Spamhaus Sender Guidelines: The Checklist in Plain English
Spamhaus's sender guidelines boil down to five minimum requirements plus list-hygiene and sending rules: confirmed opt-in, forward-confirmed reverse DNS and a resolving HELO on every sending IP, SPF, DKIM and DMARC with DKIM aligned to your From domain, a bounce rate under 5%, and unsubscribes processed within 2 days. Spamhaus published them as one resource in October 2026, and from November 2026 it's gradually enforcing the HELO and reverse DNS part.
A post in r/Emailmarketing flagged the new resource last month. Below is what's on the Spamhaus Sender Guidelines page (read 2 November 2026), with a way to check each item.
The five minimum requirements
| Requirement | What it means | How to check |
|---|---|---|
| Confirmed opt-in | "Each recipient should confirm their address by clicking a link." Unconfirmed addresses shouldn't be mailed | Your signup flow |
| Forward-confirmed reverse DNS | "Every sending IP must have a reverse DNS entry pointing to a fully qualified domain name", and that name resolves back to the IP | Reverse DNS lookup |
| HELO/EHLO resolves | "The hostname the server announces in the HELO/EHLO command must resolve to the IP" | Spamhaus's HELO checker; see the November 2026 HELO requirement |
| IPv6 | Allocations of /64 or larger, with valid rDNS | Your host's IP allocation |
| Authentication | SPF and DMARC for every sending domain, DKIM on all mail, DKIM domain aligned with the From domain | Bulk email authentication checker |
If you send through an ESP (Mailchimp, SES, Postmark and so on), the ESP runs the IPs, reverse DNS and HELO. Your part is authentication and the list.
Authentication details
- SPF: list your senders, stay within 10 DNS lookups, never
+all. The SPF lookup counter counts them. - DKIM: 1024-bit minimum, 2048-bit recommended, rotated at least yearly, with
d=matching the header From domain. - DMARC: publish a policy, set up
rua=reports, and don't stay atp=nonefor good. Our post on moving DMARC from none to reject covers the steps.
Permission and list hygiene
- Confirmed opt-in for bulk mail, with timestamped consent records.
- No purchased, rented or harvested lists; "permission is not transferable".
- A sunset policy for inactive subscribers. Spamhaus cites M3AAWG: mailboxes inactive for more than 12 months can be repurposed as spam traps.
- On traps: don't try to identify or suppress individual trap addresses. Audit and remove the source they came from.
Sending practices
| Area | Spamhaus rule |
|---|---|
| Bounces | Keep the bounce rate below 5%; suppress hard bounces immediately; investigate and remove after 3-5 consecutive soft bounces |
| Unsubscribe | One-click header for bulk senders, a visible link in the body, processed within 2 days, no login required |
| Warm-up | No engagement-inflation services; ramp slowly to engaged recipients; carry suppression lists to new infrastructure; slow ramp if you haven't sent in 90 days |
| Links | HTTPS links from your own system; avoid free or unbranded URL shorteners |
Reputation
- Avoid mailing from newly registered domains for at least 30 days. New domains sit on Spamhaus's Zero Reputation Domains list for their first 24 hours.
- Use subdomains of your own domain rather than lookalike "cousin" domains, and don't hide WHOIS for the root sending domain.
- Spamhaus doesn't explain reputation attributes or reset reputation on request.
For ESPs, a separate page asks platforms to give each customer a dedicated subdomain and to review accounts above a 5% bounce rate or 0.3% complaint rate. Our post on using one subdomain with two providers covers what that means for you as a customer. If you're already listed, see Spamhaus listings explained.
Where SimpleVerifier fits
Verification covers the bounce side: it removes invalid, disposable and dead-domain addresses so hard bounces stay well under 5%. It doesn't replace confirmed opt-in, and it doesn't identify spam traps; Spamhaus is clear that the fix for traps is the list source. The first 100 checks are free with a Google sign-in on the verify page. Pro is $39 a month with the first 100,000 checks a month at full speed, then slower, never cut off, and one-time packs of 10,000 checks for $15 never expire. See pricing.
Common questions
What are the Spamhaus sender guidelines?
A consolidated set of requirements Spamhaus published in October 2026 for avoiding its listings. They cover six areas: infrastructure and DNS, authentication, permission and list hygiene, sending practices, IP and domain reputation, and a separate page for ESPs and large senders.
Does Spamhaus require double opt-in?
Its minimum requirements list confirmed opt-in for all subscribers: each recipient confirms their address by clicking a link, and unconfirmed addresses shouldn't be mailed. Confirmed opt-in is what's often called double opt-in.
Will following the guidelines get me delisted?
They describe what Spamhaus expects to avoid a listing. Spamhaus says it doesn't reset reputation on request, so reputation recovers as your sending changes. Delisting from a specific list follows that list's own removal process.
Do these guidelines apply to cold email?
Spamhaus's permission section says not to send to purchased, rented or harvested lists and that permission isn't transferable. Cold outreach built from data providers sits outside that, which is why it carries more listing risk. The DNS, authentication and bounce requirements apply to any sender.
Check your list before you send
Real mailbox checks over SMTP, and nothing is sent to the address. Sign in with Google and your first 100 email checks are free, no card. Plans for bigger lists are on the pricing page.