What Is the Spamhaus CSS?
The Spamhaus Combined Spam Sources (CSS) Blocklist helps you identify IP addresses that are known for sending spam.
The Spamhaus Combined Spam Sources (CSS) Blocklist is a resource to identify IP addresses known to send unsolicited bulk emails, commonly referred to as spam.
Maintained by the non-profit Spamhaus Project, which tracks email spammers and spam-related activities worldwide, the CSS Blocklist is essential for protecting networks and users from spam. By using this blocklist, email providers and network admins can filter out annoying emails, keeping inboxes safe from unwanted and potentially harmful content.
CSS Blocklist: A Dataset for Spam
The Spaamhaus CSS blocklist focuses on SMTP traffic and port-25 based malicious activity detection. You might end up on this list if you send unsolicited emails, have poor email marketing practices, or send out malicious emails because of compromised accounts or content management systems (CMS). Both IPv4 (/32) and IPv6 (/64) addresses are tracked by CSS..
An Automated Blocklist for Catching Spammers
The Spamhaus CSS list is auto-generated to include IP addresses involved in sending low-reputation emails. It mainly targets static spam emitters not covered by the Policy Blocklist (PBL) or Exploits Blocklist (XBL), such as snowshoe spam operations. It also covers other high-risk senders, including compromised hosts.
The CSS Blocklist Aggregates Data for Enhanced Protection
CSS data is compiled from many sources, resulting from numerous events and heuristics. Typically, the Spamhaus Blocklist contains between 2 to 4 million entries, with 300,000 to 400,000 new listings added daily. Email administrators can use this real-time DNSBL to significantly cut down on spam and other malicious emails. Enjoy industry-leading catch rates with minimal false positives, helping to mitigate security risks, lower email infrastructure costs, and reduce workload.
How to Utilize This Dataset
To get the most out of Spamhaus’ data, implement blocklists at specific points in the email filtering process. For the CSS, it’s part of the Spamhaus Blocklist zone, a subset of SBL, and should be used during:
- The initial connection – check the connecting IP.
- After the email data is accepted, check IP addresses in the Received chain within the mail headers and look up IP addresses hosting resources in the email body, like URLs.
For more details, check out this best practice guide.
Spamhaus Blocklists are Free and Used Globally
Each blocklist targets a specific behavior. Relying on a single blocklist limits data effectiveness. Spamhaus offers three other IP-based blocklists for free:
These IP blocklists are accessible via ZEN, which combines these datasets for efficient querying.
While most malicious emails are intercepted at the SMTP transaction, many bad actors invest heavily in evading IP detection. For optimal catch rates, domain and hash blocklists should also be employed to filter emails post-acceptance. Spamhaus provides the Domain Blocklist (DBL) for free. Discover more about the importance of domain and hash blocklists here.
How to Configure the CSS Blocklist
To get your CSS blocklist up and running, you can use the data through SMTP server configuration for connection and SMTP transaction checks. Plus, there are open-source tools like SpamAssassin and Rspamd that help with content analysis. There are plugins available for both, making configuration easier, especially if you’re using Spamhaus Technology’s free Data Query Service.
How to Use the CSS Blocklist Data
Good news! Using Spamhaus DNSBLs is free for low-volume, non-commercial users. If you’re not sure, check our DNSBL usage criteria.
IP Reputation is Everything
Spamhaus’ data helps protect billions of mailboxes worldwide. To keep your IP off the list and ensure smooth email service, follow these tips:
- IP Warm-Up – Start by gradually increasing the mail sent from new IPs. Building a good reputation starts here, so it’s crucial.
- Proactive Configuration – Make sure your new IPs are properly set up at least 30 days before your first send.
- Restrict Outbound SMTP Traffic – Configure your firewall to allow outbound SMTP traffic (destination port 25) only from your mail server’s internal IP.
- Infrastructure – Double-check your internet infrastructure providers, like ISPs. Check out reputation statistics on ISPs/networks.
- Use Double Opt-In – Avoid spam traps and make sure only genuine, interested recipients get your emails.
- Configuration – Ensure your hostname and HELO match, and your reverse DNS (PTR record) points to the same hostname.
How to be Removed from a CSS Block
If your IP ends up on the CSS blocklist, just visit https://check.spamhaus.org for more info. That’s the one place where CSS removals are dealt with.