Proofpoint (final operator; decommissioned the service). Originally founded by Michelle Sullivan in 2001; acquired by GFI Software in 2009, then by Proofpoint in 2011. · Primarily IP addresses, plus some domain listings via its RHSBL zones (rhsbl.sorbs.net / badconf.rhsbl.sorbs.net).
SORBS (Spam and Open Relay Blocking System)
SORBS was one of the oldest and largest free DNS-based blocklists (DNSBL), a confederation of 18 distinct DNS zones each targeting a different abuse category (spam sources, open relays, open proxies, dynamic IPs, botnet zombies, bad DNS config, etc.). It had a reputation as one of the more aggressive and controversial lists, using 'escalated' listings that blocked entire IP ranges and a 'block' zone where delisting effectively required a payment/donation. IMPORTANT: SORBS is DEAD. Proofpoint permanently decommissioned it on June 5, 2024, emptying all 18 zones; it holds no reputation data, has no successor, and the sorbs.net website/domain itself no longer resolves (DNS returns NXDOMAIN for sorbs.net, www.sorbs.net, and the dnsbl.sorbs.net query zones).
Why you get listed
- Spamhaus-style spam evidence: the IP sent mail to spamtraps or generated abuse complaints (spam.dnsbl.sorbs.net and its new/recent/old sub-zones)
- Running, or having historically run, an open SMTP relay (smtp.dnsbl.sorbs.net)
- Running an open/misconfigured proxy: HTTP proxy, SOCKS proxy, or other web proxy (http/socks/web/misc.dnsbl.sorbs.net)
- Being a dynamic/residential or generically-assigned IP not meant to send mail directly (DUHL - dul.dnsbl.sorbs.net), often listed by IP-range policy rather than observed behavior
- Compromised/botnet-infected host emitting spam (zombie.dnsbl.sorbs.net)
- Hosting infrastructure tied to spam, plus 'escalations' that expanded a listing to a whole netblock when an ISP was unresponsive (escalations.dnsbl.sorbs.net)
- Bad reverse-DNS / hostname configuration for a domain (badconf.rhsbl.sorbs.net) or a spam-associated domain (rhsbl.sorbs.net)
Impact
Historically meaningful: SORBS was widely queried (often via the aggregated dnsbl.sorbs.net zone) by mail servers, hosting providers, and appliances, so a listing could cause rejected or deferred mail at receivers that used it. As of now the listing has ZERO real impact: every zone was emptied on 2024-06-05 and the query zones return NXDOMAIN, so SORBS produces no hits and any well-configured server has stopped (or should stop) querying it. A 'SORBS listed' result in a monitoring tool today is a stale/cached artifact, not a live deliverability problem. The bigger risk now is operational, not reputational: mail servers still configured to query a sorbs.net zone are hitting a dead/dangling resolver, which can add latency or unpredictable behavior to inbound mail handling.
How to delist from SORBS (Spam and Open Relay Blocking System)
- First, recognize there is nothing to delist and no delisting URL to use: SORBS shut down on June 5, 2024, all 18 zones are empty, and the sorbs.net site itself no longer resolves. The old self-service delist form, account login, and support tickets are gone.
- If a blacklist-checker still shows you on SORBS, treat it as a stale/cached entry in that tool's database, not a live listing - it requires no action from you and will clear as tools drop SORBS.
- On your OWN mail servers, remove every reference to *.sorbs.net (e.g. dnsbl.sorbs.net, spam.dnsbl.sorbs.net, dul.dnsbl.sorbs.net) from your DNSBL/RBL configuration so you stop querying a decommissioned service that only adds latency.
- Redirect remediation effort to lists that are still live: check Spamhaus (ZEN/SBL/PBL), Barracuda, Microsoft SNDS/JMRP, and Google Postmaster Tools instead.
- Fix the underlying cause that would have gotten you listed anywhere: close any open relay/proxy, secure compromised hosts, ensure valid reverse DNS, and publish SPF, DKIM, and DMARC.
Good to know
- DEAD LIST - Proofpoint decommissioned SORBS on 2024-06-05, emptied all 18 DNS zones, and the sorbs.net domain itself no longer resolves (verified: NXDOMAIN for sorbs.net, www.sorbs.net, and dnsbl.sorbs.net). There is no successor and no delisting process. The former official pages (the lookup at http://www.sorbs.net/lookup.shtml and the delisting overview at http://www.sorbs.net/delisting/overview.shtml) are completely offline - do NOT use them. The delistingUrl/checkUrl above point to live third-party pages that document the shutdown.
- A 'SORBS listing' surfaced by a third-party multi-RBL checker today is almost always a stale cache in that tool, not a real block. Don't chase a delist for it.
- The DUHL (dul.dnsbl.sorbs.net) was policy-based, not behavior-based: dynamic/residential IP ranges were listed by default to discourage direct sending - that was expected, not a sign your IP was caught spamming.
- Action item if you still see SORBS anywhere in your own stack: strip *.sorbs.net out of your mail server's RBL config, since querying the dead/non-resolving zones just adds resolution latency to inbound mail.
Stay off the lists in the first place.
Most listings trace back to volume spikes, bad lists, and cold domains. Scheduler Zero warms your domains, paces sending, and keeps your lists clean so you build reputation instead of blacklisting yourself.