The Spamhaus Project · IP addresses only (IPv4 /32 and IPv6 /64). Despite the "Composite Snowshoe" name, CSS lists IPs, not domains — Spamhaus now officially calls it "Combined Spam Sources." Domain reputation is handled separately by the Spamhaus DBL.
Spamhaus CSS (Composite Snowshoe / Combined Spam Sources)
CSS is an automatically generated subset of the Spamhaus Blocklist (SBL) that lists IP addresses sending low-reputation email — primarily static spam emitters not already caught by the PBL or XBL, with a heavy focus on snowshoe spam. It is highly aggressive and purely algorithmic: it reacts quickly to suspicious sending patterns and can list a single /32 or an entire range based on multiple heuristics. It typically holds millions of listings at any time and adds hundreds of thousands of new ones daily.
Why you get listed
- Snowshoe spamming — spreading low-volume sends across many fresh IPs and domains to dodge reputation/volume filters
- Sending unsolicited email / poor list hygiene (high invalid, spam-trap, or complaint rates)
- Mail from IPs Spamhaus heuristics associate with known bad actors or spam operations
- A compromised, insecure, or misconfigured mail server (e.g. open relay, hijacked host) emitting bad mail
- Infected websites/CMS, bots, or insecure applications/devices sending from the IP
- Newly provisioned 'cold' IPs that behave like a snowshoe pattern (low-rep blocks of consecutive IPs)
Impact
Very high. CSS is bundled into Spamhaus ZEN (zen.spamhaus.org), the single most widely deployed DNSBL in the world, so a CSS listing is consumed by a huge share of mail receivers — including Microsoft/Outlook/Hotmail, which lean heavily on Spamhaus. A listed IP sees mail rejected or deferred at the SMTP edge ("blocked using Spamhaus"), not just filtered to spam. Because CSS targets the actual sending IP, it hits the whole IP's outbound mail, and on shared infrastructure it can affect neighbors.
How to delist from Spamhaus CSS (Composite Snowshoe / Combined Spam Sources)
- First, identify and FIX the root cause — CSS is purely behavioral, so removing before fixing is pointless: it re-lists immediately if abuse is still detected. Check server logs, secure compromised hosts/CMS, close open relays, and clean your mailing lists (remove invalid addresses and spam traps).
- Go to the IP & Domain Reputation Checker at https://check.spamhaus.org and enter the listed IP address.
- Confirm the listing is CSS specifically (the result page identifies which dataset — CSS vs SBL/PBL/XBL — and links the removal flow). check.spamhaus.org is the ONLY place CSS removals are handled.
- Use the self-service removal option shown for the CSS listing on that page. No evidence submission or manual ticket is required for CSS (unlike SBL), but be aware Spamhaus LIMITS how many times you can self-remove an IP — repeated removals are capped and signal the abuse isn't actually fixed.
- Because listings auto-expire ~3 days after the last detected spam, the most reliable fix is often simply to stop the bad sending and let the listing lapse; only self-remove once you are certain the cause is corrected.
- If it keeps re-listing (or you've exhausted self-removals), the underlying abuse/compromise is ongoing — re-investigate rather than repeatedly requesting removal. Warm new IPs slowly to avoid a snowshoe-like signature.
Good to know
- Auto-expires: CSS listings normally drop ~3 days after the last spam is detected, so a fixed problem often clears itself without any manual action (chronic-abuse cases can persist longer).
- Self-removal is allowed but LIMITED — Spamhaus's own CSS FAQ states 'self-removals are limited,' so you cannot keep self-delisting an IP that keeps re-offending. And any removal is futile if the cause isn't fixed: CSS re-lists immediately if it still sees the problem.
- Don't confuse the Spamhaus lists: SBL requires a manual removal request (you submit evidence and a human reviews), PBL is a policy list removed via a different self-service flow (it lists IP ranges that shouldn't send direct-to-MX mail), and CSS is self-service removal at check.spamhaus.org. There is no separate 'CSS removal team' to email.
- Spamhaus provides NO spam samples for CSS listings — they expect you to find the cause yourself via server logs and list hygiene. The old 'Blocklist Removal Center' URL is retired; everything now lives at check.spamhaus.org (the IP & Domain Reputation Checker).
Stay off the lists in the first place.
Most listings trace back to volume spikes, bad lists, and cold domains. Scheduler Zero warms your domains, paces sending, and keeps your lists clean so you build reputation instead of blacklisting yourself.