Plesk Server Blacklisted? How to Get Your IP Delisted
One hosted domain's compromised contact form can get your whole Plesk server's IP blacklisted. Here is how to find the cause and get delisted properly.
A Plesk server blacklisted on a major list like Spamhaus or Barracuda affects every domain hosted on that IP, not just the one that caused it. Filing a delisting request without fixing the actual cause first just gets you re-listed within days, so the order of operations matters more than the speed.
Confirm which list flagged you, and why
Do not assume. Different lists (Spamhaus, Barracuda Reputation Block List, SORBS, UCEPROTECT) flag for different reasons, ranging from confirmed spam sends to simply being on a range of IPs previously abused by someone else.
dig +short YOUR_IP.zen.spamhaus.org
dig +short YOUR_IP.bl.spamcop.netA non-empty response means you are listed on that block. For a full picture faster, run the IP through mxtoolbox.com/blacklists, which checks dozens of lists at once and links directly to each one's delisting page and stated reason.
Find which domain or account actually caused it
Plesk's mail logs live at /var/log/maillog (or /var/log/mail.log depending on the OS under Plesk). Rank outbound volume by sender to find the outlier.
grep 'from=' /var/log/maillog | grep -oP 'from=<\K[^>]+' | awk -F@ '{print $2}' | sort | uniq -c | sort -rn | head -20The domain sending an order of magnitude more mail than everything else is your source. Cross-check it against Plesk's own outgoing mail limits and usage, visible per subscription and per domain under Tools & Settings > Mail Server Settings > Custom Limits, to confirm the volume is real and not a logging artifact.
Once you have the domain, the cause is nearly always one of: a compromised CMS plugin calling PHP's mail() directly, a contact form with no rate limiting that got scripted against, or a customer's mailbox password guessed via IMAP brute force and used to relay through your own SMTP. Check IMAP and SMTP auth logs for repeated failed logins from unfamiliar IPs to rule the last one in or out.
grep 'authentication failed' /var/log/maillog | awk '{print $NF}' | sort | uniq -c | sort -rn | head -10Fix the source before you touch the blacklist
-
1
Suspend or rate-limit the domain
In Plesk, disable the subscription temporarily under Websites & Domains, or set a per-domain email limit under Tools & Settings if you want to keep the site live while investigating.
-
2
Reset every credential the compromised path touches
The domain's Plesk mailbox passwords, the CMS admin password, and any application-level SMTP credentials stored in config files.
-
3
Remove the malicious script or clean the plugin
Search for recently modified PHP files in the domain's document root and compare against a clean copy of the plugin or theme if one is available.
-
4
Clear only that domain's queued mail
postqueue -p | grep -B2 baddomain.com | grep '^[A-F0-9]' | awk '{print $1}' | tr -d '*!' | postsuper -d -removes queued messages tied to the compromised domain without touching the rest of the queue.
Cleaning one compromised account is an afternoon. Watching every hosted domain's outbound volume for the next spike, on every server you run, is the part that does not scale to a person checking logs manually. BashEmail tracks per-domain sending volume across the whole server and flags an outlier before it reaches a blacklist threshold, rather than after a customer reports bounced mail.
Catching an outbound spike before it becomes a blacklist
One domain is sending well outside its normal range for this time of day.
| Domain | Last 24h | 7 day average | Status |
|---|---|---|---|
| shop-widgets.net | 8,412 | 140 | flagged |
| 31 others | normal | normal | ok |
orders@shop-widgets.net accounts for 8,100 of the 8,412 messages, well outside its normal volume. Applying Plesk's per-mailbox outgoing limit to stop it before this pushes you toward a blacklist threshold.
plesk bin mail --update orders@shop-widgets.net -outgoing-messages-mbox-limit 50Try this on one of your own servers.
Start free trialRequest delisting from the specific lists that flagged you
- Spamhaus: use the Spamhaus Block List Removal Center at their site, which requires you to confirm the cause is resolved before it processes the request.
- Barracuda Reputation Block List: submit through their public lookup and removal form, typically processed within a few hours once resubmitted.
- SORBS and UCEPROTECT: both have longer cooldown windows and are more sensitive to repeat listings, so only submit once you are certain the cause will not recur.
- Do not pay a third party to expedite delisting. Every major list's process is free and the fastest path is a genuinely fixed root cause, not a faster form submission.
Verify delivery actually recovered
Delisting from one blacklist does not mean every mail provider trusts you again immediately, some maintain their own internal reputation scoring on top of public lists.
dig +short YOUR_IP.zen.spamhaus.orgAn empty response confirms the public list cleared. Follow up with a real test send through mail-tester.com or to a Gmail account you control, and read the delivered message's headers for Authentication-Results and any spam score the receiving server attached.
Prevent the repeat
- Set a conservative per-domain hourly send limit as a default for every new subscription in Plesk, not just the one that got flagged.
- Enable Plesk's fail2ban integration for mail services to slow down IMAP and SMTP brute force attempts before they succeed.
- Keep a standing alert on outbound queue size and per-domain volume, since the earliest sign of a compromise is always in the numbers before it becomes a blacklist notice.
