On 21 October 2026, Spamhaus published a unified set of sender guidelines. A cold list cannot click a confirmation link, and the guidelines make that distinction sharper than it has been in years. This is for the person who loads a sequence, and for the person who controls the DNS on the IP that sequence uses.
The question Spamhaus hears most is how to stay off its blocklists. Its answer is the same one it has given for 20 years: send only to people who asked, and set the infrastructure up properly. The guidelines are written for anyone running a mail server — a small team on its own setup, and an email service provider. Spamhaus says these are not new rules. They collect IETF standards, mailbox-provider practice, and a heavier emphasis on DNS than earlier guidance carried.
The five requirements Spamhaus puts at the top
On the guidelines page, five requirements are marked as the checklist for avoiding a listing. Confirmed opt-in is the first.
Each subscriber confirms the address by clicking a link in a confirmation email. Without that click, do not mail the address. Lists that were never confirmed — purchased, rented, or scraped — are named as the most common source of spam-trap hits. Hitting traps is called one of the fastest routes to a listing.
Every sending IP has forward-confirmed reverse DNS. The PTR record points to a fully qualified hostname, and that hostname resolves back to the same IP. Missing or mismatched reverse DNS is treated as suspicious.
The HELO or EHLO hostname resolves to the connecting IP and stays the same across connections from that IP.
localhost, a hosting-provider default, and a hostname that changes between connections can each cause a listing.If you send over IPv6, the address sits in an allocation of /64 or larger, with valid reverse DNS.
Every sending domain publishes SPF and DMARC. Every message carries a DKIM signature. The DKIM domain aligns with the domain in the visible From header (RFC 5322).
Lack of permission and bad DNS are the two reasons Spamhaus names most often. A poorly configured server can be mistaken for a compromised host or a spammer. Fail the DNS items, and the IP can land on the Email Spam IPs zone (CSS) or the compromised-IP zone (XBL).
Why a cold list fails the opt-in test
Confirmed opt-in means a click on a link in a confirmation message. A list exported from a database, scraped from the web, or bought from a vendor has no such click on record. Spamhaus also says permission does not transfer between organizations or domains. Keep a record of when and how each address confirmed — timestamp and source.
Sending a confirmation message first does not turn the rest of the sequence into opt-in mail. The rule is clear: do not mail an address until the confirmation has come back. That first unsolicited message is already the send the rule tells you not to make.
For teams running cold outbound, this does not mean giving up on email. It means deciding which domains and sending identities carry confirmed mail and which ones carry first-touch cold sequences — and keeping them separate. The older notes on this site about cold email outreach and improving deliverability still describe how a cold sequence is built once a list exists. Those pages are unchanged. They do not satisfy the confirmation requirement on their own, and they were never meant to.
What you can still fix before November
Starting in November 2026, Spamhaus is rolling out enforcement of basic DNS over several months. Every sending IP will need a valid HELO, a PTR record, and a matching A record. The announcement does not give a week-by-week timetable inside those months, only that the rollout begins in November and continues into 2027.
You can check your setup now. Go to the Spamhaus sender guidelines page, enter the sending IP, and run "Check HELO/DNS." Alternatively, send a message to helocheck@abuseat.org to see the HELO your server is actually announcing. Results are not available for every IP, and they may lag a change you just made. If the IP is already listed, the reputation checker at check.spamhaus.org is the troubleshooting path Spamhaus points to.
While you are in the DNS, the authentication section adds limits that sit beside requirement 5:
SPF stays within 10 DNS lookups, nested
includemechanisms counted. Over the limit, the result is a PermError — not a pass.DKIM uses at least a 1024-bit key. Spamhaus recommends 2048-bit. The
d=domain matches the header From.DMARC is published. Starting at
p=noneis allowed, but staying there permanently is not. The guidelines ask for an enforcement policy eventually.
New domains and the warmup services that get you listed
A HELO domain with no sending history faces additional filtering. Domains registered in the past 24 hours go on the Zero Reputation Domains list. Domains used for mailing within 30 days of registration are treated as suspicious. Spamhaus recommends waiting at least 30 days for a newly registered domain, and not using one as the SMTP From or HELO name until it has been warmed. Even a new domain inside the email body can weigh on reputation.
Extra mailstreams belong on subdomains of the brand. Cousin domains — names registered to resemble the brand for another stream or country — are on the list of things not to do. A different DKIM d= domain per stream, transactional separate from marketing, lets each stream build its own reputation independently.
This is where the warmup conversation gets specific. Services that simulate opens, clicks, or replies to make a domain look warm will get the IP or the domain listed. Infrastructure run to inflate engagement can be listed as a spam-enabling service. The warmup Spamhaus describes is simpler: slow, consistent volume on an IP or domain that has not sent in the past 90 days, aimed first at recipients who already engage. Carry the suppression list over — old bounces and unsubscribes are not mailed again.
When a platform sends your mail
The ESP and large-sender page says everything in the main guidelines applies to mail sent through a platform. The platform is expected to verify that customers use confirmed opt-in, and its acceptable-use policy should prohibit lists that were never confirmed. Moving the send from your own server to a shared platform does not create the confirmation click.
What the platform owns is the HELO and reverse DNS, unless it has branded those records to your hostname. The page asks operators to make the HELO, the PTR, and the A record the same hostname, and to give each customer a dedicated subdomain used as both the From domain and the DKIM domain. At the customer-account level, bounce rates above 5% or complaint rates above 0.3% trigger throttling or a manual review.
Ask your platform which hostname your IP announces. The list decision — whether each address actually opted in — stays on your side. A platform cannot confirm an address your list never asked.
The sending limits that sit next to permission
Under sending practices, the overall bounce rate stays below 5%. Hard bounces are suppressed immediately. Bulk commercial mail includes the one-click unsubscribe header from RFC 8058 plus a visible unsubscribe link in the body. Unsubscribe requests are acted on within 2 days and added to the suppression list. The link is not hidden, and unsubscribing does not require the recipient to log in.
List-validation software is not treated as a substitute for permission, and it is not treated as a way to find spam traps. Spamhaus says its traps do not subscribe and do not engage — there is no technical shortcut around the confirmation requirement.
One more thing worth keeping in mind: a strong negative signal can outweigh a stack of missing positives. Passing SPF, DKIM, and DMARC does not offset a list that was never confirmed. The DNS passes. The permission doesn't. Spamhaus sees both.
Two checks to run before your next import
Most of the November requirements are DNS-level, and fixing them is a matter of configuration rather than a rewrite of your sending setup. Start there.
Open the Spamhaus sender guidelines and enter the sending IP in the HELO checker — or send a test message to helocheck@abuseat.org. Hand the result to whoever can change that IP's PTR and HELO records. If you are on a shared platform, ask the platform which hostname your IP announces, and confirm that the PTR, HELO, and A record match.
Then answer one list question. For each address in the next sequence: is there a confirmation click, with a timestamp and a source? Unverified addresses fail that test. Take them out of the confirmed-mail stream and route them through a separate sending identity if you plan to continue cold outreach.
The announcement, with the November wording, is here: One clear set of rules. Operators on shared infrastructure should also read the ESP and large-sender page. The five requirements on the guidelines page are the full checklist. This article is a reading of them for cold outbound — not a replacement for the original.
If you are setting up a cold email sequence from scratch, see our guide on cold email outreach. If deliverability is already a problem, start with improving deliverability.
