On October 21, 2026, Spamhaus published its Sender Guidelines, a single rulebook for staying off its IP and domain blocklists. The document lists confirmed opt-in, often called double opt-in, among five minimum requirements that apply to every sender, from a small company’s mail server to the largest email platforms.
The launch post also sets a date. Starting in November 2026, Spamhaus says it is “gradually rolling out enforcement of basic DNS requirements over several months”: a valid HELO, a reverse DNS (PTR) record and a matching A record for every sending IP address.
Six areas and a page for platforms
Spamhaus, founded in London in 1998 by Steve Linford and now based in Andorra, is a nonprofit. It publishes reputation lists that mail servers query to filter incoming mail, and it says it protects 4.5 billion user mailboxes. According to its post, the question it gets asked most is how to stay off its blocklists, and the guidance had been spread across FAQs, blog posts and support tickets.
The new document covers six areas: minimum requirements, infrastructure and DNS, permission and list hygiene, authentication, sending practices, and IP and domain reputation. A separate page addresses email service providers (ESPs) and large senders. Spamhaus thanks Laura Atkins, Jennifer Nespola Lantz and Matthew Vernhout for reviewing it.
Five minimum requirements
The first item requires confirmed opt-in for every subscriber, and the permission section applies it to all bulk email. Subscribers click a link in a confirmation email, and until they do, the address should not be mailed. Spamhaus calls purchased, rented and harvested lists the most common source of spam trap hits, and says hitting traps is “one of the fastest routes to a listing.”
The other four items are technical. Every sending IP needs reverse DNS that points to a fully qualified domain name, and that name must resolve back to the same IP. The hostname the server announces in its HELO or EHLO command must resolve to the connecting IP and stay consistent across connections. Mail sent over IPv6 must come from an allocation of at least a /64 with valid reverse DNS.
Every sending domain must also publish SPF and DMARC records and sign all of its mail with DKIM, using a signing domain aligned with the visible From address. A guide to taking a site live, from the domain name to a business email address shows how all three records go into the domain’s DNS zone.
The DNS check that starts in November
The post names lack of permission and DNS as the two most common reasons for a listing. On the DNS side, the usual culprits are an invalid HELO, no reverse DNS record or no matching A record. A poorly configured server, Spamhaus writes, can easily be mistaken for a compromised machine or a spammer.
The guidelines page spells out the defects: placeholder values such as “localhost,” generic hostnames assigned by the hosting provider, and HELO names that change between connections. Failing these checks can get an IP listed in one of two Spamhaus zones, CSS for IPs that send spam or XBL for compromised machines.
An online checker, released with the guidelines, compares a sending IP’s setup against the requirements. Spamhaus warns that results are not available for every IP and may not reflect recent changes.
Hard numbers for senders
The overall bounce rate must stay below 5%. DKIM keys must be at least 1,024 bits (2,048 recommended), and SPF records are capped at 10 DNS lookups. Bulk commercial senders must implement the RFC 8058 one-click unsubscribe header. Every commercial email must carry a visible unsubscribe link, and requests must be honored within two days.
Several rules cover new IP addresses and domains. Warm-up services that fake opens, clicks or replies get the IP or domain listed, and the infrastructure behind them will itself be listed as a spam-enabling service. A domain registered in the past 24 hours lands on the Spamhaus Zero Reputation Domains (ZRD) list, and a domain that starts sending mail less than 30 days after registration is treated with suspicion.
The page for email platforms asks them to regularly verify that their customers use confirmed opt-in. Above a 5% bounce rate or a 0.3% complaint rate, a platform should throttle or review the customer account. Its acceptable use policy must ban buying, renting or harvesting lists.
How Spamhaus compares with French law, Gmail and Yahoo
Spamhaus is a private organization, and its rules carry no legal force. Their weight comes from the mailbox providers that use its lists. On August 11, 2025, Al Iverson, author of the deliverability blog Spam Resource, listed Apple iCloud, Microsoft, Yahoo and Proofpoint among the providers that reject mail based on Spamhaus listings, along with Orange and SFR in France.
France’s data protection authority, the CNIL, requires consumers to agree to marketing email in advance through a positive action, such as checking a box that is not pre-checked. Its page on the topic, dated June 10, 2026, says nothing about a confirmation email. For business recipients, notice and a right to object are enough when the message relates to their job. A guide to GTM engineering sums up the CNIL rules and Belgium’s APD rules for B2B prospecting.
French law treats double opt-in as optional, and Spamhaus makes it a condition for staying off its lists. The rest of the Spamhaus rules largely overlap with the ones Gmail and Yahoo have enforced since February 2024, with different thresholds.
| Item | Spamhaus (October 21, 2026) | Gmail | Yahoo |
|---|---|---|---|
| Confirmed opt-in | Required for all subscribers | Recommended (verify every address), not required | Recommended, not required |
| SPF, DKIM and DMARC | Every sending domain | Over 5,000 messages a day to Gmail | Bulk senders |
| Valid reverse DNS | Every IP, phased checks from November 2026 | All senders | All senders |
| One-click unsubscribe | Bulk commercial senders | Over 5,000 messages a day to Gmail | Bulk marketing mail |
| Hard threshold | Bounces under 5% | Spam under 0.3% | Spam under 0.3% |
Gmail and Yahoo accept a DMARC policy set to “none.” Spamhaus requires a defined policy and advises against leaving it at “none” long term.
Limits of the guidelines
Spamhaus writes that “these guidelines aren’t new rules.” It says they draw on IETF RFCs, mailbox providers’ best practices and what responsible senders already do, with extra emphasis on DNS. The November DNS check is the only dated change, and the post does not say how it will be phased or how fast.
The guidelines do not say at what point a signal triggers a listing, not even for the 5% bounce cap. Spamhaus says it weighs several signals before assigning a reputation, and that one strong negative signal can outweigh the absence of positive ones.
On October 22, Steve Atkins, a partner at Word to the Wise, a U.S. deliverability consultancy, called the guidelines “very clear, very precise and generally very good” on the firm’s blog. He founded the firm in 2001 with Laura Atkins, one of the three people Spamhaus thanks for reviewing the text.
What it means
For senders that already meet the Gmail and Yahoo requirements, little changes on the technical side. The difference is double opt-in, which both providers recommend but do not require. The document pulls scattered rules into one place, and the Spamhaus reputation checker gives the same guidance to addresses that are already listed.
The November DNS check mainly affects machines that deliver their own mail: in-house mail servers, virtual servers, and sites and apps that send transactional email from their own hosting. Customers of email platforms send through those platforms’ infrastructure, and the Spamhaus ESP page makes the platforms responsible for HELO and reverse DNS setup.
Double opt-in reaches further, because it is about how lists are built, whatever tool sends the mail. That covers newsletters, which the complete guide to organic marketing counts with the website among the channels a business owns.
Two questions remain open: how many addresses the DNS check will get listed, and how Spamhaus will verify that platforms check their customers. M3AAWG, the Messaging, Malware and Mobile Anti-Abuse Working Group, holds its 68th General Meeting in Paris from October 26 to 29, days before the Spamhaus rollout is due to begin.
Sources
- One clear set of rules: the Spamhaus Sender Guidelines, Spamhaus, October 21, 2026
- Sender Guidelines, Spamhaus, October 21, 2026
- ESP & Large Sender Guidelines, Spamhaus, October 21, 2026
- Spamhaus’ Sender Guidelines, Word to the Wise, October 22, 2026
- Does Spamhaus matter today?, Spam Resource (Al Iverson), August 11, 2025
- La prospection commerciale par courrier électronique, SMS-MMS et automate d’appel, CNIL, June 10, 2026
- Consignes pour les expéditeurs de messages, Google, accessed October 23, 2026
- Sender Best Practices, Yahoo Sender Hub, accessed October 23, 2026
Header image: MACCUS diagram, Spamhaus data (Sender Guidelines, October 21, 2026)
