Where you saw it: Bounces naming spamcop.net, a blocklist checker flagging the SCBL, or delivery failing at providers that query it.
Why it happens
- Users reporting your mail through SpamCop's reporting system, which is where most of their data comes from.
- Mail reaching SpamCop's spam traps, often through a purchased or scraped list.
- A short, sharp volume spike that triggered their ratio-based threshold.
- A compromised account sending through your infrastructure.
- A shared IP where another sender generated the reports.
The fix, in order
Look up the IP on SpamCop
Their listing page shows sample reports and the time of the most recent one, which usually identifies the campaign or the compromised source.
Read the sample evidence
SpamCop shows redacted examples. It is often immediately obvious which campaign or which account generated them.
Stop the source
Pause the campaign, suspend the compromised account, or fix the abused form. The listing expires by itself once reports stop, so stopping is most of the fix.
Wait rather than escalating
SCBL listings expire automatically after a period without new reports, typically measured in hours or days. There is usually nothing to request.
Fix the list quality behind it
Trap hits mean the list contains addresses that were never opted in. Cleaning the list reduces recurrence; it does not remove the pristine traps, which nobody can detect.
How to know it worked
The short version
- The SpamCop lookup shows the IP as not currently listed.
- No new reports appear against the IP over several days.
- Delivery recovers at receivers that query the SCBL.
Checking the listing from a terminal
SpamCop's list is a DNS zone, so you can query it yourself. Reverse the octets of your IP and append bl.spamcop.net. For 203.0.113.45 the command is dig +short 45.113.0.203.bl.spamcop.net. An answer of 127.0.0.2 means listed. No answer at all means not listed. To prove the lookup works from your machine, query the test entry, 2.0.0.127.bl.spamcop.net, which should always return 127.0.0.2.
Ask for the TXT record on the same name and you get the pointer that receivers quote in their bounces, a line starting "Blocked - see" followed by a spamcop.net URL ending in your IP. A Postfix server using the list rejects with something like 554 5.7.1 Service unavailable; Client host [203.0.113.45] blocked using bl.spamcop.net. If your bounce names a different zone, you're on a different list.
How the score is built, by SpamCop's published rules
SpamCop's published listing rules explain why waiting works. The most recent reports count four times as much as reports about mail 48 hours old or older, with a sliding scale in between, and reports about mail received more than a week ago are ignored. Without new reports, an address stays listed for only 24 hours. A single report never lists an IP, and with only two reports the listing lasts at most 12 hours after the most recent reported mail.
Trap hits weigh more than user reports. For a trap score under 6, the quantity of trap reports is multiplied by five before it's added to the total, and for larger scores the quantity is squared. That's why a scraped or purchased segment lists you faster than an annoyed subscriber base does.
Say you send 40,000 messages on Tuesday morning and you're listed by noon. If you pause the campaign then and nothing new is reported, the listing should lapse around Wednesday noon. If it's still there on Thursday, reports are still arriving, so look for a second source: a retry queue still draining, an autoresponder, or a compromised account.
Questions people ask
How do I get off SpamCop?
Usually by stopping whatever generated the reports and waiting. The list expires entries automatically once new reports stop arriving.
Does SpamCop affect Gmail delivery?
Not directly. Google runs its own filtering. SpamCop matters at the smaller and mid-sized receivers that query it at connection time.
Why does the listing keep coming back?
Because the source has not stopped. Either a campaign is still running to a list with traps in it, or an account on your infrastructure is compromised.