SURBL Declares War on Cold Email: Why 90% of Domains We Tested Are Already Blacklisted

Cold email has a new enemy, and it isn't a spam filter tweak or an algorithm update — it's a blacklist that used to sit quietly in the background, mostly known for catching phishing links. In 2026, SURBL has turned into one of the most consequential threats to cold outreach, and almost nobody sending cold email is watching it closely enough.

We didn't want to speculate about this one. So we pulled live data on 2,679 active cold-email sending domains and ran every single one directly against SURBL's Multi blacklist (multi.surbl.org), verified against SURBL's own permanent test domain to make sure the results were real and not just rate-limiting. Here's what we found.

90% of the Domains We Tested Are Already Listed

Out of 2,679 live cold-email sending domains checked, 2,419 — 90.3% — came back listed on SURBL Multi. Only 260 domains, just under 10%, were clean.

If you send cold outreach in 2026 and you haven't checked your domains against SURBL recently, the base rate says you should assume you're already affected until you've actually looked.

It's Not Phishing. It's Not Malware. It's Abuse — Every Single Time.

SURBL Multi is actually a combined feed of several sub-lists: phishing (PH), malware (MW), compromised/cracked sites (CR), and abuse (AB), among others. Each one flags a different kind of problem.

We decoded the sub-list for every one of the 2,419 listings we found. 100% of them — every single one — came back under the AB (abuse) sub-list. Zero phishing hits. Zero malware hits.

That matters, because it rules out the explanation a lot of senders reach for first ("SURBL thinks my domain looks like a phishing lookalike"). This isn't a phishing-detection issue. It's an abuse-reporting issue — the kind of signal that comes from spam complaints and trap hits, not from anything resembling a scam page.

The Real Predictor Isn't Content. It's Infrastructure.

Here's the finding that actually explains the pattern. We split the domains into two groups based on their sending infrastructure — domains sitting on a shared, pooled sending setup (the same outbound mail servers used across many different customers/domains at once) versus domains on separate, dedicated, or otherwise non-pooled infrastructure.

Infrastructure type	Domains checked	% listed on SURBL Multi
Shared / pooled sending infrastructure	2,327	99.7%
Dedicated / non-pooled infrastructure	352	27.8%

That's a nearly 4x difference, and the pooled-infrastructure number sits right at a ceiling — 99.6–100% listed no matter how we sliced it. We also found something that made the mechanism click: the shared mail infrastructure domain itself was directly listed on SURBL Multi, under the same abuse sub-list, independent of any individual customer domain.

The likely read: when a lot of different sending domains share the same outbound mail servers, it only takes a fraction of that shared pool generating spam complaints or hitting spam traps for the entire pool's reputation to degrade — and every domain riding on that infrastructure inherits the hit, whether or not it personally did anything wrong. This is a shared-reputation problem, not a per-domain content problem.

Two Popular Theories We Tested — and Killed

Two explanations circulate constantly in cold-email communities right now. We had the data to actually check both.

"It's because everyone bulk-buys domains on the same day." We grouped domains by how many were set up together on the same day, as a proxy for bulk purchasing, and compared listing rates. Once you control for whether a domain is on shared infrastructure, batch size stops mattering — domains on shared infra are already listed at ~100% regardless of whether they were bought solo or in a batch of 50. Bulk buying doesn't independently predict a listing; it just correlates with being on shared infrastructure in the first place.

"It's because of get-/try-/use- style alias domain names." This is the theory we hear most often — that SURBL is specifically targeting alias-style secondary domains. We tagged every domain for common alias prefixes and compared listing rates. On shared infrastructure, alias-prefixed domains listed at 99.4% versus 99.9% for non-alias domains — essentially no difference. Off shared infrastructure, alias-prefixed domains were actually less likely to be listed than non-alias domains (18.4% vs. 31.5%) — the opposite direction the theory predicts. We don't see support for this one in the data.

What About Redirects?

We also tested whether domains redirecting to a different destination correlated with listings — a theory that lines up with SURBL's own published concern about redirect sites being used to "wash" and disguise already-blocked destinations. Our sample here was small and several domains had no live website at all to test, so we're not going to claim a verdict either way. If you're testing your own domains, this is worth checking domain by domain rather than assuming it either matters or doesn't.

What This Means If You're Sending Cold Email in 2026

The data points to one dominant, actionable conclusion: your own list hygiene and content matter less here than who you're sharing sending infrastructure with. A domain with perfect SPF/DKIM/DMARC and zero links in the email body can still get swept into an abuse listing if it's riding on infrastructure shared with senders who generate complaints.

A few things worth doing given this:

Check every active sending domain against SURBL directly rather than assuming you'd notice — most senders find out only after inbox placement quietly craters. If you're on any kind of shared or pooled sending setup, ask directly what isolation exists between your reputation and everyone else's on that pool. And don't chase the alias-domain-naming theory or the bulk-buying theory as your root cause fix — the data doesn't support either as the actual driver.

You can check any domain against SURBL and 34 blacklists in seconds with our free blacklist checker — and see the full breakdown of what SURBL actually is and how delisting works on our SURBL wiki page.

FAQ

What is SURBL Multi? SURBL Multi (multi.surbl.org) is a combined DNS-based blacklist that aggregates several sub-lists — abuse, phishing, malware, and compromised-site feeds — into a single lookup. A domain can be flagged by any one of these sub-lists and show up as "listed" on Multi.

How do I check if my domain is on SURBL? Run it through a blacklist checker that queries multi.surbl.org directly, like our free blacklist checker, or query yourdomain.com.multi.surbl.org yourself and check whether it resolves.

How do I get delisted from SURBL? Fix the underlying cause first — SURBL's reviewers look for evidence the issue was addressed, not just a request that the listing is unfair. Then submit a removal request through SURBL's own lookup/removal page. If the root cause is shared infrastructure reputation, delisting an individual domain without addressing the shared infrastructure may not hold.

Does SURBL affect Gmail and Outlook the same way? Both use SURBL data as one input among many in their spam filtering, but they don't weight it identically. A SURBL listing is a strong negative signal at either provider, but it's not a guaranteed universal block — treat a listing as urgent regardless of which provider you're troubleshooting for.

Is a SURBL listing the same as a phishing flag? Not necessarily. SURBL Multi combines several sub-lists (abuse, phishing, malware, compromised sites). In our dataset, every single listing we found was on the abuse sub-list specifically — not phishing — so always check which sub-list a domain is actually on before assuming the cause.

Bottom Line

SURBL isn't quietly sitting in the background anymore — in 2026, it's one of the most consequential blacklists cold email senders will run into, and 9 out of 10 domains we tested are already caught in it. The data says this is overwhelmingly an infrastructure-reputation problem, not a content or naming-convention problem. If you send cold email and haven't checked your domains against SURBL this month, that's the first thing to fix.

👉 Continue: How Do I Know If I'm Blacklisted? · IP vs. Domain Blacklists · Improve Inbox Placement for Cold Email