SpamHaus is Blocking my IPs I need them Whitelisted

Question

SpamHaus is Blocking my IPs I need them Whitelisted

David Zakowski 0

I paid for Microsoft Technical Support but it sent me here before I could Submit a ticket. I have a Web App that is sending emails and its being blocked by SpamHaus. I need my outbound IPs whitelisted so my apps can send emails.

Ajay Rathod 260 Reputation points Microsoft External Staff Moderator

2026-08-17T02:27:25.13+00:00

Hi @David Zakowski

Greetings for the day, Thanks for reaching out to Q&A.

We are looking into this issue and reach out to you for further updates.
Ajay Rathod 260 Reputation points Microsoft External Staff Moderator

2026-08-17T03:09:45.6533333+00:00
Please Check below details,

Outbound mail from your Web App being blocked is production-impacting, so let's get you to a working state.

Short version: Microsoft can't delist anything with Spamhaus, and the IP that got listed isn't exclusively yours. The fix is to send through Azure Communication Services Email over authenticated SMTP on port 587, which owns and maintains its own sending reputation. Full steps below - it's a same-day change.

WHY THE WHITELIST REQUEST CAN'T BE ACTIONED Spamhaus is an independent third-party organisation. Microsoft has no ability to add or remove entries on their lists - only Spamhaus controls them.

Authenticated SMTP relay on port 587 is not restricted in Azure regardless of subscription type. Direct port 25 sending isn't a supported path here - from App Service it only works via VNet integration or App Service Environment v3, and it's exactly the pattern that gets shared IPs listed.

Create an Email Communication Service resource in the Azure portal.

https://learn.microsoft.com/en-us/azure/communication-services/quickstarts/email/create-email-communication-resource?pivots=platform-azp

Add your custom domain. Provision Domains > Add domain > Custom domain > enter your domain twice > Confirm > Add.

Verify domain ownership. Click Verify Domain, add the TXT record the portal gives you to your DNS, then Next and Done. DNS changes take 15 to 30 minutes to take effect.

Add the sender authentication records. The portal generates three:

SPF - TXT name: your domain value: v=spf1 include:spf.protection.outlook.com -all

DKIM - CNAME name: selector1-azurecomm-prod-net._domainkey.<your domain> value: selector1-azurecomm-prod-net._domainkey.azurecomm.net

DKIM2 - CNAME name: selector2-azurecomm-prod-net._domainkey.<your domain> value: selector2-azurecomm-prod-net._domainkey.azurecomm.net

Two things that trip most people up here: - If you provision a subdomain (for example notification.contoso.com), the record name must include that subdomain segment. Omitting it is the most common reason DKIM/DKIM2 stays unverified. - ACS requires the SPF record to end with -all. If it ends with ~all, the SPF check fails. (This is an ACS requirement, not a universal email rule.)

Confirm the records resolved, then wait 15 to 30 minutes for ACS verification to complete.

nslookup -q=TXT <YOUR_DOMAIN>

nslookup -q=CNAME selector1-azurecomm-prod-net._domainkey.<YOUR_DOMAIN>

nslookup -q=CNAME selector2-azurecomm-prod-net._domainkey.<YOUR_DOMAIN>

Link the verified domain to your Communication Services resource and point your app at the SMTP relay on port 587.

https://learn.microsoft.com/en-us/azure/communication-services/quickstarts/email/send-email-smtp/smtp-authentication?tabs=built-in-role

Check the limits fit your volume BEFORE you cut over.

Custom domain (verified) - 30 emails per minute, 100 per hour, per subscription. Higher limits available via a quota increase request.

Azure managed domain - 5 emails per minute, 10 per hour, per subscription. Higher limits are NOT available.

Also: 50 recipients per email, 10 MB total request size including attachments (roughly 7.5 MB of real content after Base64 encoding), 250 authenticated connections per subscription. Higher quotas are available only for verified custom domains, so use a custom domain for production. If you send more than 100 per hour, request the quota increase before you migrate.
https://learn.microsoft.com/en-us/azure/communication-services/concepts/service-limits

Confirm end to end. Send a test to a Gmail or Outlook.com mailbox, open the received message's internet headers, and check that Authentication-Results shows spf=pass and dkim=pass, and that the sending IP is the relay's.

Thanks,

Ajay Kumar

2 answers

Your answer

Ajay Rathod 260 Reputation points Microsoft External Staff Moderator

2026-08-17T02:27:25.13+00:00

Hi @David Zakowski

Greetings for the day, Thanks for reaching out to Q&A.

We are looking into this issue and reach out to you for further updates.

Answer 1

EmilyS_726 24,550 Volunteer Moderator

If your IP is blocked by SpamHaus, you send your delist request to them, not to Microsoft.

SpamHaus is a third party IP monitoring organization, Microsoft, Google and many other email services simply use SpamHaus' list as reference, but Microsoft doesn't manage their list.

Check out their delist instructions here: https://www.spamhaus.org/resource-hub/delisting/good-bye-blocklist-removal-center-hello-ip-and-domain-reputation-checker/

0 comments

Answer 2

Hello David Zakowski,

Greetings! Thanks for raising this question in Q&A forum.

I understand this is frustrating, especially if your application is unable to send emails. In most cases, Microsoft cannot directly whitelist App Service outbound IPs with Spamhaus on a customer's behalf through the Q&A forum. The block usually needs to be investigated to determine why the IP is listed and whether a delisting request is required.

Check whether the App Service outbound IP addresses are currently listed by Spamhaus and note the exact listing reason.
If you are sending mail directly from your Azure Web App, consider using a dedicated email service such as Azure Communication Services Email, Exchange Online, or a third-party SMTP provider instead of relying on App Service outbound IP reputation.
If the IPs belong to Azure infrastructure and are listed, open an Azure Support request from the Azure Portal and provide:
- The App Service name
- The outbound IP addresses
- The Spamhaus listing details and evidence
The Azure Support team can review the IP reputation status and determine whether backend action or coordination with the relevant team is required.

The next action is with you to gather the listed IP addresses and submit a support ticket with the Spamhaus listing information. The Azure Support team will then review the IP ownership and possible remediation options.

If this answer helps you kindly accept the answer which will help others who have similar questions

Best Regards,

Jerald Felix.

David Zakowski 0 Reputation points

2026-08-17T02:41:16.5266667+00:00

I only have Developer Level Support, Do I need to upgrade Subscription to get a Support ticket with Azure Support? I know the IPs that are having issues with SpamHaus. I do utilize a Microsoft 365 Email Relay to send emails but are getting blocked.
David Zakowski 0 Reputation points

2026-08-17T02:42:14.7466667+00:00

I wanted to also note when I am self-hosting my site, I do not run into issues with emailing.