What are Spamhaus CSS and DROP lists?

**Spamhaus** CSS (Combined Spam Sources) and DROP (Don't Route Or Peer) are specialized **Spamhaus** lists serving different purposes than the main **SBL**.

CSS (Combined Spam Sources):

• Automatically generated list targeting snowshoe spam operations
• Lists IPs sending low-reputation email that evades threshold-based detection
• Included as a subset within **SBL** and ZEN
• Focuses on "under the radar" spam rather than obvious bulk sources

Impact Level: High (included in ZEN)

CSS listing triggers:

• Low-volume but persistent spam patterns
• Distribution across many IPs (snowshoe)
• Automated detection of spam characteristics

DROP and EDROP:

• DROP - "Don't Route Or Peer" - netblocks hijacked or leased by spammers
• EDROP - Extended DROP - additional netblocks with similar issues
• These are for firewall/routing blocks, not DNSBL queries
• If you're on DROP, you have a serious IP allocation/registration issue

Delisting from CSS: CSS is automated based on behavior. If your sending patterns improve, listings typically resolve. For persistent issues, contact **Spamhaus**.

How to check: check.spamhaus.org - CSS shows as **SBL** with CSS-specific return codes

CSS catches the professionals who thought they were being clever by spreading spam thinly. DROP catches the pirates who stole someone else's ship entirely.