What are Spamhaus CSS and DROP lists?

Spamhaus CSS (Combined Spam Sources) and DROP (Don't Route Or Peer) are specialized Spamhaus lists serving different purposes than the main SBL.

CSS (Combined Spam Sources):

• Automatically generated list targeting snowshoe spam operations
• Lists IPs sending low-reputation email that evades threshold-based detection
• Included as a subset within SBL and ZEN
• Focuses on "under the radar" spam rather than obvious bulk sources

Impact Level: High (included in ZEN)

CSS listing triggers:

• Low-volume but persistent spam patterns
• Distribution across many IPs (snowshoe)
• Automated detection of spam characteristics

DROP and EDROP:

• DROP - "Don't Route Or Peer" - netblocks hijacked or leased by spammers
• EDROP - Extended DROP - additional netblocks with similar issues
• These are for firewall/routing blocks, not DNSBL queries
• If you're on DROP, you have a serious IP allocation/registration issue

Delisting from CSS: CSS is automated based on behavior. If your sending patterns improve, listings typically resolve. For persistent issues, contact Spamhaus.

How to check: check.spamhaus.org - CSS shows as SBL with CSS-specific return codes

CSS catches the professionals who thought they were being clever by spreading spam thinly. DROP catches the pirates who stole someone else's ship entirely.