Issue: Some messages are marked Undeliverable 'blocked using Spamhaus'
Incident Length: 1 hour and 27 minutes
Incident Date: 9/01/2026, UTC 13:26– 14:53 UTC 9/01/2026
Incident Status: Resolved
Summary
US customers using Exclaimer Cloud to apply a signature once the email was sent would see some messages get rejected when routed back from Exclaimer, with the reason stated as 'Client host blocked using Spamhaus'.
The rejection was caused by a false positive against the IP address by Spamhaus’ servers, which was cleared after a short period of time. Some customers experienced continued mail flow issues due to replication delays in Exchange Online, which would result in some relays continuing to believe the IP address is on this list.
Root Cause
Discussions with Spamhaus’ technical team were able to identify that messages routed through the Exclaimer relay were hitting invalid email addresses or recipient addresses where the bounce management had been incorrectly configured.
They have been able to confirm that there is no issue within this US relay, which would indicate an issue within Exclaimer directly.
Mitigation
During the Incident, Mail Flow was directed away from the impacted relay within the US region. Messages that have already been queued to be processed by the impacted relay would continue attempting to use this relay until the message was resubmitted for a retry. Once the engineers had confirmed that the IP addresses were no longer flagged by Spamhaus and had not been returned to the list, the relay was brought back into service.
Additionally, with an understanding of Exclaimer, Spamhaus has agreed to a long-term whitelisting of our system within their filtering, which will prevent this from occurring again for our customers globally.
Incident Timeline
13:26 – The Exclaimer IP for the US relay was added to the Spamhaus eXploits Blocklist (XBL)
14:20 – The Exclaimer IP for the US relay is cleared from the Spamhaus XBL
14:28 – Exclaimer Support team raises internally that customers are reporting that messages are being blocked by this list.
14:33 - Engineering teams within Exclaimer confirm that the IP address is not showing as listed, and the responses look to be generated by Microsoft relays within Exchange Online.
14:34- Internal Investigation begins to investigate internally for the cause of the relay being added to the list.
14:45 – Exclaimer Engineers set the impacted relay to be excluded from traffic management, preventing messages from being routed to the impacted IP range.
14:53 – Exclaimer Engineers confirm that the delisting is picked up by Microsoft servers, and rejection messages reasons that specify Spamhaus’ stop.
15:01 – With mail flow confirmed to flow without impact. Exclaimer reaches out to Microsoft and Spamhaus’ teams to identify the cause of the IP address being flagged.
17:32 – Engineers note that the IP is listed on the Spamlist once more for a few minutes before being removed automatically.
12/01, 09:00 – Microsoft advised that contact needs to be made with Spamhaus to determine the cause of the block.
09:05 – Exclaimer Engineers confirm there have been no further reports of the IP address being added onto the Spamhaus xBl, and enable the impacted relay to process messages once more.
13/01, 16:28 – A response is received from Spamhaus regarding this issue, which confirms the suspected cause of the incident and confirms that the Exclaimer domain has been added to their trusted domain listing.
19/01, 15:02 Confirmation is received that all relays globally for Exclaimer are covered within the trusted listing by Spamhaus, confirming the block will not occur again.