uceprotect.net is a DNS blacklisting service that is comprised of three distinct zones: dnsbl-1.uceprotect.net, dnsbl-2.uceprotect.net, and dnsbl-3.uceprotect.net. Each zone has different listing criteria, all of which are extremely important to understand before using any zone within the service. While DNS blacklists by nature can be controversial, uceprotect.net is perhaps one of the most controversial of them all. uceprotect.net works with over 50 other partners to help them gather information on servers that have been seen sending spam. Every tactic is used to locate which servers are sending spam, from spamtraps to third party reports, each of the 50 partners untimely communicates their findings back to useprotect.net. From there, useprotect.net will determine which of their three zones the IP address should be listed in. useprotect.net is unforgiving with their listing policy, with a core belief that "people learn by consequence". As a result of uceprotect.net's unforgiving listing polices, there is significant misinformation about their service written at other sources. uceprotect.net does not charge for delisting, delisting happens automatically as soon as spam has ceased, and no special treatment is given to partners or anyone in particular with regard to listing or delisting. uceprotect.net does have an expedited delisting service in which there is a fee, though it is only applicable to certain levels of listings.
This is uceprotect.net's primary first level zone. If you find yourself in this blacklist, it generally means your server has inadvertently been sending spam. Track down the source of the spam, prevent it from happening again, and your IP will be delisted in seven days.
This is uceprotect.net's secondary level zone. Allocations less than /26 will be automatically be removed if no additional abuse is detected. Allocations of /25 will be allowed to expire only if there are less than two IP addresses listed in the level one blacklist.
A /24 range will expire if four or less IP addresses remain in Level one.
useprotect.net uses a formula for all further delisting calculations within the level two zone:
(Netmask - 1) = Abuser IP's + (Abuser IP's at Netzmask + 1)
For example, a /23 network range will be removed when nine or less IP addresses remain, a /22 network range will be removed if fourteen or less IP addresses remain, and a /21 network range will be removed if twenty-four or less IP addresses remain.
Furthermore, in order for a network range to be removed from a level two listing, that IP address must have already been removed from a level one listing.
Level two listings can usually only be removed at the request of your upstream service provider.
As an end user administrator of an email server, you can become delisted out of the level one uceprotect.net DNS blacklist by simply correcting the spam that was seen to come from your server, and waiting seven days. If seven days is too long of a wait, for a fee of 50 Euros per IP address, you can have your addresses immediately removed.
Naturally delisting in seven days, or even paid delisting, can only happen for IP space in which you are in control of. If your IP address is a leased or shared IP address, and part of a larger network, the network owner will have to work with uceprotect.net for delisting. uceprotect.net's policy is that it is not your responsibility to do the work of your upstream provider; the upstream must be the one to correct the problem.
A level two delisting will usually require significant work, as well as policy change on how spam is dealt with on behalf of the upstream that is providing leased or shared IP services. A level three delisting will be much like a level two delisting, however, the most challenging of all. As level three listings are comprised of large ISP's, it may be impossible to have them make the needed changes to meet uceprotect.net's delisting criteria. In those cases, you can search out a new provider, or chose to no longer support this particular DNS blacklist.