---
title: Spamhaus has listed a million cold email domains. What the latest Domain Reputation Update means for everybody else sending email
description: Spamhaus has listed around a million cold email domains since August 2026. What the Domain Reputation Update says, why it affects ordinary senders, and the TLD check to run now.
---

[Skip to content](https://weareastral.co.uk/thevault/spamhaus-has-listed-a-million-cold-email-domains.-what-the-latest-domain-reputation-update-means-for-everybody-else-sending-email#main-content)

**FREE WEBINAR:** Email marketing in 2027: everything you need to know

[Sign up now](https://weareastral.co.uk/webinar/email-marketing-in-2027)

![astral.](https://weareastral.co.uk/hs-fs/hubfs/astral.%20new%20logo%20no%20background%20large.png?width=500&height=200&name=astral.%20new%20logo%20no%20background%20large.png)

- Email services
  
  Show submenu for Email services 
  
    - [Email Strategy Workshops](https://weareastral.co.uk/email-strategy-workshops)
    - [Email Audit](https://weareastral.co.uk/email-audit)
    - [Deliverability Audit](https://weareastral.co.uk/email-deliverability-audit)
- Email & CRM resources
  
  Show submenu for Email & CRM resources 
  
    - [Deliverability Hub](https://weareastral.co.uk/deliverability-hub)
    - [Email & CRM Vault](https://weareastral.co.uk/thevault)
    - [Email Copy & Psychology Guide](https://weareastral.co.uk/email-copy-psychology-guide)
    - [Email Design Handbook](https://weareastral.co.uk/email-design-handbook)
    - [Email Deliverability Guide](https://weareastral.co.uk/email-deliverability-guide)
    - [Email Health Check tool](https://www.emailhealthcheck.co.uk/)
    - [Deliverability Health Check tool](https://www.emaildeliverabilitycheck.co.uk/)
- [astral academy](https://weareastral.co.uk/academy)
  
  Show submenu for astral academy 
  
    - [Deliverability Certification](https://weareastral.co.uk/emaildeliverability/training)
    - [Email Design Masterclass](https://weareastral.co.uk/email-design-masterclass)
    - [Inbox Psychology Masterclass](https://weareastral.co.uk/email-psychology-masterclass)
    - [Free Deliverability Training](https://weareastral.co.uk/free-email-deliverability-training)

Open main navigation

Close main navigation

- Email services
  
  Show submenu for Email services 
  
    - [Email Strategy Workshops](https://weareastral.co.uk/email-strategy-workshops)
    - [Email Audit](https://weareastral.co.uk/email-audit)
    - [Deliverability Audit](https://weareastral.co.uk/email-deliverability-audit)
- Email & CRM resources
  
  Show submenu for Email & CRM resources 
  
    - [Deliverability Hub](https://weareastral.co.uk/deliverability-hub)
    - [Email & CRM Vault](https://weareastral.co.uk/thevault)
    - [Email Copy & Psychology Guide](https://weareastral.co.uk/email-copy-psychology-guide)
    - [Email Design Handbook](https://weareastral.co.uk/email-design-handbook)
    - [Email Deliverability Guide](https://weareastral.co.uk/email-deliverability-guide)
    - [Email Health Check tool](https://www.emailhealthcheck.co.uk/)
    - [Deliverability Health Check tool](https://www.emaildeliverabilitycheck.co.uk/)
- [astral academy](https://weareastral.co.uk/academy)
  
  Show submenu for astral academy 
  
    - [Deliverability Certification](https://weareastral.co.uk/emaildeliverability/training)
    - [Email Design Masterclass](https://weareastral.co.uk/email-design-masterclass)
    - [Inbox Psychology Masterclass](https://weareastral.co.uk/email-psychology-masterclass)
    - [Free Deliverability Training](https://weareastral.co.uk/free-email-deliverability-training)
- [Work with Beth](https://weareastral.co.uk/work-with-beth)

[Work with Beth](https://weareastral.co.uk/work-with-beth)

 11/2026

# Spamhaus has listed a million cold email domains. What the latest Domain Reputation Update means for everybody else sending email

![Picture of Beth O'Malley](https://app.hubspot.com/settings/avatar/2761c9d87ba551994b382ed8415ad538) [Beth O'Malley](https://weareastral.co.uk/thevault/author/beth-omalley)

Share: [Share this page on LinkedIn](http://www.linkedin.com/shareArticle?mini=true&url=https://weareastral.co.uk/thevault/spamhaus-has-listed-a-million-cold-email-domains.-what-the-latest-domain-reputation-update-means-for-everybody-else-sending-email) [envelope icon](mailto:?body=https://weareastral.co.uk/thevault/spamhaus-has-listed-a-million-cold-email-domains.-what-the-latest-domain-reputation-update-means-for-everybody-else-sending-email)

[← Back to the Vault](https://weareastral.co.uk/thevault)

 

[Spamhaus has published its Domain Reputation Update for April to September 2026](https://www.spamhaus.org/resource-hub/domain-reputation/domain-reputation-update-april-september-2026/), and the headline is the biggest piece of news in deliverability this year.

Since late August, Spamhaus has listed approximately one million domains used for cold email. They describe it as one of the most significant increases in the history of the report. Bad reputation listings, the category that covers spam, more than doubled in a single month, from 468,000 in August to 987,000 in September.

A million domains, in about five weeks, for one practice.

Most coverage of this will treat it as a cold email story. It is bigger than that, and parts of it matter even if you have never sent a cold email in your life.

 

## Before you dig in, why don't you get access to RE:markable

  RE:markable is the weekly email about emails. Dropping the latest email marketing news, updates, insights, free resources, upcoming masterclasses, webinars, and of course, a little inbox mischief. 

 Subscribe to RE:markable

 

 

## What this covers

1. What happened, and where the data came from.
2. Spamhaus defining cold email as spam, in their own words.
3. Why it affects you even if you do not send cold email.
4. The TLD numbers, and the check to run before you register a sending domain.
5. What to do about it, translated for marketers rather than registrars.

# What happened

## A million domains, and where the data came from

The mechanism matters as much as the number. Validity, the deliverability company, sent Spamhaus a set of known cold email domains as part of a data-sharing collaboration. Spamhaus compared it against their own tracking, found a strong correlation among the top contributors, confirmed they were looking at the same underlying activity, and listed the domains.

- Two organisations pooling intelligence, then acting on it. Which is a precedent rather than a one-off, and it follows Validity launching its own blocklist aimed at synthetic engagement and warm-up tooling in September.
- Preventative listing of whole portfolios. Spamhaus notes that part of the wider increase comes from listing large domain portfolios where only a subset had been used yet. The stated aim is to raise the cost for operators, which also means the unused domain somebody bought in a bulk batch can be listed before it ever sends.
- And the scale of the business being targeted. Research cited by Spamhaus puts investor funding in the cold email market at roughly £80 million, with operators having bought an estimated million disposable domains at around £8 each.

## Key takeaway:

*The industry is consolidating its threat intelligence, and enforcement is getting faster rather than more cautious.*

*Anything that depends on being too small to notice is on a shorter timer than it was this time last year.*

# The definition

## Spamhaus has said the quiet part out loud

The part of the report I would put in front of anybody still arguing about this is the definition, because it removes the ambiguity the cold email industry has been living in.

Spamhaus describes cold email as spam. Unsolicited bulk email sent to people who have not given verifiable permission. No consent, no commercial relationship, and typically some form of bulk automated distribution.

- Personalisation does not exempt you. The report says so directly, noting that cold email is spam despite often being personalised. The merge tag was never the point.
- Legitimate interest does not exempt you either. Spamhaus assesses consent, not your lawful basis. A legal argument that satisfies a regulator does not satisfy a blocklist, and the two have never been the same test.
- They are careful to separate it from phishing. Cold email is not trying to steal credentials, and Spamhaus says the domains used for it do not overlap with phishing domains. Their objection is that it is unwanted mail flooding inboxes and destroying trust, using the same disposable domain model as the rest of the abuse they track.

M3AAWG, the industry body most large mailbox providers and sending platforms belong to, has published a position paper describing the use of deceptive and misleading delivery methods to send unsolicited email, cold email included, as an abusive practice. The position is no longer one organisation's opinion.

 

 

# The collateral

## Why this matters if you have never sent a cold email

Plenty of marketers will read this and move on, which is a mistake. Four parts of it land on ordinary senders.

- Your sales team may be doing this on your behalf. Prospecting from lookalike domains, sequencing tools with built-in sending, bought contact data. Marketing frequently has no visibility of it, and the domain reputation consequences do not respect your internal org chart.
- The domain you are about to register might be in a bad neighbourhood. TLD reputation is real, measurable and public, and the report publishes the numbers. More on that below.
- Shared infrastructure gets caught in the sweep. If your sending platform's IP ranges or your hosting provider carry cold email operators, enforcement at that level reaches you without you doing anything wrong.
- And the whole category is getting less tolerant. Faster listing, pooled intelligence between vendors, preventative listings of unused domains. The margin for a sloppy send is narrower than it was, and it will be narrower again next year.

 

# The numbers

## The wider picture in the report

- 57.1 million new domains registered in six months. Up 21.8% on the previous six months, the biggest growth in over two years, averaging 9.5 million a month and peaking at a record 10.7 million in September.
- 3.37 million malicious or suspicious domains detected. Up 56.6%, averaging around 561,000 a month.
- Listings hit 1.15 million in September alone. The highest monthly figure in Spamhaus's data to date, driven by new domain growth and the cold email listings together.
- Malicious bad reputation domains reached 2.61 million. Up 62%, and more than three times the number of malicious phishing domains at 728,660.

Worth holding onto the methodology note alongside those figures. The data reflects what Spamhaus observed and listed, not the entirety of what exists, and their WHOIS and RDAP coverage is incomplete for data protection reasons. The direction is reliable, the absolute totals are a floor rather than a ceiling.

 

# The neighbourhoods

## The check to run before you register a sending domain

The most immediately useful thing in the report for an ordinary sender is the percentage of zone file listed, which is the share of all domains on a given top-level domain that Spamhaus has listed.

 

## The thresholds Spamhaus publishes:

Above 5% listed is a red flag.

Above 10% indicates a problematic TLD.

 

### Three gTLDs exceeded that this period

- .help, at 26.48% of its zone listed. Up from 4.1% in the previous report, and Spamhaus attributes the rise largely to cold email. More than a quarter of every .help domain in existence is listed.
- .qpon, at 15.11%.
- .study, at 12.37%.

### And the .info story, which is the one to understand

New .info registrations fell 52% over the period. Listings for .info rose 248%, to 131,578, taking it to fifth in the Top 20 listed TLDs. Fewer new domains, far more abuse, and Spamhaus names the main driver as spam, specifically cold email.

Which tells you that a TLD's reputation is about who uses it rather than how popular it is, and that it can deteriorate quickly while registration volume goes the other way.

 

## Your action:

*Before you register a domain for sending, check the TLD against the report's zone listing table rather than choosing on price or availability.*

*Cheap TLDs are cheap because they are bought in bulk and abandoned. Registrations starting at under £2 are what makes the burn-and-replace model work, and you would be buying into the same neighbourhood as the people doing it.*

# What to do

## Spamhaus wrote their recommendations for registrars, so here is the version for marketers

The report's own recommendations are aimed at registries and registrars: look for patterns rather than single domains, watch how price and policy shape abuse, track the share of your zone that is listed, flag brand names at registration. All sensible, and none of it actionable if you run an email programme.

The sender version.

1. Find out what your sales team is sending, and from where. Specifically whether prospecting runs on a lookalike domain, where the contact data came from, and whether any sequencing tool is doing automated warming alongside it.
2. Audit every domain your organisation sends from. Most businesses have more than they think, inherited from campaigns, agencies, microsites and departed staff. Any one of them can carry reputation back to you.
3. Check your TLDs against the zone listing thresholds. Five per cent is the red flag, ten per cent is a problem. If a sending domain of yours sits on a TLD above either, plan a migration before you are forced into one.
4. Separate your streams properly. Marketing, transactional and prospecting should not share a sending identity. Enforcement at the domain or IP level is indiscriminate, and the order confirmation is what you cannot afford to lose.
5. Monitor blocklists on a schedule rather than on a hunch. Listings now arrive faster and in larger batches, including preventative ones against domains that have not sent anything yet.
6. And stop buying contact data. The practice is being actively dismantled by the organisations that decide whether your email arrives. Arguing about whether that is fair is a poor use of the next two years.

## Watch out for:

*A domain bought as part of a bulk batch can be listed before it has ever sent an email, because Spamhaus is listing portfolios preventatively.*

*If somebody in your business bought sending domains cheaply and in quantity, check them now rather than at launch.*

# The direction

## What the report tells you about the next eighteen months

- Vendors are pooling data, and acting on it together. Validity to Spamhaus here, and Validity's own synthetic engagement blocklist in September naming Comcast, Proofpoint, Spamhaus and SURBL among those using or evaluating it. The intelligence is consolidating and the gaps between systems are closing.
- Enforcement is moving from reactive to preventative. Listing a portfolio before it sends is a different posture from listing a domain after complaints arrive.
- The economics are being attacked rather than the symptoms. Spamhaus has said for years that cheap domains enable abuse at scale. Raising the cost of the disposable domain model is the strategy, and it is explicit.
- And the shortcut lifecycle is shortening. Every deliverability shortcut follows the same path: it works, it gets productised, the pattern becomes obvious, detection is built. That cycle used to take years. Cold email tooling went from growth market to a million listed domains inside twelve months.

## A quick win:

*Pull a list of every domain your organisation currently sends from, including anything sales or an agency is using.*

*Check each one against Spamhaus and check the TLD against the zone listing thresholds. An afternoon, and most businesses find at least one thing they did not know existed.*

## The conclusion

A million domains listed in five weeks is not an enforcement action against a handful of bad actors. It is an industry deciding that a widespread, funded, professionalised practice is spam, and acting accordingly.

For anybody running a permission-based programme, the report is mostly good news. The inbox you are competing for gets quieter when a million disposable domains stop reaching it. The caution is that enforcement at this scale is blunt, and proximity to the people being caught is now a liability in itself. Your sales team's prospecting domain, your cheap TLD, your shared sending infrastructure.

Permission has always been the thing that holds up. Each of these reports makes the gap between having it and arguing about it a little more expensive.

 

![Copy of Getting email deliverability right What to know & track (1080 x 900 px) (1)](https://weareastral.co.uk/hs-fs/hubfs/Copy%20of%20Getting%20email%20deliverability%20right%20What%20to%20know%20%26%20track%20(1080%20x%20900%20px)%20(1).png?width=1080&height=900&name=Copy%20of%20Getting%20email%20deliverability%20right%20What%20to%20know%20%26%20track%20(1080%20x%20900%20px)%20(1).png)

## Reputation is the whole game, and it is being enforced harder every year

Everything in this report comes back to the same thing: who you send to, how you got them, and what your infrastructure looks like from the outside.

 

My free 60 minute Email Deliverability Training covers reputation, authentication and what normal looks like. The Email Deliverability Certification Programme takes you through the full audit process, including your domain estate.

[Join the free deliverability training →](https://weareastral.co.uk/free-email-deliverability-training)

### Further reading from The Vault:

- [How to Run Cold Email Without Destroying Your Domain](https://weareastral.co.uk/thevault/how-to-run-cold-email-without-destroying-your-domain.-and-what-to-build-before-the-window-closes)
- [Synthetic Engagement Is Now a Blocklistable Offence](https://weareastral.co.uk/thevault/synthetic-engagement-is-now-a-blocklistable-offence.-what-validitys-heatwave-means-for-anybody-using-a-warm-up-tool)
- [Spam Traps: Every Type Explained](https://weareastral.co.uk/thevault/spam-traps-every-type-explained-how-they-end-up-on-your-list-and-how-to-find-out-whether-you-have-one)
- [Why Cold Email Is Dying, and Why It Will Be Dead by 2030](https://weareastral.co.uk/thevault/why-cold-email-is-dying)
- [Email Behaving Badly: Why Compliance Will Not Save Your Deliverability](https://weareastral.co.uk/thevault/email-behaving-badly-why-compliance-will-not-save-your-deliverability)
- [The State of Email Deliverability in 2026](https://weareastral.co.uk/thevault/the-state-of-email-deliverability-in-2026.-and-what-i-think-happens-in-2027)

 

### Sources

- [Spamhaus Domain Reputation Update, April 2026 to September 2026.](https://www.spamhaus.org/resource-hub/domain-reputation/domain-reputation-update-april-september-2026/)
- [Spamhaus, Cold Email: One Year On, resource hub.](https://www.spamhaus.org/resource-hub/spam/cold-email-one-year-on/)
- [M3AAWG position paper on unsolicited email and deceptive delivery methods.](https://www.m3aawg.org/sites/default/files/doc_files/m3aawg_position_on_cold_email.2025_0.pdf)
- Figures originally published in dollars and converted to pounds at approximate rates.

 

## Like this blog? You'll love RE:markable

 RE:markable is the weekly email about emails. Dropping the latest email marketing news, updates, insights, free resources, upcoming masterclasses, webinars, and of course, a little inbox mischief.

 Subscribe to RE:markable

 

## Email, CRM and HubSpot Support

I help marketers and businesses **globally** improve, design and fix their email, CRM, and HubSpot ecosystems, from strategy through to execution.

**My services include:**

- Email marketing strategy, audits, training, workshops, and consultancy
- CRM strategy and enablement
- Full HubSpot implementations, optimisation and onboarding through my agency

If you’re looking for experienced external support (and lots of enjoyment along the way), this is where to start.

[Work with Beth](https://weareastral.co.uk/work-with-beth)

 

[← Back to the Vault](https://weareastral.co.uk/thevault)

[Email Marketing](https://weareastral.co.uk/thevault/tag/email-marketing), [Marketing Strategy](https://weareastral.co.uk/thevault/tag/marketing-strategy)

![a. final -2](https://weareastral.co.uk/hs-fs/hubfs/a.%20final%20-2.png?width=100&height=100&name=a.%20final%20-2.png "a. final -2")

Copyright © Astral Digital ™. All Rights Reserved By Astral Digital.  
Registered company number 1460594

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Beth O'Malley",
    "url" : "https://weareastral.co.uk/thevault/author/beth-omalley"
  },
  "dateModified" : "2026-11-03T19:17:15.449Z",
  "datePublished" : "2026-11-03T19:17:15.000Z",
  "headline" : "Spamhaus has listed a million cold email domains. What the latest Domain Reputation Update means for everybody else sending email",
  "mainEntityOfPage" : {
    "@id" : "https://weareastral.co.uk/thevault/spamhaus-has-listed-a-million-cold-email-domains.-what-the-latest-domain-reputation-update-means-for-everybody-else-sending-email",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://weareastral.co.uk/hubfs/astral.%20new%20logo%20no%20background%20large.png"
    },
    "name" : "Astral Digital"
  }
}
```