Over the past several weeks, I've been noticing a pattern: legitimate corporate emails from well-known companies are getting blocked. Not going to spam. Blocked. The culprit in most cases? Spamhaus ZEN. And the common thread is Google.
Here's what's happening, why it's getting worse, and what your organization should do about it.
The Core Problem: Shared IP Contamination
Google Workspace routes outbound email through shared IP ranges. When one bad actor on those shared ranges gets listed in Spamhaus ZEN, all outbound mail from that IP block gets blocked — including yours, even if your organization has done everything right.
This is not a new problem. But it's getting worse, and the consequences for legitimate businesses are real.
What Is Spamhaus ZEN?
Spamhaus ZEN is a combined blocklist that aggregates several individual Spamhaus blocklists. It's used by many organizations as a first-line defense against spam and malicious email. Getting listed on ZEN isn't just inconvenient — it means your emails may be silently dropped before they ever reach a human inbox.
Why This Is Getting Harder to Manage
The volume of abuse on shared infrastructure has increased significantly. Cloud email providers like Google host millions of tenants. A small percentage of bad actors can contaminate IP reputation for everyone else on the same sending infrastructure.
The situation is compounded by the fact that most organizations don't monitor their own sending reputation. They only find out something is wrong when a customer or partner reports a delivery failure.
What Your Organization Should Do
-
Check your sending IPs against Spamhaus ZEN — do this now, before you have a problem. Use the Spamhaus lookup tool.
-
Implement SPF, DKIM, and DMARC — these won't prevent your IP from being listed on ZEN, but they establish your domain's authenticity. Organizations with properly configured DMARC have more options for remediation.
-
Consider dedicated sending IPs — if email deliverability is critical to your business, dedicated sending IPs (available in Google Workspace and Microsoft 365 at higher tiers) eliminate shared contamination risk.
-
Monitor your sending reputation — tools like Google Postmaster Tools, Microsoft SNDS, and third-party reputation monitoring services can alert you to problems before customers start complaining.
-
Establish a delisting process — know where to go and what to do when you get listed. Spamhaus has a self-service delisting portal for some of their lists. Know how it works before you need it.
The Bottom Line
The recipient is not the problem here. Neither is the email filter. The problem is shared infrastructure and the externalities that come with it. If your organization relies on Google Workspace for outbound email and you haven't checked your sending IP reputation recently, do it today.
Email deliverability is a security and compliance issue, not just an IT problem. Treat it that way.