Getting Your Email Delivered Again After a Hack

By Glenn Lyvers · Updated September 20, 2026 · 4 min read

The mailer script is gone and the outbound flood has stopped. Now your invoices are bouncing, your order confirmations are landing in junk folders, and a customer has told you they never received the quote you sent last Tuesday. Reputation takes longer to repair than the infection did to remove, and the order you do things in makes a real difference.

How sending reputation works

Mailbox providers score incoming mail on where it came from — the sending IP address, the sending domain, and the authentication records that tie the two together. Send a large volume of spam from your server or your domain and both scores drop, and they stay down for a while after the behaviour stops because reputation systems are deliberately slow to forgive.

There are two separate reputations at play. Your domain's, which follows you even if you change hosting, and the sending IP's, which on shared hosting you share with every other customer on that server. Understanding which one is damaged changes what you can do about it.

Stop the sending, completely

Nothing else works until this is true. Delisting requests submitted while spam is still going out fail and burn credibility with the list you asked. So confirm the source is genuinely gone: the mailer script removed, any stolen SMTP credentials rotated, and the site itself actually clean rather than probably clean.

Check your mail queue for pending messages and clear anything the infection left behind, because a queue full of spam will keep delivering for hours after the script is deleted and undo everything you are about to do. My guide on finding the mailer script covers locating the source properly.

Check and clear the blocklists

Find out where you actually stand before you start requesting things. Check your sending IP address and your domain against the major blocklists — there are free multi-list lookup tools that check dozens at once — and note which ones list you and why.

Then work through them individually, since each has its own process. Most have a delisting form, most will delist once the sending has stopped, and some delist automatically after a quiet period. The large ones matter most because many providers consult them. Be honest in the request: state that the site was compromised, that the source has been removed, and what you changed. My guides on blacklist detections and the vendor delisting links cover the mechanics.

Fix your authentication records

This is where you turn a recovery into an improvement. Correct SPF, DKIM and DMARC records tell mailbox providers which servers are allowed to send for your domain and let them verify that messages really came from you. Weak or missing records made the spam more damaging than it needed to be, because nothing distinguished it from your legitimate mail.

Getting them right now both speeds recovery and limits the damage if it happens again. My guide on rebuilding SPF, DKIM and DMARC walks through each record and the mistakes that quietly break them.

When the problem is the IP, not you

On shared hosting you send from an address shared with many other sites, so your deliverability can be poor because of somebody else's behaviour entirely — and there is very little you can do about that from your side. If your domain is clean, your authentication is correct, and mail is still failing, this is the likely explanation.

The practical answer is to stop sending through the shared server. Use a dedicated transactional email service for your site's outgoing mail, which gives you a professionally managed sending reputation independent of your hosting neighbours. For any business that depends on order confirmations or invoices arriving, that is worth doing regardless of whether you have been hacked.

Rebuilding over time

Reputation recovers with consistent, wanted mail rather than with requests. Send your normal volume to your normal recipients, keep your lists clean, remove addresses that bounce, and avoid sending a large catch-up blast to prove everything works — a sudden volume spike from a domain that recently sent spam is precisely the wrong signal.

Expect days to a few weeks for most of the recovery. Monitor by testing delivery to accounts at the major providers, and by watching your DMARC reports if you have them enabled. If mail is still failing weeks later with clean records and no listings, the shared IP is almost certainly the answer — and if you want the underlying compromise verified as genuinely cleared first, that is what my malware removal service does.

Common questions

How long until my email delivers normally again?

Usually days to a few weeks once the sending has genuinely stopped, the blocklists have delisted you and your authentication records are correct. Domain reputation recovers faster than shared IP reputation, since the latter depends on everyone else on your server as well.

How do I find out which blocklists have me?

Use one of the free multi-list lookup tools, which check your IP address and domain against dozens at once and tell you which list you and why. Do this before submitting anything, so you know the actual scope rather than guessing at which lists matter.

Will delisting requests work if I still have malware?

No, and they actively hurt. If spam is still going out, the listing returns immediately and you have spent credibility with that list for nothing. Confirm the source is removed and the queue is clear before you ask anyone to delist you.

My records are correct and mail still fails. What now?

Most likely the shared sending IP, whose reputation depends on other customers on the same server. You cannot fix that from your side. Moving your site's outgoing mail to a dedicated transactional email service gives you a managed sending reputation that is independent of your hosting neighbours.

Should I send a big catch-up mailing to test things?

No. A sudden volume spike from a domain that was recently sending spam is one of the worst signals you can produce. Resume your normal volume to your normal recipients, keep the list clean, and let consistency rebuild the reputation gradually.