For the last six months I have been locked in battle with the Spamhaus CSS SBL, having to regularly check if the IPv6 address of my Exim4 server has been listed and, if it has, manually delisting it. I finally conceded defeat last week and switched my SAAS app from using a self-managed (and well configured) Exim4 server to Mailgun. By "well configured" I mean it had SPF, DKIM and DMARC records, sent well-formed, multipart emails, had list-unsubscribe headers, etc. All the so-called "best practice" things.
The CSS SBL is supposed to list "snowshoe" spammers, which means operators sending low volumes of email from multiple IP addresses. Well, for a start, email for the SAAS's domain only ever originated from this one address, so I'm not sure how their algorithms concluded it was a snowshoe spamming operation, but anyway...
Whilst the SAAS app now sends all its email via Mailgun, I left Exim4 running in case other services on the machine needed to send emails to my support email address. Since then, the Exim4 server has sent about five very benign emails to my support email address, which is hosted on a self-managed Ubuntu machine running Postfix and doesn't have any anti-spam modules installed (so I know it isn't talking to Spamhaus).
Despite that, the IP of the Exim4 server continues to get listed in the CSS SBL on an almost daily basis. What is even more perplexing is that the IP address is getting listed even when no email has been sent! By way of example, I delisted the IP address yesterday and when I checked this morning (approximately 20 hours later), it had been re-listed. I checked the Exim4 logs and not a single email had been emitted in that period.
So does anybody know why the IP address would continue to be listed in the CSS SBL even though essentially no email is being sent from that address?
I should add that the IP address has been in use on this server for over three years, the DNS is with Linode and the domain name is registered with GoDaddy with publicly accessible, genuine whois records (ie. no privacy protection).