SURBL Is Mass-Listing .info Domains on Microsoft and Azure - What Happened and What To Do

What Is SURBL and Why Does It Matter

SURBL is a domain-based blacklist - it flags domains, not IP addresses. It is run by organizations that take a maximalist stance on unsolicited email: any domain that appears in email sent to addresses that never opted in is fair game for listing. There is no hearing, no warning, and no guaranteed path to removal.

Historically, a SURBL listing was a death sentence for a sending domain. Mail stopped landing. The only move was to discard the domain and rebuild.

That calculus shifted in late 2025. Research from multiple infrastructure providers showed that Google and Microsoft had quietly reduced the weight they placed on SURBL - a listing alone was no longer enough to route mail to spam. A properly warmed domain on a clean IP could still land despite a SURBL flag.

What Happened in June 2026

Starting in mid-June 2026, operators began reporting that .info domains running on Microsoft 365 and Azure-based inboxes were appearing on SURBL in large numbers. The pattern had several consistent characteristics:

Why .info and Why Now

SURBL lists domains that appear in email sent to addresses that never opted in - typically honeypot addresses. The most likely explanation for the June 2026 spike is that SURBL or its data partners acquired a significant number of expired .info domains and converted them into honeypots.

.info has historically been one of the lower-cost TLDs, which made it attractive to cold email operators looking to build out sending infrastructure cheaply. It also means there is a large pool of expired .info domains from defunct businesses and abandoned projects - domains that once received real business email and might still appear in prospecting databases.

When SURBL acquires those expired domains and redirects their inboxes, any cold email sent to contacts associated with those old domains gets captured. The sender is flagged. At scale, this explains how entire sending pools can get listed in a short window.

The Microsoft and Azure angle likely relates to IP reputation. Azure IP ranges have faced elevated scrutiny from spam infrastructure monitors over the past 18 months due to their relatively accessible provisioning compared to Google. SURBL's data partners may weight signals from Microsoft-routed email more heavily, or Microsoft's own filtering may interact differently with SURBL lookups compared to Google's approach.

What This Means for Deliverability in Practice

The honest answer is: it depends on your setup, and you need to test rather than assume.

The late-2025 finding that SURBL listings had reduced impact was real and is still broadly true for Google. A well-warmed .com domain on Google Workspace, even if SURBL-listed, often continues to land in inbox if engagement signals are strong.

The June 2026 situation is more complicated for two reasons. First, the volume of listings is high enough that it may shift how providers weight the signal - a sudden spike in SURBL-listed domains from a particular infrastructure type could cause adaptive filters to treat SURBL more seriously in that context. Second, the .info TLD itself carries less inherent trust than .com with most spam filters. A .info domain on SURBL faces a compounded trust deficit that a .com domain on SURBL does not.

What To Do If Your .info Domains Are Listed

The Broader Lesson on TLD Selection

The June 2026 situation reinforces something the most experienced infrastructure operators have known for years: TLD selection is a deliverability variable, not just a branding one.

.info, .co, .io, and other alternatives can work, and many operators have run them successfully. But the margin for error is smaller. A .com domain can absorb some deliverability stress - a SURBL listing, a temporarily elevated bounce rate, a list quality issue - and continue performing. A .info domain under the same stress is more likely to fall over.

If you are currently running significant infrastructure on .info or other non-.com TLDs, this event is a good moment to assess your exposure and begin migrating your most important sending volume to .com.

What To Watch Going Forward

SURBL events like this tend to have a defined window. Once the honeypot coverage in the targeted namespace is established and the listings have accumulated, the rate of new listings typically stabilizes. The question is whether Google and Microsoft adjust their weighting of SURBL signals in response to the volume spike, and whether the .info targeting represents a sustained shift in SURBL's data acquisition strategy or a one-time event.

Watch your deliverability data closely over the next two to four weeks. If you are operating on .com with properly warmed infrastructure and good list hygiene, you should be largely insulated. If you are on .info with Microsoft infrastructure, treat this as an active incident and move accordingly.

Quick Reference