The workflow
- Sweep DNSBLs for sending IPs and the domain.
- Capture the listing state and timestamp.
- Run the verification workflow (DNS, SSL, reputation).
- Identify the trigger — content, volume, IP rotation, compromise.
- Remediate, re-sweep, and document.
- Request delisting with the trail attached.