A blocklist is a published list of addresses that receiving servers use to reject or penalise mail. Ending up on one means your mail stops arriving: not everywhere, and not visibly to you.
The recovery is mostly about fixing the cause. Delisting before that is a request that will be refused, or granted and reversed within days.
Find out whether you actually are
First, confirm the symptom is a blocklist rather than something else.
The evidence is in the bounce message, which usually names the list and gives a URL. Read the whole bounce in place of the first line. It distinguishes a blocklist rejection from an SPF failure, a full mailbox, or a greylisting delay, which are different problems entirely.
Then check your address against the major lists using an online multi-blocklist tool. Check the server's sending address, not your domain, unless the bounce named the domain.
On shared hosting the address is shared, so a listing may be another account's doing: that is a support conversation rather than something you fix.
Find the cause before requesting removal
Four causes cover nearly all listings.
A compromised script sending spam. The most common on a hosting server. Something on the site was exploited and is sending in volume. Cleaning up a hacked site goes into finding it.
A compromised mailbox. Someone guessed a mail password and is sending through your server with valid credentials, which no security rule catches because the login is correct.
Bulk mail sent from hosting. A newsletter to a purchased or stale list, sent through a server meant for transactional mail. This gets listed quickly and legitimately.
Forwarding. A role address forwarding spam to an external provider, which attributes it to you.
The mail queue and the mail delivery report tell you which. A queue full of messages to addresses you do not recognise is the first two; a large batch to a list is the third. For reading it, see email routing and track delivery.
Stop the sending, then clear the queue
In this order, and both are needed.
Stopping the source without clearing the queue means the already-queued spam continues leaving for hours, and the listing stands.
Clearing the queue without stopping the source means it refills.
Change the compromised mailbox password, suspend or fix the compromised site, and then remove the outbound messages that should not be there.
Then request delisting
Most lists have a self-service removal form. Some remove automatically once sending stops for a period; some require an explanation.
Where an explanation is asked for, be specific and brief: what the cause was, what you did, and when. "It has been fixed" without detail is treated as boilerplate.
Request removal once. Repeated requests while the problem persists get you re-listed with a longer minimum, and some operators treat repeat listings much less charitably than a first one.
Some lists are worth ignoring
An honest point, because a multi-blocklist checker will show hits that mean nothing.
The major lists used by large providers matter enormously. A small list nobody queries affects nothing, and some exist mainly to sell removal.
Never pay for delisting. The reputable lists do not charge. A list demanding payment is telling you it is not one that matters.
Work out which list is actually blocking your mail from the bounce messages, and address that one.
Reputation recovers gradually
Delisting removes the block. It does not restore your standing.
Large providers score senders continuously, and an address that recently sent spam is treated cautiously for weeks afterwards, mail is accepted and filed as spam rather than rejected, which looks like the problem persisting.
Send normally and consistently during that period. Volume spikes while rebuilding reputation extend it.
Prevent the recurrence
The measures that address the four causes above.
Block outbound mail from anything except your mail service, so a compromised script cannot send at all. This is the single most effective control available.
Enforce strong mailbox passwords and rate-limit outbound mail per account, so a compromised mailbox is caught early rather than after a thousand messages.
Send bulk mail through a service built for it, never through hosting. Fixing WordPress email walks through the transactional versus bulk distinction.
Watch outbound volume. A rise from an account that normally sends little is visible hours before a listing appears. There is more in managing quotas and bandwidth.
Get the authentication right while you are here
SPF, DKIM and a valid reverse DNS record do not prevent a listing, and they materially affect how your mail is treated afterwards.
A sender with correct authentication recovering from a listing is treated better than one without. Understanding PTR records goes into the one you have to request from your provider rather than set yourself.
If it was not you
On shared hosting, the sending address belongs to the server. Another account's compromise lists everyone on it.
That is your provider's problem to resolve, and the right action is a support ticket with the bounce message attached in place of a delisting request you cannot substantiate.
If it happens repeatedly, it is a reason to move to a plan with a dedicated sending address, or to send through a dedicated mail service where your reputation is your own.
The setting that most often prevents a repeat is a per-account hourly send limit, which caps what a compromised account can do. There is more in Exim Configuration and Mail Routing in WHM.
The bounce text normally names which list and why, which is faster than checking them one by one. Understanding Email Bounces and Delivery Codes goes into the codes.
A recipient whose system filtered your message can send you the headers, which usually name the exact rule. How to Read Email Headers and Trace a Message goes into reading them.