diff --git a/TODO.md b/TODO.md
index 764710a..efb7b84 100644
--- a/TODO.md
+++ b/TODO.md
@@ -3,6 +3,28 @@
 Outstanding hardening items (see `README.md` for the full service overview).
 Nothing here is urgent; all are low-risk, no-downtime changes.
 
+- [ ] **Mail server IP (`89.58.8.149`) listed on Barracuda's BRBL** — found
+      2026-07-25 (user report: "jayfield.org is on the Barracuda MX
+      blacklist"). Confirmed via `dig +short 149.8.58.89.b.barracudacentral.org A`
+      → `127.0.0.2` (listed); clean on Spamhaus ZEN, SpamCop, and SORBS —
+      Barracuda-specific. Checked the server for actual abuse before
+      requesting removal: mail queue empty, outbound volume ~11 msgs over
+      the prior week, only known SASL logins (`jens@`/`otto2022@jayfield.org`
+      from the usual home IP), no backscatter, correct PTR
+      (`alpha.jayfield.org`), SPF/DKIM/DMARC (`p=reject`) all already live —
+      no sign of a compromised account or open relay, so most likely a
+      stale/inherited reputation hit on the IP rather than active abuse
+      from this host.
+      Submitted a removal request via
+      `https://www.barracudacentral.org/rbl/removal-request` on 2026-07-25.
+      **Confirmation number: `BBR21785009436-19117-9182`.** Per Barracuda's
+      response, the IP gets a temporary 48h reputation bump to "normal"
+      while they investigate (up to ~1h to propagate), after which it
+      either stays clear or reverts to listed. Scheduled follow-up checks
+      (routines `trig_01F1RMhEtNHtAbuHb9ffe1oX` at ~1h,
+      `trig_019GayXSo5TW5eSxiJ99Ghrp` at ~48h) — if it reverts, next step is
+      a manual follow-up to Barracuda citing the confirmation number above.
+
 - [ ] **dyndns app has no real per-user auth binding** — found 2026-07-20,
       while fixing the command injection below.
       `index.php`'s `pass == '_NO_PASS_'` check is a hardcoded magic