Blacklist Check

About the Blacklist Check

This tool runs a live DNSBL lookup, checking an IPv4 address, or the IP behind a domain's A record, against ten of the internet's most consulted DNS blacklists (DNSBLs, also called RBLs) in a single pass, including Spamhaus ZEN, SpamCop, Barracuda's BRBL and CBL. It answers the one question that decides whether a message lands in an inbox or a junk folder: is this sending IP on a list a receiving mail server actually consults.

A blacklist check matters because most receiving servers query DNSBLs before they even look at message content. A single listing on Spamhaus ZEN or SpamCop can mean instant rejection or silent delivery to spam, no matter how clean your SPF, DKIM and DMARC setup is. Run this rbl check whenever mail suddenly stops arriving, before moving a mail server to a new IP, or as a routine step in a deliverability audit.

What sets this dnsbl lookup apart from a quick single-list spamhaus check is breadth combined with detail. It queries the reversed IP against all ten zones directly over DNS in parallel and returns the raw listing codes per list, not just a yes or no. It also separates a genuine listing from a "blocked query" response, a distinction most quick blacklist checkers get wrong and misreport as either clean or listed.

Enter an IPv4 address or a domain name. If you give a domain, the tool resolves its current A record first and checks that IP, so there is no need to look up the address yourself beforehand. Combine the result with the SPF, DKIM, DMARC and mail deliverability checkers on this site to build the full picture behind a bounced or spam-foldered message.

How to use it

1. Enter the sending IPv4 address, or a domain to have its A record resolved automatically.
2. Submit the check to query ten major DNS blacklists, including Spamhaus, SpamCop and Barracuda, in parallel.
3. Read the overall verdict: clean, or listed on N of the 10 blacklists checked.
4. Open the per-list table and note which zones show listed versus clean versus blocked query.
5. For a real listing, note the returned code, it usually maps to a specific reason such as spam source, open relay, compromised host or dynamic IP.
6. Visit that specific blacklist's own site to start delisting, each list runs its own removal process.
7. Re-run the check after requesting removal to confirm the record actually cleared before you resume sending.

Examples

• Check 8.8.8.8 as a baseline and see it return not listed on any of 10 blacklists.
• Enter your mail server's public IP, for example 203.0.113.42, right after a delivery complaint to rule blacklisting in or out first.
• Enter a domain like mail.example.com to have the tool resolve its A record and check that IP without running dig or whois yourself.
• Check a fresh VPS IP before configuring it as a mail relay, a previous tenant may have left it listed on SORBS or UCEPROTECT.
• See a hit on cbl.abuseat.org with a code like 127.0.0.2, confirming the IP feeds into Spamhaus XBL because it looks compromised, not merely badly reputed.
• After requesting removal from zen.spamhaus.org, re-check the same IP to confirm the listing actually dropped before telling a client mail is fixed.

How a DNSBL lookup actually works

Every DNSBL is queried the same way: the IP's octets are reversed and prepended to the blacklist's zone as a hostname, then looked up as a DNS A record. For 8.8.8.8 against Spamhaus, that means querying 8.8.8.8.zen.spamhaus.org. No answer (NXDOMAIN or empty) means clean. An answer in the 127.0.0.0/8 range means listed, and the specific address returned usually encodes the reason, for example Spamhaus splits SBL, XBL and PBL hits across different 127.0.0.x codes.

This tool fires that same reversed-IP query at all ten zones in parallel rather than one at a time, so a full check completes in one round trip per list instead of ten sequential ones. One reserved range needs special handling: codes in 127.255.255.x are not listings at all, they are a list telling the resolver something else, most notably that Spamhaus refuses queries sent through public DNS resolvers like 8.8.8.8 or 1.1.1.1. Those responses are filtered out and reported as a blocked query, never counted toward the listed total, which is exactly the kind of detail a naive DNSBL script gets wrong.

What each blacklist actually checks

The ten zones behind this ip blacklist lookup cover different detection methods, so a listing on one carries different weight than a listing on another.

• zen.spamhaus.org, Spamhaus ZEN: the combined feed of SBL (hand-verified spam sources), XBL (compromised hosts and botnets, including CBL data) and PBL (dynamic or residential ranges policy-blocked from sending mail directly). The single most consulted DNSBL worldwide, and the one most likely to cause an outright rejection.
• bl.spamcop.net, SpamCop: driven by end-user spam reports submitted through SpamCop's reporting tool. Listings are usually short-lived and clear on their own once complaints stop arriving.
• b.barracudacentral.org, Barracuda Reputation Block List (BRBL): used by Barracuda's own mail security appliances and widely mirrored by other vendors, so a listing here affects more inboxes than just Barracuda customers.
• cbl.abuseat.org, Composite Blocking List (CBL): a fully automated detector of hosts exhibiting spamming or backscatter behaviour, built from spamtrap and honeypot data. Its feed is folded into Spamhaus XBL, so a CBL hit very often means a Spamhaus ZEN hit as well.
• dnsbl.sorbs.net, SORBS: one of the oldest DNSBLs, aggregating several sub-lists covering open relays, open proxies and known spam sources.
• dnsbl-1.uceprotect.net, UCEPROTECT Level 1: lists individual IPs after spamtrap hits. Known for auto-expiring listings after roughly seven days of clean behaviour, or a paid fast-track removal if you need it lifted sooner.
• psbl.surriel.com, Passive Spam Block List (PSBL): spamtrap-driven, with free self-service delisting once you fix the cause.
• bl.mailspike.net, Mailspike: a reputation-scored blacklist used by several mail security products rather than a simple binary list.
• db.wpbl.info, Weighted Private Block List (WPBL): a smaller, community-reported list, useful as a secondary signal rather than a primary indicator.
• all.s5h.net, S5H: a lightweight, spamtrap-based list with a narrower footprint than the others checked here.

Delisting steps per blacklist

Fix the underlying cause first, an open relay, a compromised WordPress cron job sending spam, or mail routed straight from a dynamic residential IP, or any delisting will not stick. Once the cause is resolved, follow the specific list's own process:

• Spamhaus (ZEN / SBL / XBL / PBL): look the IP up directly at spamhaus.org to see which sub-list and reason applies. SBL and XBL require a self-service removal request after the cause is fixed. PBL removal is either handled by your ISP or self-service if you legitimately send mail from that range.
• Barracuda (BRBL): submit a removal request at barracudacentral.org/rbl/removal-request. It usually clears within a few hours once approved.
• SpamCop: listings expire automatically as reports stop coming in, typically within 24 to 48 hours of clean sending, there is no manual removal form.
• CBL (abuseat.org): check the lookup at abuseat.org/lookup for the detection detail. Listings usually self-expire once the compromised behaviour stops, and a manual removal option is also available there.
• UCEPROTECT Level 1: auto-expires after about 7 days of no further hits, or use their paid express delisting to have it removed sooner. That pay-to-delist model is widely criticised in the industry, factor that in before paying.
• SORBS, PSBL, Mailspike and WPBL: each runs its own free web-based delisting form, search for the list name plus "delisting" and follow its instructions after confirming the cause is resolved.

False positives and reading the result correctly

Not every entry in the results table means what it looks like at first glance, and not every listing carries the same weight with a receiving mail server.

• "blocked query" is not a listing: some lists, notably Spamhaus, refuse lookups sent through public DNS resolvers such as 8.8.8.8 or 1.1.1.1 and answer with a reserved 127.255.255.x code instead of a real result. This is filtered and reported separately here so it never gets counted as clean or listed by mistake.
• Shared hosting IPs get listed for someone else's spam: if outbound mail goes through a shared IP, another tenant's abuse can list the entire address. If this keeps recurring, ask the host for a dedicated sending IP instead of repeatedly delisting.
• A PBL listing is a policy flag, not an abuse flag: Spamhaus PBL listings usually just mean the IP sits in a range marked as not meant to send mail directly, such as residential or dynamic cloud ranges. The fix is routing outbound mail through a proper SMTP relay, not requesting delisting.
• Not every receiving server checks every list: a hit on a smaller list like WPBL or S5H may have no effect at all on delivery to Gmail or Microsoft, while a Spamhaus ZEN listing almost always causes an outright rejection. Weigh listings accordingly rather than treating all ten as equally severe.

Frequently asked questions