IP blacklist check

What is an IP blacklist (DNSBL)?

An IP blacklist, also called a DNSBL or RBL, is a list of IP addresses that its operator treats as a source of spam, malware traffic or mail that shouldn't come straight from that network. Mail servers query one or more lists for every IP that connects to them, then reject or score the message when the address is listed.

The lookup runs over ordinary DNS, as described in RFC 5782. The mail server reverses the four parts of the IPv4 address and appends the list's zone name. To test 192.0.2.99 against Spamhaus ZEN, it asks DNS for 99.2.0.192.zen.spamhaus.org. An answer inside 127.0.0.0/8, such as 127.0.0.2, means the address is listed. No answer means it isn't.

RFC 5782 also requires every IPv4 list to include 127.0.0.2 as a test entry and never list 127.0.0.1.

How to read your IP blacklist check results

To answer "is my IP blacklisted?", read the results one row at a time. Each row names one list and gives one status. "Not listed" means the list returned nothing for your IP. "Listed" means it returned a 127.0.0.x code. A timeout means the list didn't reply in time, which says nothing good or bad about your address.

Lists don't carry equal weight. A Spamhaus or Barracuda listing tends to cause bounces at many providers, while a small list may have no visible effect. Bounce messages usually name the list that blocked you. For Spamhaus ZEN, the return code tells you which list matched:

• 127.0.0.2 and 127.0.0.3: SBL and its CSS component, addresses Spamhaus has tied to spam sending.
• 127.0.0.4 to 127.0.0.7: XBL, hijacked machines and devices infected with malware.
• 127.0.0.10 and 127.0.0.11: PBL, end-user ranges that shouldn't send mail directly. This is a policy entry, not proof of spam.
• 127.255.255.x: an error, not a listing. Spamhaus sends these codes when a query arrives through a large public DNS resolver or when query volume is too high.

Why do IP addresses get blacklisted?

Most IP addresses end up on a blacklist because spam actually left them, usually from an infected computer, a hacked mailbox or a website form abused to send mail. The rest are listed for policy reasons or because other customers on the same network sent spam.

• Compromised machines: a PC in a botnet sends spam directly on port 25 without the owner noticing.
• Stolen passwords, open relays and contact forms without a CAPTCHA let others send mail through your server.
• Bad lists: bulk mail sent to bought or years-old lists hits spam traps, addresses kept only to catch senders who never asked for consent.
• Shared addresses: one bad customer on shared hosting gets the server IP listed for everyone, and a new VPS can inherit an address a previous tenant burned.
• Whole ranges: UCEPROTECT Level 2 lists a netblock with too many bad IPs, and Level 3 lists a provider's entire network (ASN).

When a listed address is unfamiliar, see who owns an IP address to learn whether it belongs to a home ISP, a hosting company or a cloud network.

How to remove your IP from a blacklist

IP blacklist removal starts with fixing the cause, then asking each list that names you to delist the address. If you remove an IP from a blacklist before the spam source is gone, the list adds it again as soon as it sees new spam.

1. Fix the cause. Remove malware, reset mailbox passwords, close open relays and check the mail queue for messages you didn't send.
2. Open each list's own removal page and follow its process. For Spamhaus, the Spamhaus reputation checker is the only place removals are handled.
3. If the IP is rented from a host or cloud provider, open a ticket with them. For range listings, only the provider can request removal or give you a clean address.
4. Run the check again. Spamhaus asks you to allow about 15 minutes for DNS to update; other lists can take hours or days.

How to keep your mail server off blacklists

A mail server stays off blacklists by sending authenticated mail only to people who asked for it, at a limited rate. Publish SPF, DKIM and DMARC records for every sending domain, and set the PTR (reverse DNS) record of the sending IP to the hostname the server announces in HELO.

• Send only to subscribers who opted in, and drop addresses after the first hard bounce.
• Limit messages per minute for each account, so one stolen password can't push out a flood.
• Block outbound port 25 from every machine except the mail server.

Then check which ports are open on your server and close any you don't use.

Frequently asked questions

Does a blacklisted IP affect normal browsing?

Almost never. DNSBLs are built for mail servers, and websites rarely query them. Some forums check spam lists before accepting a post, which is where home users usually see "your IP is listed." Email you send through Gmail or Outlook on the web isn't affected, because it leaves from their servers, not your IP.

Why is my home IP on Spamhaus PBL?

Spamhaus describes the PBL as "a dataset containing end-user IP address ranges from which email should never be sent directly to the final destination," and says these IPs "are not necessarily bad." ISPs often add their home ranges themselves. Only public addresses appear there, never the private 192.168.x.x ones your router hands out; see public and private IP addresses. Dynamic addresses can't be removed.

How long does it take to get delisted?

It depends on the list. A Spamhaus PBL exclusion for a mail server works after about 15 minutes of DNS propagation and lasts one year. Lists that expire entries automatically may wait days after the last spam they saw. Range listings last until the provider cleans up its network.

Can I check a domain instead of an IP?

Domain reputation lives on separate lists, such as Spamhaus DBL, SURBL and URIBL, which flag domains found in links inside spam. An IP list says nothing about a domain. To test a domain against IP lists, look up the IP of its mail server (the MX record) and check that address. Spamhaus's own checker accepts both IPs and domains.

My IP is clean on every list but emails still go to spam. Why?

Gmail and Outlook keep their own sender reputation, which public blacklists don't show. Missing SPF, DKIM or DMARC, a mismatched PTR record, spam complaints and link-heavy content all count against you. Google's email sender guidelines list what Gmail checks. Google Postmaster Tools shows how Gmail rates your domain, and Microsoft SNDS shows how Outlook.com sees your IPs.