Is My IP Blacklisted? How to Check and Get Delisted

To find out whether your IP address is blacklisted, look it up on the DNS blacklists (DNSBLs) that mail servers consult, such as Spamhaus ZEN, Barracuda, SpamCop, and PSBL. If it is listed, find and fix the cause, then use that list's own removal process, which for these lists costs nothing. An IP blacklist check takes a few seconds, and the result tells you which list has the address and usually why.

Check an IP address on four blacklists Look up any IPv4 address, or the server behind a domain, on Spamhaus ZEN, Barracuda, SpamCop, and PSBL.

What is an IP blacklist (DNSBL)?

An IP blacklist is a list of IP addresses that have sent spam, been seen in abuse, or, in some cases, should not be sending mail directly at all. Most are published through DNS, which is why they are called DNS blacklists, DNSBLs, or RBLs (realtime blackhole lists). Many operators now call them blocklists. A mail server that receives a connection looks the connecting address up on one or more of these lists and decides what to do with the message.

How does a blacklist lookup work?

The method is described in RFC 5782. To check an IPv4 address, reverse its four numbers and add the list's zone name. For 203.0.113.25 on Spamhaus ZEN, the query is 25.113.0.203.zen.spamhaus.org. Then read the answer:

• NXDOMAIN (the name does not exist): the address is not listed.
• An A record in 127.0.0.0/8: the address is listed. The exact value says why. RFC 5782 asks lists to answer inside that range so the reply cannot be mistaken for a real host.
• A TXT record (optional): a short reason, often with a link. Mail servers frequently copy it into their rejection message.

Every DNSBL must list 127.0.0.2 as a test entry and must never list 127.0.0.1. A real query for the test entry on Spamhaus ZEN:

IPv6 addresses work the same way, with the address written out as 32 reversed hexadecimal digits, but many lists, and the HostChecker tool, cover IPv4 only.

Why do blacklists give different results?

Each list has its own sources, criteria, and expiry rules, so one address can be listed on one and clean on the others. The four that HostChecker checks:

• Spamhaus ZEN combines several Spamhaus lists in one zone. The return code names the list: 127.0.0.2 is the SBL (addresses sending spam or hosting malicious content), 127.0.0.3 is SBL CSS data, 127.0.0.9 is DROP (hijacked or criminal network ranges), 127.0.0.4 is the XBL (compromised or infected machines), and 127.0.0.10 and 127.0.0.11 are the PBL (address ranges that should not send mail directly).
• Barracuda Reputation Block List is run by Barracuda Networks and rates the sending IP addresses of mail servers.
• SpamCop Blocking List is built from spam reports and spam traps, and is time-based. SpamCop calls it aggressive and says it often errs on the side of blocking mail.
• PSBL (Passive Spam Block List) lists any address that delivered mail to its spam-trap addresses.

Spamhaus's free service also refuses queries that come through many public DNS resolvers. It answers with a code such as 127.255.255.254 in place of a verdict, which some checkers misread as a listing. The Spamhaus DNSBL usage FAQ lists these codes.

Why does a blacklisting make email bounce?

When your server connects to deliver a message, the receiving server looks your IP address up on the lists it has chosen. If it finds a listing, it can reject the message during the SMTP conversation with a 5xx error, which your server turns into a bounce. The bounce text often names the list and includes the TXT record's link. Other servers accept the message but add points to its spam score, so it lands in the junk folder. Each receiving server picks which lists to use and what a listing means for it; SpamCop itself recommends tagging or diverting mail from its list over rejecting it outright.

How do I check if my IP is blacklisted?

1. Find the right address. Check the IP your mail leaves from, which may differ from your website's address. Send a message to another mailbox you own and open its headers: the Received line added by the receiving server names the address that connected to it. If you send through Google Workspace, Microsoft 365, or a mailing service, the sending address is the provider's.
2. Run the check. Enter the address in the IP blacklist check (the "Blacklists" button). It queries the four lists above and reports each one as listed, clean, or not checked. A list that times out or refuses the query shows as "not checked", which is never counted as clean. A domain is checked at the first IPv4 address it resolves to.
3. Read the bounce. If mail is being rejected, the bounce message is the most direct evidence. It shows which server refused the mail and often which list it used.

Why did my IP get blacklisted?

• A compromised host. Malware on a computer or router, a stolen mail account password, or a vulnerable website contact form sending spam. This is what the Spamhaus XBL tracks.
• A shared or recycled IP. On shared hosting, a VPS, or a newly assigned address, someone else's mail can get the address listed. PSBL notes that on a dynamic address the previous user may have sent the spam.
• A residential or dynamic range. The Spamhaus PBL lists ranges that ISPs and Spamhaus say should not deliver mail directly. A home connection on the PBL has not done anything wrong; mail from it is expected to go through the provider's server.
• Sending practices. Mailing old or bought lists hits spam traps, which feed lists such as SpamCop and PSBL.

How do I get my IP off a blacklist?

Fix the cause first. A removal without a fix lasts until the next spam run. Then follow each list's own process:

• Spamhaus. All removals go through the Spamhaus Reputation Checker. Spamhaus says there is never a fee for removing any Spamhaus listing, and any offer to remove one for a fee is a scam. XBL listings expire automatically once the bad behavior stops, and can also be removed there. SBL removals are handled by the network or hosting provider responsible for the address, so a customer starts with their provider. For the PBL, a static IP running a real mail server with matching forward and reverse DNS can be excluded; anyone else should send through their provider's server using authenticated SMTP on port 587 or 465.
• Barracuda. The removal request form asks for the IP address, an email address, a phone number, and a reason. Barracuda says requests with a valid explanation are typically processed within 12 hours, and that requests without valid information, and repeat requests, are ignored.
• SpamCop. SpamCop says an address is delisted automatically 24 hours after the last spam report, and asks people not to write in for early delisting once they have fixed the problem. If reports keep arriving, the listing stays. Its blocking list page shows when a listed address will expire.
• PSBL. The PSBL site has an automated removal form, and PSBL says the address leaves its DNS servers within about half an hour. Without it, an address expires once it has sent nothing to the traps for a few weeks.

Mail servers cache DNS answers, so a removal can take a little while to reach every receiver. Run the check again afterwards to confirm.

What a blacklist listing does not tell you

A public blacklist is one signal among several. Large mailbox providers such as Gmail and Microsoft keep their own private reputation data, which no public lookup can show. An address clean on every DNSBL can still be blocked at Microsoft, and a listing on one small list may not affect delivery to most recipients.

Microsoft 365 is a common case: a bounce with 550 5.7.606-649 Access denied, banned sending IP means the address is on Microsoft's own blocked senders list, and the fix is Microsoft's delist portal. No DNSBL removal will clear it. Google's Postmaster Tools reports how Gmail sees mail from a domain you verify, including its spam rate and authentication results.

Common questions

Can I pay to get delisted faster?

Not from Spamhaus: removal is free, and Spamhaus calls paid removal offers a scam. Treat any third party that charges to remove a listing with suspicion; the removal still has to go through the list's own process.

How long does a blacklist listing last?

It depends on the list. SpamCop listings end 24 hours after the last report, PSBL entries expire after a few weeks without spam-trap hits, and Spamhaus XBL entries expire once the activity stops. Spamhaus SBL listings stay until the responsible provider resolves them. A listing that keeps returning means the cause is still there.

My IP is clean but mail still goes to spam. Why?

Delivery also depends on authentication, reverse DNS, content, and the receiver's own reputation data. Check your domain's SPF, DKIM, and DMARC records with the SPF, DKIM, and DMARC checker, and confirm the sending IP's reverse DNS name with a DNS lookup of the address.

Is my home IP on the Spamhaus PBL a problem?

Only if you send mail directly from it to other mail servers. A mail program that sends through your provider's or mail host's server with a login is not affected.

Does a blacklist affect my website?

These lists are built for mail, and mail servers are what query them. A listing of a web server's IP does not by itself stop the site loading in a browser.