What this blacklist check shows
An IP blacklist (also called a blocklist, a DNSBL, or an RBL) is a list of IP addresses that have been seen sending spam or taking part in abuse. Mail servers look an address up on these lists when a message arrives, and many reject it or send it to spam when it is listed. HostChecker asks four of them about an address: Spamhaus ZEN, Barracuda Reputation, SpamCop, and PSBL. The lookup is ordinary DNS. It reverses the four numbers of the address and adds the list’s name, so 203.0.113.25 on Spamhaus becomes 25.113.0.203.zen.spamhaus.org. If that name does not exist, the address is not listed. If it answers with an address that starts 127., the address is listed, and the exact number says which list or reason (the method is standardized in RFC 5782). Each list gets one lookup, so a check takes a few seconds. What happens first depends on whether you enter a domain name or an IP address.
For a domain name
Enter a domain and HostChecker looks up its IPv4 address first, following any alias (CNAME) to the real address, then checks that address. If the name has several addresses, as big sites usually do, only one is checked, and it can be a different one the next time. The note under the table says which address was checked and how many the name has. To check another one, type that address. Here is an example, with what each part tells you:
Blacklists
| Blacklist | Status |
|---|---|
| Spamhaus ZEN | clean |
| Barracuda Reputation | clean |
| SpamCop | clean |
| PSBL | clean |
Checked 203.0.113.10, one of the 3 addresses example.com points to. To check another one, type its address. Being listed does not always mean compromised: shared-hosting addresses get swept up too. Not being listed does not mean every mail provider will accept this address.
The address that gets checked is the one the name points to for ordinary lookups, which is usually the web server. That is often not the server that sends or receives the domain’s email. If you are chasing an email problem, look up the domain’s MX record with DNS Lookup and check the mail server’s address, or better, check the address your mail actually leaves from, which is in the Received headers of a message you sent. Many domains send through a provider such as Google or Microsoft, in which case the sending address is the provider’s, not yours.
For an IP address
Enter an IP address and it is checked directly, with no name lookup. The tiles count the lists that list it, the lists that do not, and any that could not be checked. The table says which is which, and the line under each status says why, where the list or the lookup tells us. Here is an example, with what is different:
Blacklists
| Blacklist | Status |
|---|---|
| Spamhaus ZEN | LISTED XBL (compromised or infected machine) |
| Barracuda Reputation | clean |
| SpamCop | LISTED |
| PSBL | not checked No reply from the DNS server |
Checked 203.0.113.25. Being listed does not always mean compromised: shared-hosting addresses get swept up too. Not being listed does not mean every mail provider will accept this address.
“Not checked” is not a clean result. It means a list did not give a usable answer: the lookup timed out, failed, or the list refused to answer. Some lists limit who may ask. Spamhaus’s free service, for one, does not answer queries that arrive through many public or shared DNS resolvers (it wants a resolver on your own network, or a public one that supports EDNS Client Subnet), or in large volumes, and it replies with an error code in place of a verdict. HostChecker shows that as “not checked” with the reason, and never counts it as listed or as clean.
Either way, this check looks at four IPv4 blacklists and nothing else. It does not check IPv6 addresses (they are not accepted), domain and link blacklists such as the Spamhaus Domain Blocklist, SURBL, or URIBL (those list domain names, not addresses), the many other IP blacklists that exist, or the private reputation scores that mailbox providers such as Gmail and Microsoft keep about senders. Nor does it test whether your mail is being delivered. Private and reserved addresses, such as 192.168.x.x or 127.0.0.1, are refused. For a Spamhaus listing the line under the status names the Spamhaus list that matched. The other three lists only say “listed”.
How to read the result
- Listed (red). At least one list has this address. One listing on one list is a signal, not a verdict: each mail server picks which lists it consults and what it does about a listing, and many only use them as one input to a spam score. Look at which list, and why (below).
- Clean on every list (green). None of these four lists has the address. It does not mean mail will be accepted. Other lists, mailbox providers’ own reputation systems, missing email authentication, and the content of the message all affect delivery.
- Not checked (amber). One or more lists could not be asked or did not answer properly. The rest of the result still stands, but a green “not listed” is only claimed when every list answered. Run it again in a minute if you need a full answer; if the same list is never checked, check that list on its own website instead.
- The line under a Spamhaus ZEN listing. ZEN combines several Spamhaus lists, and which one matters. SBL and CSS list addresses that send spam or support spammers. DROP covers network ranges that Spamhaus says are leased or stolen by spam and cybercrime operations, and it always appears together with SBL. XBL lists addresses of machines or devices that are insecure, compromised, or infected. PBL is different: it lists address ranges (mostly home and office connections) that should not send email directly to other mail servers, so it is a policy list, not a record of spam sent from that address.
- The tiles. Listed is red above 0. Clean counts lists that answered “not listed”. Not checked appears only when there is a list that could not be asked.
What to do if an IP is listed
Find out why before asking to be removed
A listing is a symptom. Removal without a fix usually lasts only until the next spam. Common causes are a compromised mail account or website, malware on a computer or router in the network, an open mail relay, a form or script on a website that spammers abuse to send mail, mailing a list that includes spam traps or people who did not ask for it, and, on shared or recycled addresses, the behavior of a previous owner or a neighbor. Check your mail logs for messages you did not send, change passwords, and update any software that has a known security hole. Each list has a lookup page that usually explains its own reason, such as the Spamhaus Reputation Checker at check.spamhaus.org.
Ask each list to remove it, and never pay
Every list works differently:
- Spamhaus. Removal is free, always, and Spamhaus says any offer to remove a listing for a fee is a scam. Use check.spamhaus.org. XBL listings expire on their own once the problem stops, and have a removal option there. For SBL, Spamhaus says removal requests come from the internet provider in charge of the address, so if you rent the address from a hosting company, start with them.
- Barracuda. It has a removal request form on barracudacentral.org that asks for the address and an email address. Give a real explanation of what was wrong and what you changed, because requests without one are ignored. Barracuda says valid requests are normally processed within hours.
- SpamCop. Its list follows spam reports and spam traps and is time-based. SpamCop says an address delists by itself about a day after the reports stop, and that you should not ask for early delisting after you have fixed the problem. If reports keep arriving, so does the listing.
- PSBL. It lists addresses that sent mail to its spam-trap addresses. Entries expire by themselves when the traps stop hearing from the address, and PSBL also has a removal form on psbl.org.
After removal, wait a little for DNS caches to catch up and run the check again.
Listed only on the Spamhaus PBL
The Policy Blocklist is not an accusation. It exists because ordinary home and office connections should send email through their provider’s mail server, not directly to the world. If your address is on it and you run a mail server on a static address, Spamhaus says a single address that is a real, correctly configured mail server (with a matching reverse DNS name) should be removed, and individuals can ask for removal at check.spamhaus.org. If you only use a mail program on a home connection, send through your provider’s or your mail host’s outgoing server instead, and you will not hit the problem.
You are listed but nothing is wrong
This happens most on shared hosting, virtual servers, and newly assigned addresses: someone else abused the address before you, or a neighbor on the same range did. The fix is the same: ask the list to remove it, and tell your hosting provider, because they can move you or clean up their range. Some lists, Spamhaus’s among them, can list a whole range of addresses, so one bad customer can affect others.
Not listed, but mail still bounces or lands in spam
Then the cause is somewhere else. Read the bounce message; it usually names the reason and sometimes the list. Microsoft, for example, keeps its own blocked-senders list for mail to Microsoft 365. A bounce with a code of the form 5.7.606 to 5.7.649 means the sending address is blocked there, and Microsoft points to a delist portal at sender.office.com. Outlook.com, the consumer service, has its own delisting form. Google offers Postmaster Tools, which shows the reputation Gmail has for your sending domain and address. Then check the basics with Email Check: SPF, DKIM, and DMARC records. Also make sure the sending address has matching reverse DNS, and that you are not sending bulk mail people did not ask for.
Frequently asked questions
How do I check whether my IP address is blacklisted?
Type the IP address into the box above and run the check. It looks the address up on four blacklists (Spamhaus ZEN, Barracuda Reputation, SpamCop, and PSBL) and shows which, if any, list it. To check a mail server, use the address your mail is sent from, not necessarily your website’s address. You can also type a domain, in which case its first IPv4 address is checked.
What is a blacklist, a DNSBL, or an RBL?
They are all names for the same thing: a list of IP addresses, published through DNS, that have been associated with spam or abuse. A mail server asks DNS whether the sender’s address is on the list (a name that exists means yes, a name that does not exist means no), and then rejects, flags, or accepts the message according to its own rules. “Blocklist” is the newer word that many operators, such as Spamhaus, now prefer. The lookup method is defined in RFC 5782.
Which blacklists does this check use?
Four: Spamhaus ZEN, which combines Spamhaus’s SBL, XBL, and PBL lists; the Barracuda Reputation Block List; the SpamCop Blocking List; and the Passive Spam Block List (PSBL). That is a short list on purpose: they are widely used, and each publishes how to get removed. There are dozens more IP blacklists in the world, so a clean result here is not a clean result everywhere.
What does “not checked” mean?
It means a blacklist gave no usable answer, so it is not counted as listed and not counted as clean. The cause is usually a timeout or DNS failure, or the list refusing the query. Spamhaus’s free service, for example, does not answer queries that come through many public or shared DNS resolvers (it wants a resolver on your own network, or a public one that supports EDNS Client Subnet), or that arrive in large numbers. The line under “not checked” shows the reason. Run the check again, or look the address up on that list’s own website.
Does being on a blacklist mean my email is blocked?
Not necessarily. A blacklist only publishes information. Each mail server decides which lists to use and what to do about a listing: some reject the message, some add to a spam score, some ignore the list. SpamCop itself says its list should be one input to a scoring system, not the only reason to block mail. Being listed does raise the chance of rejected or filtered mail, but being clean does not guarantee delivery either.
How do I get removed from a blacklist?
Fix the cause first, then use that list’s own process. Spamhaus removals are free and handled through check.spamhaus.org (for SBL, by the internet provider in charge of the address). Barracuda has a removal request form. SpamCop listings expire by themselves some time after spam reports stop. PSBL entries expire by themselves and also have a removal form. Never pay anyone to get you delisted: Spamhaus says any offer to do so is a scam, and no third party can speed up a removal.
How long does a blacklist listing last?
It depends on the list and on whether the problem continues. SpamCop and PSBL listings are time-based and drop off by themselves when the reports or spam-trap hits stop. Spamhaus XBL listings also expire automatically once the bad behavior is no longer seen. Others, such as Spamhaus SBL, stay until they are removed. A listing that keeps coming back means the cause has not been fixed.
Why does it check an IP address when I entered a domain?
These blacklists list IP addresses, not domain names. When you enter a domain, HostChecker looks up its IPv4 address and checks that. A domain with several addresses has only one checked, and the note under the table says which. A domain’s website address is often not its mail server’s address, so for email problems check the mail server’s address directly. Blacklists that list domain names themselves, such as the Spamhaus Domain Blocklist, SURBL, and URIBL, are not checked.
Can I check an IPv6 address?
No. This check covers IPv4 only. An IPv6 address is not accepted, and a domain that has only an IPv6 address cannot be checked.
Is the blacklist check free?
Yes. There is no signup, no account, and no limit on how many addresses you check, apart from a per-visitor rate limit that keeps the service fast for everyone.