IP blacklist check

How this tool works

Enter an IPv4 address and the tool queries 8 DNS-based blocklists at once. The lookup is free and there is no account.

A DNSBL is a blocklist published through the DNS. To ask whether 203.0.113.45 is listed, a client reverses the octets, appends the list's zone and queries the resulting name, in this case 45.113.0.203.zen.spamhaus.org. If the name resolves to an address in the 127.0.0.0/8 range, the IP is listed, and the exact address encodes why. If the name does not exist, the IP is not on that list. The tool performs these queries through our server's resolver for each of the 8 lists and reads the return codes. The DNSBL glossary entry covers the mechanism in more depth.

The lists queried:

For Spamhaus ZEN the tool decodes the return code into the sub-list that matched: 127.0.0.2 is an SBL listing, 127.0.0.3 is CSS, 127.0.0.4 is XBL, 127.0.0.9 is DROP, 127.0.0.10 is a PBL end-user range and 127.0.0.11 is a PBL range maintained by the ISP itself. The other lists return a generic code, which the tool shows as listed with the code value.

Two situations are reported as errors rather than results. Spamhaus refuses queries that are relayed through public resolvers or that exceed its free-use limits, answering with a code in the 127.255.255.0/24 range; the tool recognizes that code and reports that the list refused the query instead of showing a false listing. If our server's own resolver is unhealthy, the Spamhaus query is skipped entirely, because asking a public resolver would only produce a refusal, and the tool reports that the list is not queryable from this server. The other 7 lists accept queries through either path.

Results are cached for 1 hour per address and list, and cached rows are marked so you know the answer is not seconds old. Only IPv4 addresses are checked; an IPv6 address returns a note on each row that the list does not cover it.

How to read the result

The summary line gives the number of lists checked and the number that returned a listing. Below it, each list has one of four states:

Not listed. The query returned no record. The address is clean on that list as of the time of the query.

Listed. The query returned a 127.0.0.x code. The reason column shows the decoded meaning for Spamhaus or the raw code for the other lists. Follow the link to the list's site for the full entry.

Query refused. The list answered with a policy code. The address may or may not be listed; the tool could not find out through this path.

Lookup failed. The DNS query itself failed. Retry later; if it persists, the list may be down.

A single listing on a small list has a small effect. A listing on Spamhaus SBL, XBL or CSS, or on Barracuda, affects delivery at a large share of mail servers worldwide, because those lists are consulted at connection time and a hit is usually a hard rejection.

The reason matters as much as the list. The Spamhaus PBL, for example, is not an accusation. It says the address belongs to a range that the ISP has designated for end users, whose mail should go through the ISP's mail server rather than directly to the recipient. Every home and mobile connection is expected to be on it. An XBL listing is different: it says the machine behind the address, or one that shared it, has been observed infected with malware or acting as an open proxy, and that needs fixing.

UCEPROTECT Level 1 and PSBL list individual addresses that hit spam traps. SORBS and DroneBL include categories such as open proxies and dynamic ranges that may apply even if no spam was ever sent from your address specifically.

How to get delisted

Before requesting removal

1. Find out why the address was listed. Each list's site shows the listing with a date and category; the Spamhaus reason code already narrows it down.
2. Fix the cause. For a server, that means finding the compromised account, the vulnerable contact form, the open relay or the infected website that was sending. For a home connection, scan every device behind the router. Requesting removal while the cause is still active gets the address relisted within hours and some lists lengthen the listing for repeat offenders.
3. Make sure the basics are right so the address does not get listed again: a PTR record that forward-confirms, an SPF record that includes the address, DKIM signing and a DMARC policy on the sending domain.

Requesting removal, list by list

1. Spamhaus. Use the lookup on the Spamhaus site for the exact address. SBL removals are reviewed by Spamhaus staff and need a description of what was fixed. CSS and XBL entries can be cleared through the self-service pages once the cause is gone, and come back automatically if the behavior continues. PBL entries are not an abuse listing: either send through your ISP's relay, or, if you legitimately run a mail server on a static address, use the PBL self-removal process.
2. SpamCop. Entries expire on their own, typically within a day or two of the last report, once trap hits stop. Check the listing page for the expiry time; there is no form to fill in.
3. Barracuda. Submit the removal request on the Barracuda reputation site with a contact email and a short explanation of the fix.
4. SORBS. Check the SORBS site for the current procedure, which varies by category; some categories, such as dynamic ranges, are changed only at the request of the ISP that owns the range.
5. UCEPROTECT. Level 1 entries expire automatically after a period with no new trap hits. Removal on request is available but not required; waiting it out is the normal approach.
6. PSBL. The listing page offers immediate self-removal. Entries also expire on their own.
7. s5h.net and DroneBL. Both describe their removal process on their sites. DroneBL expects the open proxy or compromised host to be fixed first and may re-test it before removing the entry.

For a home or mobile connection

A PBL, SORBS dynamic or similar policy listing on a consumer address does not need removal. Send mail through your ISP's or your email provider's server, which is what every mail client does by default, and the listing is irrelevant. If a hosting or anti-abuse listing points at your home address, something on your network is infected or misconfigured: check every device, including phones, smart TVs and cameras.

Checking progress

Re-run the check after the 1-hour cache expires. A list that marked you removed will show as not listed. Mail servers that cached the DNSBL answer may take a little longer to let your mail through, since DNSBL answers carry their own TTLs.

Why an address ends up on a blacklist

Most listings have one of a few causes. A mail server with a weak password on one mailbox gets used to send tens of thousands of messages overnight. A website with an outdated plugin gets a mailer script uploaded. A home computer is part of a botnet and sends directly on port 25. A newly rented server inherits the history of its previous tenant, which is why checking a cloud address right after provisioning, and before setting up mail, is worth the minute it takes.

For anyone evaluating a proxy or VPN address, a listing has a second meaning. Websites and anti-fraud systems consult some of the same lists, particularly XBL, DroneBL and similar lists of compromised hosts and open proxies. An address listed there is likely to see captchas, blocked sign-ups and locked accounts regardless of mail. The IP checker combines this blacklist result with the network type and other reputation signals into a single verdict for that use.

How mail servers use these lists

A receiving mail server checks the connecting address against its chosen lists before it accepts a single byte of the message. If the address is listed, the server refuses the connection with a permanent error, and the sending server turns that refusal into the bounce message you receive. The bounce usually names the list, in wording such as "client host blocked using zen.spamhaus.org", and often includes a link to the listing. Reading the bounce is the fastest way to find out which list is involved, and running this check confirms whether the listing is still active.

Because the check happens at connection time, one listing on a widely used list blocks mail to every receiver that uses it, regardless of the content of the messages or how legitimate the sender is. That is why the order of operations matters: fix, delist, then send. Sending while listed adds fresh evidence to the list's traps and extends the listing.

Receivers differ in how much weight they give each list. Many reject outright on the large lists and merely add a spam score for the smaller ones, so a listing on a smaller list may land your mail in the spam folder rather than bouncing it. If mail is being delivered but ignored, the smaller listings and the authentication records are the first things to check.

Blacklist check versus IP reputation

A DNSBL answers a yes-or-no question for one list, and the answer is public. Reputation is something else: the large mailbox providers keep private scores for every sending address and domain, built from complaint rates, engagement, authentication history and trap hits, and no public tool can read them. An address can be clean on every public list and still have a poor private reputation at one provider because recipients there kept marking its mail as spam.

This check covers the public half. For the private half, use the postmaster or sender tools that the large providers offer to domain owners, and watch complaint rates and bounce codes in your own sending logs. The two together, plus the basics of reverse DNS and authentication, are the complete picture.

Limits of this tool

• The 8 lists here are among the most consulted, but hundreds exist. A clean result does not mean the address is on no list anywhere. Large mail providers also run private reputation systems that no public tool can query.
• Spamhaus refuses queries relayed through public resolvers and limits free use. When the tool reports a refusal, confirm the status on the Spamhaus website; it is not a listing and not a clean result.
• Only IPv4 addresses are checked. IPv6 listings are not covered.
• Results are cached for 1 hour. Listings or removals newer than that are not reflected.
• The reason is decoded only for Spamhaus ZEN. For other lists the tool shows the raw return code and links to the list for details.
• Domain-based blocklists, which list sending domains and URLs found in messages rather than IPs, are a separate class and are not checked here.
• A listing is the list operator's judgment. The tool reports it; it cannot verify or dispute it.
• Blocklists change over time; some reduce their coverage or stop publishing listings altogether. A list that returns not listed for every address you try may be inactive rather than a sign that every address is clean.
• The check says nothing about whether the address can currently deliver mail to any specific provider, because each receiver applies its own mix of lists and internal reputation.