How to use it
- Enter the public IP, domain or email address to check. For an email address only the domain after the @ is used.
- For a domain, the tool finds its MX mail servers, single IPv4 addresses written in SPF and the website IP, checks each one, and checks the domain itself against domain blacklists.
- Read the table: red means listed, yellow means a broad list or something to watch, grey means a list you check by hand on its website. Open a list’s name for official details and use Request removal to follow that list’s process.
How to fix a blacklisting
- Find the source: look for compromised mailboxes and weak passwords, malware-infected computers, abused website forms or scripts, and an open mail relay.
- Complete authentication: the sending IP needs a PTR that matches its hostname both ways, and the domain needs correct SPF, DKIM and DMARC; the email health check covers them in one pass.
- Request removal only after the fix: use each list’s Request removal link in the results; some lists expire on their own, and repeat listings take longer.
- For an IP that belongs to a shared host, cloud server or email provider, send the results to the provider; if needed, send through the provider’s authenticated SMTP.
Blacklists we check
Automatically checked lists are queried by this site’s server directly at each list’s official DNS servers; lists that require authorization or registration, or are limited to non-commercial use, are only linked.
| List | Type | How it is checked | Note |
|---|---|---|---|
| Spamhaus ZEN | IP list | Check by hand on its website | Combines the SBL, XBL and PBL lists; one of the IP lists receiving mail servers use most. |
| SpamCop | IP list | Checked automatically | Lists sources reported by users and spam traps; an IP is removed automatically 24 hours after the last report. |
| UCEPROTECT Level 1 | IP list | Checked automatically | Lists single IPs that sent mail to its spam traps; entries expire automatically. |
| UCEPROTECT Level 2 | IP list | Checked automatically | Lists whole ranges when several IPs in them are listed, so your IP may only be affected by its neighbours. |
| UCEPROTECT Level 3 | IP list | Checked automatically | Lists a provider’s whole network (ASN); it reflects the provider as a whole, not necessarily your IP. |
| Backscatterer | IP list | Checked automatically | Lists servers that bounce mail to forged senders (backscatter) or run sender callouts. |
| PSBL | IP list | Checked automatically | A passive spam-trap list; anyone can remove an IP on its website, effective immediately. |
| DroneBL | IP list | Checked automatically | Records compromised hosts, open proxies and botnet nodes; the return code gives the type. |
| Mailspike | IP list | Checked automatically | Rates IPs by sending behaviour; 127.0.0.2 means listed and 127.0.0.10–14 mean poor reputation levels. |
| S5H | IP list | Checked automatically | A small, independently run list of spam sources. |
| blocklist.de | IP list | Checked automatically | Lists IPs that attacked mail, SSH or other services in the last 48 hours. |
| SpamEatingMonkey | IP list | Checked automatically | An IP list fed by spam traps. |
| SpamEatingMonkey Backscatter | IP list | Checked automatically | Lists servers that send backscatter bounces. |
| GBUdb Truncate | IP list | Checked automatically | Spam-source IPs selected from sending-reputation statistics. |
| ZapBL | IP list | Checked automatically | A list kept by its administrators from the spam they receive. |
| 0spam | IP list | Checked automatically | Free for every use, and removal is free too. |
| InterServer RBL | IP list | Checked automatically | A spam and attack source list run by the hosting provider InterServer. |
| Suomispam | IP list | Checked automatically | Covers spam sources in Finnish or related to Finland. |
| SPFBL | IP list | Checked automatically | The reputation list of the Brazilian SPFBL project; you can request removal on its website. |
| Anonmails | IP list | Checked automatically | A spam-trap list run by anonmails.de in Germany. |
| SWINOG | IP list | Checked automatically | A spam-trap list run by ImproWare in Switzerland. |
| Fabel Spamsources | IP list | Checked automatically | A spam-source list run by Fabel in Denmark; you can request removal yourself on its website. |
| Barracuda BRBL | IP list | Check by hand on its website | Barracuda’s reputation list, used by many corporate mail gateways. |
| SpamRATS | IP list | Check by hand on its website | Lists IPs with no reverse DNS, dynamic addresses and spam sources. |
| Abusix Mail Intelligence | IP list | Check by hand on its website | A commercial mail threat intelligence list. |
| Invaluement | IP list | Check by hand on its website | A subscription sender-reputation list. |
| Spamhaus DBL | Domain list | Check by hand on its website | Spamhaus’s domain list of domains found in spam, phishing and malware. |
| SPFBL | Domain list | Checked automatically | The SPFBL project’s domain reputation list. |
| Suomispam DBL | Domain list | Checked automatically | Suomispam’s domain list. |
| NordSpam DBL | Domain list | Checked automatically | NordSpam’s list of domains seen in Nordic spam. |
| SpamEatingMonkey URIBL | Domain list | Checked automatically | Lists domains that appear in links inside spam. |
| SWINOG URIBL | Domain list | Checked automatically | A domain list ImproWare builds from spam traps. |
| SURBL | Domain list | Check by hand on its website | Lists domains found in the body of spam and phishing mail. |
| URIBL | Domain list | Check by hand on its website | Lists domains found in links in spam. |
Frequently asked questions
Is the blacklist check free? Are there limits?
Yes, and no sign-up is needed. To respect each list’s terms of use, each network can run up to 3 checks a minute and 30 a day, and repeat checks of the same IP or domain within 30 minutes return the cached result.
Which blacklists are checked, and why must Spamhaus and Barracuda be checked by hand?
More than 20 IP lists that allow free queries are checked automatically, including SpamCop, UCEPROTECT levels 1–3, PSBL, DroneBL, Mailspike and blocklist.de, plus several domain lists; the full list is below. Free public queries to Spamhaus are for non-commercial use only, Barracuda requires the querying server to be registered, and SpamRATS, Abusix and others need a key or subscription, so this site does not query them automatically and links to their official lookups instead.
What should I do if a result says Listed?
Find the cause before asking for removal: look for compromised mailboxes, malware-infected computers, an open relay or an abused website form, and make sure PTR, SPF, DKIM and DMARC are correct. Once fixed, follow each list’s process: SpamCop and UCEPROTECT level 1 expire automatically, while PSBL, blocklist.de, SPFBL and others offer self-service removal on their websites. For an IP owned by a shared host or email provider, contact the provider.
If nothing is listed, will my mail reach the inbox?
Not necessarily. Public blacklists are only one reputation signal; Gmail, Outlook and other receivers have their own reputation systems, complaint rates and filters that cannot be queried over DNS. Also check SPF, DKIM, DMARC and PTR, and look at delivery data in official tools such as Gmail Postmaster Tools.
Why is my IP on UCEPROTECT level 2 or 3?
Level 2 lists ranges and level 3 lists a provider’s whole network (ASN), usually because other customers in the same range or provider sent spam, so it may not be your fault. If level 1 and the other lists do not include your IP, contact your provider first. The tool shows these two levels as yellow warnings, not as serious hits.
What does the return code 127.0.0.2 mean?
DNS blacklists answer “listed” with an address in 127.x.x.x, and no record (NXDOMAIN) means not listed. 127.0.0.2 is the most common “listed” code; some lists use different codes for different reasons, and the tool shows each list’s meaning. Codes such as 127.255.255.x are query errors, not listings, and are shown as Unknown.
Why does a domain check several IPs? Is the MX IP my sending IP?
MX servers receive mail. A self-hosted mail server often sends from the same IP, but with a hosted email service the sending IP is usually different. The tool checks the MX IPs, single IPv4 addresses written in SPF and the website IP, and labels where each came from. The real sending IP is in the Received headers of a sent message or in your provider’s documentation; you can enter that IP directly.
Can I check an IPv6 address?
You can enter one, but most public blacklists only cover IPv4. Every hour the tool tests each list with the RFC 5782 test addresses, queries only the lists that support IPv6, and shows the rest as “No IPv6 support” rather than as not listed.
Do the queries go through public DNS? How accurate are the results?
No. Many lists refuse or answer wrongly when queried through public DNS, so this site’s server asks each list’s official DNS servers directly and tests every list hourly with test addresses; a list that has stopped working or answers “listed” for every address is turned off automatically. Results are cached for up to 30 minutes, so a list that has just changed may take a moment to show it.
Why are SORBS and NiX Spam not included?
Both have shut down (NiX Spam has announced it on its website, and the SORBS query domain no longer resolves). If a bounce still cites them, the receiving server’s configuration is usually out of date; forward the bounce to that server’s administrator.