Blacklist Checker

A blacklist checker (also called a DNSBL checker or RBL lookup tool) queries DNS-based blackhole lists to determine whether an IP address or domain is flagged as a spam source, malware distributor, or otherwise malicious. These lists are used by mail servers worldwide to filter incoming email in real time.

When someone sends you an email, your mail server checks the sender's IP against one or more DNSBLs before accepting the message. If the IP is listed, the email may be rejected outright, tagged as spam, or silently discarded. This tool lets you see exactly what those mail servers see when they check your IP or domain.

This checker queries 60+ blacklists in parallel, including all major lists used by enterprise mail servers: Spamhaus (ZEN, SBL, XBL, PBL, DBL), Barracuda, SpamCop, the entire SORBS family, UCEPROTECT Levels 1-3, SURBL, URIBL, and dozens more. For each listing found, it provides the return code, human-readable reason, and a direct link to request delisting.

DNSBL lookups use the DNS infrastructure itself as the query mechanism — no special protocols or APIs are needed. The process differs slightly for IP-based and domain-based lists:

The return codes in the 127.0.0.x range encode the reason for listing. Each blacklist defines its own return code scheme. For example, Spamhaus ZEN uses 127.0.0.2 for SBL (spam sources), 127.0.0.4 for XBL (exploited hosts), and 127.0.0.10-11 for PBL (dynamic/residential IPs). This tool decodes all known return codes automatically.

• •Compromised Server — A hacked web server, CMS, or email account sending spam without your knowledge. Check server logs for unusual outbound SMTP connections.
• •Open Relay — A misconfigured SMTP server that allows anyone to send email through it. Spammers actively scan for open relays and exploit them within hours.
• •Dynamic/Residential IP — Spamhaus PBL and similar lists flag IP ranges assigned to residential broadband. If you run a mail server on a home connection, you will be on PBL. Use your ISP's SMTP relay or a transactional email service instead.
• •Inherited IP Reputation — Cloud IPs (AWS, GCP, Azure) are frequently recycled. A new EC2 instance may inherit an IP that was previously used for spam. Check your IP immediately after provisioning.
• •Bulk Email Without Authentication — Sending marketing emails without SPF, DKIM, and DMARC configured properly. Use the DNS Inspector to verify your email authentication records.

If your IP or domain is listed on a blacklist, follow these steps to resolve the issue and prevent re-listing:

1. Identify the root cause. Check server logs for unauthorized outbound SMTP traffic. Scan for malware, compromised CMS plugins, or misconfigured mail settings.
2. Fix the underlying issue. Patch vulnerabilities, change compromised passwords, close open relays, update software. Do not request delisting until the problem is resolved.
3. Request delisting. Use the delist links provided in the results above. Each blacklist has its own process — some are instant, others take 24-48 hours.
4. Configure email authentication. Set up SPF, DKIM, and DMARC records. These prove to receiving servers that your email is legitimate and prevent domain spoofing.
5. Monitor regularly. Re-check your IPs weekly. Set up monitoring to catch new listings early before they impact deliverability.

Use the DNS Inspector to verify SPF, DKIM, and DMARC records, and the IP Location tool to check the reputation and geolocation of your mail server IP.

Both types are important. An attacker can use a clean IP with a blacklisted domain, or a clean domain from a blacklisted IP. Comprehensive checking requires both. When you enter a domain into this tool, it checks domain-based lists directly and also resolves the domain to its IP address to check IP-based lists.