IP Blacklist Checker - DNSBL & Reputation Report

What is a DNS blocklist (DNSBL/RBL)?

A DNS blocklist - also called a DNSBL or RBL (Real-time Blackhole List) - is a published list of IP addresses (and sometimes domains) with a history of sending spam, hosting malware, or other abuse. Mail servers and security systems query these lists in real time over DNS before accepting a connection. If your sending IP is listed, your email is often rejected or sent to spam, which is why checking and clearing listings is essential for email deliverability.

Why would an IP get blacklisted?

• A compromised account or website sending spam without the owner’s knowledge.
• An open relay or open proxy that lets anyone send mail through your server.
• Malware or a bot on a device behind the IP.
• Hitting a spam trap - sending to an address harvested or used only to catch spammers.
• A “bad neighbour” - on shared hosting or a cloud range, another customer’s abuse can get the shared IP listed.
• Policy listings (e.g. Spamhaus PBL) that simply mark IPs that should not send mail directly, such as residential/dynamic ranges.

What do the four result states mean?

• Listed - the IP returned a listing on that blocklist; we decode the specific return code to show why (e.g. botnet/exploit vs. policy vs. spam source).
• Clean - the list answered and the IP is not on it. We verify each list is actually responding (with a positive control) before trusting a “clean” result.
• Blocked - the list is running, but it refused this query. Spamhaus in particular rejects lookups that arrive through a large public DNS resolver and answers with a refusal code instead of a verdict. That is about our server’s DNS path, not about your IP.
• Not checked - the list did not answer at all, or does not publish an IPv6 zone.

Blocked and not-checked results are excluded from the grade, so an unreachable list never fakes a verdict in either direction. We would rather tell you a list is missing than quietly count it as clean.

What to do if your IP is listed

Work in this order. Delisting an address that is still sending spam gets you re-listed within days, often with a longer hold the second time.

1. Find out what is sending the mail. Read your mail server’s outbound logs and look at the queue. A sudden pile of undeliverable bounces to addresses you have never written to means something on your side is sending without you.
2. Check for an open relay. A mail server that accepts mail from anyone and forwards it anywhere will be found and used within hours. Require authentication for every outbound message, and test the server from outside your own network.
3. Look for a compromised account or site. The usual causes are a stolen mailbox password, an out-of-date plugin on a website you host, and a contact form that will mail arbitrary addresses. Reset the passwords, patch the software, and scan for malware.
4. Rate-limit outbound mail so the next compromise cannot send thousands of messages before you notice.
5. Then request removal using each list’s own link in the table above. SpamCop, PSBL and UCEPROTECT Level 1 drop listings on their own once the abuse stops, so those often need nothing from you. Spamhaus and Barracuda want a request after the cause is fixed.

Be careful with paid delisting. Several lists offer an “express” or “immediate” removal for a fee while the free route takes a week. Paying removes the entry; it does nothing about the cause, and nothing stops the same address being listed again the following day. No reputable list charges for ordinary removal, so treat a demand for payment as a reason to check how much that list is actually used before you spend anything. Fix the sending problem and the free route works.

Anyone who contacts you offering to clear your name from “all major blacklists” for a payment is selling something you can do yourself from the links in the table above.

I’m on a shared or cloud IP - what now?

If the IP belongs to shared hosting or a VPS/cloud range, you may be listed because of another customer. Ask your provider to address the abuse, or request a dedicated IP and warm it up. Always pair a clean IP with valid reverse DNS (PTR) and SPF, DKIM, and DMARC for the best deliverability.

Blocklists no longer operating (not checked)

Plenty of checkers still query blocklists that shut down years ago. A dead zone answers “not listed” to everything, which pads the number of lists on the page and tells you nothing. We tested every zone before including it, and left these out. Each one was queried from our own servers on the dates below and either gave no answer at all or gave an answer that cannot be trusted.

• SORBS (dnsbl.sorbs.net) - ran from 2002 and was closed by its owner in June 2024. The zone no longer returns listings. If a tool still reports a SORBS result, it is reading an empty zone.
• AHBL (dnsbl.ahbl.org) - retired in 2015, and this one is actively dangerous. Rather than switch the zone off, its operators made it answer “listed” to every query, to force the remaining users to stop. We confirmed this: it currently reports both 8.8.8.8 and 1.1.1.1 as listed. Any checker still including AHBL will tell you that you are blacklisted no matter what your address is.
• NJABL (dnsbl.njabl.org) - shut down in 2013 and does not respond.
• DSBL (list.dsbl.org) - the Distributed Sender Blackhole List ended in 2008 and does not respond.
• ORDB (relays.ordb.org) - the Open Relay Database closed in 2006.
• RFC-Ignorant (rfc-ignorant.org) - closed in 2012.
• SpamCannibal (bl.spamcannibal.org) - abandoned, and in 2018 its domain lapsed and briefly resolved to an address that made every lookup return a listing.
• Lashback UBL (ubl.unsubscore.com), MegaRBL, Tornevall, MSRBL, Leadmon SpamGuard and EFnet RBL - all failed to return their own documented test entry when we checked, so a “clean” from any of them would be meaningless.

One retirement worth knowing about: the CBL (cbl.abuseat.org) was folded into Spamhaus in 2021. It still answers, but it is the same data as the Spamhaus XBL zone we already check, so counting it separately would report one problem twice.

Related tools

• IP Reputation Aggregator - threat-intel reputation beyond DNSBLs.
• Email Health Check - SPF/DKIM/DMARC + blacklist in one report.
• Domain Health Report - full DNS + email + SSL + reputation scorecard.
• Reverse DNS Lookup - check an IP’s PTR record.
• IP Lookup - geolocation, ISP, and ASN for any IP.