IP and domain blacklist check
See whether an IP address or domain is on a DNS blocklist, why, and where to request removal. A lookup that fails is shown as unknown, never as clean.
By using these tools you accept the Terms and the Privacy page.
How the blacklist check gets its answers
The blacklist check asks DNS blocklists (DNSBLs) whether an IP address or domain is listed, and shows what each list says about it. It is for anyone who runs a mail server, sends bulk mail or wants to know why messages are being rejected.
How the public lists are queried
- Each list is asked through Cloudflare’s DNS-over-HTTPS resolver first. If Cloudflare hasn’t settled it within two seconds, Google’s resolver is asked too, and the first usable answer wins. Each request times out after eight seconds.
- An empty answer counts as not listed only when the same resolver also returns the list’s RFC 5782 test entry. A resolver can answer NXDOMAIN for every name in a list, test entry included, and that must not read as clean.
- A listing is checked against the entry the list should never list (
127.0.0.1, orinvalidfor domain lists). A list that lists it too is answering yes to everything, and its result is discarded. - For a listing or a note, the list’s TXT record for the entry is shown too, where the list publishes one.
- SPFBL is asked through Google first: measured in October 2026, its answers took about 150 ms there and about 850 ms through Cloudflare.
- A whole check has a 15-second limit in your browser. A list without an answer by then is shown as couldn’t check, and the loading line counts the seconds after three.
Spamhaus and Abusix
This site’s server asks both and stops waiting after 12 seconds; a late answer is couldn’t check and isn’t cached. An empty Abusix answer counts as not listed only when Abusix’s own test entry answers through the same key, and a 127.255.255.x answer means the query was refused, never listed. Spamhaus intelligence fills in when it arrives, so it never holds back the blocklist results.
What the answer codes mean
Lists answer with an address in 127.0.0.0/8, and the code says why. On Spamhaus ZEN, for example, 127.0.0.2 is the SBL and 127.0.0.10 is a PBL entry set by the ISP. Known codes are translated into words. An unknown code still counts as listed, as RFC 5782 says, except on a few lists whose other codes mean something else. An answer outside 127.0.0.0/8 is treated as an error, since the list’s DNS may be misconfigured or parked, and a list that returns allow-list and block-list codes at once is shown as a note.
Domains and their addresses
A domain is looked up exactly as you enter it, and domain lists usually list the registered domain, so check that too for a subdomain. Up to five mail servers, in MX priority order, and the website’s addresses are resolved, and the first 10 addresses, IPv4 first, go through the IP lists. Loopback, link-local, documentation and other non-public addresses are skipped.
What to check next
An Abusix policy note points at the address’s reverse DNS: the reverse DNS check shows its PTR record and whether it resolves back to the same address. The ASN lookup shows which network an address belongs to and where to report abuse.
Updated · Maintained by Liviu Tanase
Questions
What does the blacklist check look at?
For an IPv4 address: 27 IP blocklists, including Spamhaus ZEN, Abusix, SpamCop, Barracuda, Mailspike, PSBL, UCEPROTECT Level 1 and DroneBL. An IPv6 address is checked on the 14 lists that cover IPv6, one of them IPv6-only, so 28 IP lists in all. For a domain: 10 domain blocklists including Spamhaus DBL and ZRD (brand-new domains), Abusix and Rspamd, plus every address in its MX and A/AAAA records checked as IPs, so you see the reputation of the servers that actually send and receive its mail.
What do the results mean?
Listed means the list has an entry for the address. Not listed means the list answered and has no entry. Couldn’t check means the lookup failed, timed out or was refused, and it is never counted as clean. A note (such as a Tor exit relay or a backscatter source) is worth knowing but isn’t a block. Allow-listed (DNSWL.org, Spamhaus SWL and DWL, Mailspike, ISIPP, SPFBL) means a list vouches for the sender; allow-lists are shown on their own and never count as listings.
How are Spamhaus and Abusix checked?
Both need a private key, and Spamhaus refuses lookups through public DNS resolvers such as Cloudflare and Google, which is all a browser can use. So this site’s server asks them: Spamhaus over HTTPS (ZEN for addresses, DBL and ZRD for domains) and Abusix through its keyed DNS zones (combined for addresses, dblack for domains). Abusix policy entries (generic or missing reverse DNS) and newly seen domains are shown as notes, not listings, as Abusix asks. For a single address or domain it also reads the Spamhaus Intelligence API: an address’s XBL, CSS and BCL listing history for the past 12 months, or a domain’s reputation score. Only the address or domain is sent to Spamhaus.
Why is my IP blacklisted when I don’t send spam?
Often the address isn’t only yours: an end-user range that Spamhaus PBL lists by design, a shared server whose other users send spam, or an address someone listed before you got it. Otherwise something on your network sends mail without you knowing, such as a hacked mailbox, an infected device or an open relay. The Details column gives each list’s reason. An Abusix or SPFBL note about generic or missing reverse DNS points at the PTR record: see it with the reverse DNS check, and who runs the network with the ASN lookup.
How do I get my IP or domain off a blacklist?
Fix the cause first: a compromised account or password, an open relay or proxy, malware on the server, or mail to old or bought lists that hits spam traps. Then use the list’s delisting page linked next to the result. SpamCop and several others expire entries on their own once the spam stops. Re-check after a few hours.
Which lists were left out, and why?
SORBS shut down in 2024, and SpamRats, NiX Spam, URIBL and SURBL refuse lookups through public resolvers. UCEPROTECT Levels 2 and 3 list whole networks for the actions of neighbours, so they cause false alarms. Every list that is used was checked to answer its RFC 5782 test entries.
Can I check several IP addresses at once?
Yes: open Several IPs and paste up to 20 addresses, one per line or separated by commas. Each is checked on the IP lists, with a summary row per address; private and reserved addresses are skipped and named. To check a whole mail setup, enter the domain instead: its MX and web addresses are found and checked for you, and the email deliverability score checks its SPF, DKIM and DMARC.
Is anything sent to zerobounce.ai?
Only what Spamhaus and Abusix need: the address or domain you check (and a domain’s mail and web addresses) goes to this site’s server, which asks them. Every other list is looked up straight from your browser through Cloudflare’s and Google’s DNS-over-HTTPS resolvers. Check my IP reads the address your connection comes from. The resolvers see your IP address, as with any DNS lookup. Requests to this site appear in the request logs described on the privacy page. Spamhaus and Abusix answers are cached to save lookups: blocklist answers for up to an hour, Spamhaus intelligence for 24 hours.