RevenueFlow
    Domain health

    Blacklist checker

    The short answer

    An email blacklist — a DNSBL, or DNS blocklist — is a DNS zone that publishes IP addresses observed sending spam, queried by reversing the address and appending the zone name. Blocklists list addresses rather than domains, so this checker first resolves your domain's A record and the addresses behind its MX hosts, then queries those against each list. Every lookup returns exactly one of three things: listed, with the code the zone returned; not listed, meaning the zone answered NXDOMAIN; or no answer, meaning the query timed out, was refused, or came back with a policy code. The third is reported as its own result and never as a clean one, because a lookup that did not complete is not evidence that an address is clean.

    Run the check

    No signup, no email, nothing stored. The check is a set of DNS queries made from our server and thrown away when the answer is rendered.

    Result

    Enter a domain to run the check. Results appear here.

    How the check works

    First the addresses. An A lookup on the domain gives the hosts behind the website, and an MX lookup gives the mail exchangers, each of which is then resolved to an address of its own. Those addresses are what gets checked, and it is worth looking at the list the tool shows you: for most domains the mail addresses belong to a mailbox provider and are shared with thousands of other customers, so a listing against one is a fact about that provider's range rather than a verdict on your sending. Private and reserved addresses are skipped, since no public list covers them.

    Then the lookups. A DNSBL is queried by reversing the octets of the address and appending the zone: 203.0.113.4 checked against a zone becomes 4.113.0.203.zone.example. If that name resolves, the address is listed and the returned 127.0.0.x address is a code describing the listing — different zones use different codes for different categories, and a TXT record at the same name usually carries a human-readable reason and a delisting URL, which is fetched here only for addresses that came back listed. If the name returns NXDOMAIN, the address is not listed. Nothing else counts as an answer.

    The part most checkers get wrong is what happens in between. Several public lists refuse queries that arrive from cloud and public resolvers, and they refuse them by answering with a code in 127.255.255.0/24 rather than by returning an error. Code that treats any returned address as a listing reports those refusals as a listing, which is false in one direction; code that treats every non-answer as NXDOMAIN reports them as clean, which is false in the other. Both are handled explicitly here, and every timeout, SERVFAIL and refusal is surfaced as “no answer”.

    There is one more failure mode, and it is the dangerous one: a zone that has shut down. A dead DNSBL answers NXDOMAIN to everything, which reads exactly like good news. So on every request each zone is also asked about 127.0.0.2: RFC 5782, which describes how these lists work, requires every DNSBL to keep that address permanently listed as a test entry and to keep 127.0.0.1 permanently unlisted. If a zone does not return a listing for that, it is not answering us — dead, blocking us, or rate-limiting — and its results for your addresses are discarded and reported as unavailable, whatever they said. That check is why the zones below are the ones queried: several better-known lists, including SORBS, fail it from a datacentre network and were removed rather than left in to produce reassuring nonsense.

    Zones queried
    SpamCop bl.spamcop.net
    Listings come from spam reports and spam traps, and expire automatically about 24 hours after the reports stop. Zone policy and delisting.
    PSBL psbl.surriel.com
    The Passive Spam Block List: sending IPs caught by its own trap network, with self-service removal. Zone policy and delisting.
    UCEPROTECT Level 1 dnsbl-1.uceprotect.net
    Single IPs seen sending to its traps. Level 1 listings expire after seven days without further activity. Zone policy and delisting.
    Barracuda b.barracudacentral.org
    The Barracuda Reputation Block List. It answers only resolvers registered with Barracuda, so this column reads "unavailable" wherever it declines to answer. Zone policy and delisting.

    Finally, the limit worth stating plainly: these are the public lists. Gmail, Outlook and the other large mailbox providers filter on internal reputation systems that publish nothing and answer to nobody. A domain can be clean on every list here and still be delivered to spam by them, and that is the ordinary case rather than an anomaly.

    A worked example

    ; checking 203.0.113.4 against bl.example-list.org
$ dig +short 4.113.0.203.bl.example-list.org A
127.0.0.4

$ dig +short 4.113.0.203.bl.example-list.org TXT
"Listed: spam trap hits — https://example-list.org/remove?ip=203.0.113.4"

    The octets of 203.0.113.4 are reversed to 4.113.0.203 and the zone name appended. The A query resolves, so the address is listed, and the returned 127.0.0.4 is a category code rather than a real address — this zone uses .4 for spam-trap hits, where another zone might use .4 for an open proxy, so the code only means something in the context of the zone that returned it. The TXT query at the same name gives the human-readable reason and the delisting URL. Had the address not been listed, both queries would have returned NXDOMAIN. Had the zone been refusing us, the A query would have answered something like 127.255.255.254 — a response that looks like a listing and is not one.

    Questions

    What is a DNS blocklist?
    A DNS zone that answers questions about IP addresses, described in RFC 5782. To ask whether 203.0.113.4 is listed on example-bl.org, a mail server queries 4.113.0.203.example-bl.org. If the name resolves, the address is listed, and the returned 127.0.0.x code says why. If it returns NXDOMAIN, it is not listed. Those are the only two answers a blocklist gives.
    Why does this ask for a domain when blocklists list IP addresses?
    Because a domain is what people have. The tool resolves the domain’s A record and the addresses behind its MX hosts, then checks those. It is worth knowing whose addresses those turn out to be: if you send through a mailbox provider or an ESP, the IPs are theirs and shared with every other customer, so a listing is a fact about their infrastructure rather than a verdict on your sending.
    What does "no answer" mean in the results?
    That the lookup did not complete, or completed with something that is not a listing decision — a timeout, a SERVFAIL, a refused query, or a rate-limit code. It is reported separately because it is genuinely different from "not listed", and collapsing the two would mean telling you an address is clean on evidence that was never collected.
    Why is Spamhaus not in the results?
    Spamhaus refuses queries that arrive from public and cloud resolvers, which is where a server-side tool’s queries come from. Asked from such a network it answers 127.255.255.254, a code that means "your query was refused" — and a checker that reads it as an address returned will report the IP as listed, which is simply false. Rather than fill a column with an answer that is always unavailable, we do not query it. To check Spamhaus properly, use their own lookup form.
    Does a clean result mean my email will reach the inbox?
    No, and this is the main limitation worth understanding. Public blocklists are used mostly by smaller receivers and appliances. Gmail, Outlook and the other large mailbox providers run internal reputation systems that publish nothing and cannot be queried by anyone. Most cold email that lands in spam does so on those internal signals, with every public list clean.
    How do I get delisted?
    Per zone, through that zone’s own process, and only after the cause is fixed. Most of these lists expire a listing automatically once the behaviour stops — SpamCop within about a day of the reports ending, UCEPROTECT Level 1 after seven quiet days. Requesting removal before fixing the underlying issue usually just produces a second listing. Some lists charge for expedited removal; that fee buys speed, not a fix.

    The rest of the set

    Read further

    For the economics rather than the DNS, our free calculators cover cost per meeting, cold email ROI and a spam word checker that runs in your browser.

    Records checked · Now the sending

    Authentication is the floor, not the plan.

    Getting off a blocklist fixes an effect. The cause is usually list quality, volume ramp or infrastructure — the things we design around before a single message goes out, on programmes we are paid for by the meeting.

    Book a strategy callRead the benchmark report