Blacklist / DNSBL Checker

How DNS-based blocklists work

DNS-based Blockhole Lists (DNSBLs), also called Real-time Blackhole Lists (RBLs), are a cornerstone of email anti-spam infrastructure. They work by leveraging the DNS protocol itself — an ingenious design that allows mail servers to perform IP reputation checks with minimal overhead. Each DNSBL maintains a list of IP addresses known to send spam, host malware, or exhibit other malicious behaviour. The list is published as a special DNS zone, and mail servers query it by constructing a lookup for the IP address reversed and appended to the blacklist's domain.

When a mail server receives an inbound SMTP connection, it typically performs a DNSBL check on the connecting IP. For example, to check 1.2.3.4 against Spamhaus ZEN, the mail server constructs the query "4.3.2.1.zen.spamhaus.org". If the DNS query returns an IP address (usually 127.0.0.2 or similar), the IP is listed. If the query returns NXDOMAIN (domain not found), the IP is not listed. The returned IP address — the return code — often indicates the specific reason for the listing, such as compromised machine (127.0.0.4) or IP range not authorised for direct mail (127.0.0.7).

This tool checks three of the most widely used DNSBLs. Spamhaus ZEN is the most comprehensive, combining data from the Spamhaus Block List (SBL), Exploits Block List (XBL), and Policy Block List (PBL). Spamcop relies on user-reported spam data and is maintained by Cisco's Talos threat intelligence team. Barracuda BRBL is maintained by Barracuda Networks based on data from their global network of email security appliances. Together, these three lists provide broad coverage for IP reputation checking.

Understanding return codes

When a DNSBL lookup returns a positive result (the IP is listed), the return code is typically an IP address in the 127.0.0.0/8 loopback range. Different codes indicate different listing reasons. For Spamhaus ZEN, 127.0.0.2 indicates the IP is in the SBL (Spamhaus Block List) for sending spam, 127.0.0.4 through 127.0.0.7 indicate the XBL (Exploits Block List) for compromised machines, 127.0.0.8 through 127.0.0.10 indicate the PBL (Policy Block List) for end-user IP ranges not authorised to send mail directly. Return codes help administrators understand why their IP was listed so they can take the appropriate corrective action.

For Spamcop, the return code is usually 127.0.0.2 for all listings, as Spamcop does not differentiate between listing reasons in its response. Barracuda BRBL similarly returns a standard code. The key takeaway is that any response from a DNSBL indicates the IP has a reputation issue that requires investigation. Even a single listing can significantly impact email deliverability, as many mail servers will reject mail from an IP listed on any major DNSBL.

Understanding what a DNSBL listing means in practice is important. Spamhaus PBL listings, for example, do not necessarily mean the IP has sent spam — they indicate that the IP is in an end-user range that should relay mail through the ISP's mail servers rather than sending directly. Many residential and dynamic IPs are listed on the PBL by design. This is why checking the specific return code helps determine whether the listing indicates malicious activity or a policy that can be addressed by routing mail through a properly configured SMTP relay.

How to check and improve IP reputation

Regular IP reputation monitoring is essential for anyone running a mail server. Use this checker periodically to ensure your sending IPs remain clean. If you find your IP is listed, first determine the cause. Check for compromised accounts, open relays, or malware on your server. Review outgoing mail logs for unusual patterns that might indicate a security breach. Ensure your server is properly configured with SPF, DKIM, and DMARC records, as many receiving servers perform these checks alongside DNSBL lookups as part of their overall email authentication evaluation.

After addressing the root cause, submit a delisting request to each blacklist that has listed you. Most DNSBL operators review delisting requests within 24-48 hours. Prevent future listings by securing your mail server: use strong passwords, keep software updated, implement rate limiting, monitor for unusual outbound traffic patterns, and consider using a reputable SMTP relay service for transactional email rather than sending directly from your server's IP.

Limitations and considerations

This tool checks three major DNSBLs, but there are hundreds of other blacklists used by various mail servers around the world. A clean result on these three does not guarantee your IP is not listed elsewhere. Additionally, some blacklists use dynamic scoring systems rather than binary listed/not-listed states, and individual mail servers may have customised thresholds for DNSBL responses. The tool provides a useful baseline check for the most widely used blacklists and should be part of a broader email deliverability monitoring strategy.

Frequently asked questions