What is an email blacklist (DNSBL)?
Reviewed by Prabath Thalangama · Last updated
A DNSBL (DNS-based blacklist) is a list of IP addresses seen sending spam or other abuse, published through DNS so mail servers can check every incoming connection. This tool queries a sending IP against more than 80 public DNSBLs in parallel and shows each list the address appears on.
A listing on a widely used list can get your mail rejected outright or sent to spam. Listings on obscure or defunct lists usually have no effect, which is why the result names each list rather than just giving a count.
The major lists are included: Spamhaus (ZEN, SBL, XBL and PBL), Barracuda, SpamCop, SORBS, Mailspike and others. Spamhaus refuses lookups that arrive through large public resolvers; when it does, the result shows an error for that list rather than 'not listed', so confirm it at check.spamhaus.org. The check works for IPv4 addresses.
How do I check if my IP is blacklisted?
- Find the public IP of your outgoing mail server: it is in the Received headers of a message you sent, or run the SMTP test.
- Enter the IP address and run the check.
- For each list it appears on, open that list's lookup page to see the reason and the delisting process.
How to read the results
- Listed count
- How many of the queried lists returned a listing for the IP.
- Provider
- Each list queried and whether the IP is listed there. A list that returned an error or a non-DNSBL answer (common for defunct lists) is marked as such and never counted as a listing.
- Findings
- One finding per listing, or a note when the check was skipped (for example for an IPv6 address).
How to get removed from a blacklist
Find and fix the cause first
Lists re-add addresses that keep sending abuse. Look for a compromised mailbox or password, a website form or script sending mail, an open relay, or a purchased or stale mailing list. Check the mail log for unusual volume.
# Postfix: busiest senders today
grep "$(date '+%b %e')" /var/log/maillog | grep -o 'sasl_username=[^,]*' | sort | uniq -c | sort -rn | headRequest delisting
Use the removal form on the list's own website. Many lists expire entries automatically after the abuse stops; never pay a third party for removal.
Shared IP on a cloud or hosting provider
If the listing predates you or comes from a neighbour on a shared IP, ask your provider for a clean address or relay mail through a reputable email service.
Examples and command-line equivalents
How a DNSBL query works
Reverse the IP's octets and look them up under the list's zone. An answer in 127.0.0.0/8 means listed; no answer (NXDOMAIN) means not listed.
# Is 203.0.113.10 on the example list bl.example.org?
dig +short 10.113.0.203.bl.example.org AFrequently asked questions
Should I check my domain or my IP?
Most DNSBLs list sending IP addresses, so check the public IP of your outgoing mail server. Domain-based lists (URIBLs) list domains that appear in spam message bodies, which is a separate check.
Why is my IP listed when I don't send spam?
Dynamic and residential ranges are listed by policy on some lists, cloud IPs inherit history from previous tenants, and a compromised account can send spam without you noticing. The list's lookup page usually says which reason applies.
Does every listing matter?
No. Big mailbox providers rely on a handful of well-run lists and their own reputation data. A listing on a small or defunct list rarely affects delivery, but a listing on a major list needs action the same day.
Further reading
- Postfix postscreen and Pre-Queue Spam Defense
- Postfix as a Null Client: Send-Only Mail Done Right
- RFC 5782: DNS blacklists and whitelists
- Spamhaus IP and domain reputation checker
- Run a full Super Scan to check DNS, email, website and TLS for a domain at once.