Blacklist Check
IP address or domain
An IP is checked against address blocklists. A domain is checked against domain blocklists, then its own addresses.
Checked
-
Domain Blocklists
SURBL, DBL and RHSBL zones, which list domains rather than addresses.
Address Blocklists
RBL zones, checked against the address itself.
Notes
How to read these results.
Nothing checked yet
Enter an IP address or domain to see which blocklists report it.
How a DNS blocklist lookup works
Blocklists publish over DNS. To check 192.0.2.10 against zen.spamhaus.org the resolver reverses the address to 10.2.0.192 and queries 10.2.0.192.zen.spamhaus.org. A record coming back means listed. No record means not listed.
The answer is not the address that was checked. It is a code the provider assigns to say why the entry exists. Reading it as an IP address is the single most common misreading of blocklist results.
Domain blocklists work on the name instead, so example.com.dbl.spamhaus.org answers for a domain that appears in spam URLs rather than for the server that sends mail.
What the return codes mean
Spamhaus returns 127.0.0.2 to 127.0.0.11, and each value is a category. The important distinction is that not every listing is about spam.
| Provider and code | Meaning |
|---|---|
Spamhaus ZEN, 127.0.0.2 | Listed for sending spam, usually through a compromised account or an open relay. |
Spamhaus ZEN, 127.0.0.3 | Snowshoe or low-volume spamming from a wide IP range. |
Spamhaus ZEN, 127.0.0.10 | Compromised machine or open proxy. |
Spamhaus ZEN, 127.0.0.11 | A worm or trojan emitting from the host. |
Spamhaus, 127.255.255.254 | Query refused, not a listing. The provider blocks this network or the query limit was exceeded. |
SPFBL, 127.0.0.2 | Blacklisted for bad reputation confirmed by complaints. |
SPFBL, 127.0.0.3 | Flagged: sender does not comply with RFC 5321. |
SPFBL, 127.0.0.4 | Flagged: no mail service runs at this address, it is a NAT router or a residential line. Normal for web hosts and CDNs. |
SPFBL, 127.0.0.5 | Flagged: the address sits in a range whose abuse desk does not respond. |
SPFBL is not Spamhaus and its codes carry different meanings. A 127.0.0.4 from SPFBL against a Cloudflare or hosting address is expected and does not mean the IP sends spam. This tool marks those results as flagged rather than listed for that reason.
Why a listing may not be your fault
Shared hosting puts hundreds of sites on one address. One compromised account in the same block can list the address for everyone, including you. CDN and proxy addresses are shared by design, so an address behind Cloudflare will accumulate reports from unrelated traffic.
Before you act, confirm the address is really yours and check whether the reverse DNS name matches your domain. If the listed address belongs to your provider, open a ticket with the report rather than delisting requests, because the provider controls the reverse name and the abuse process.
Getting delisted
Each provider publishes its own removal procedure and none of them accept a request before you have fixed the cause. Work in this order:
- Find and close the source. A compromised mailbox or a form that relays mail without authentication is the usual culprit.
- Confirm SPF, DKIM and DMARC pass so receivers can authenticate you on the next attempt.
- Check forward and reverse DNS agree, since many lists weight that heavily.
- Submit the delisting form once per provider, then wait. Most take hours to two days.
Resubmitting repeatedly slows the process. Blocklists record request volume and a persistent requester is treated as a persistent spammer.
Frequently asked questions
What does 127.0.0.4 mean on a blacklist result?
From SPFBL it means no mail service was found at that address, or it is a NAT or residential connection. It is a policy flag, not a spam listing, and it is normal for web hosting and CDN addresses. From Spamhaus it means a different category entirely, so read the provider name with the code.
Is being listed on one blocklist serious?
A listing on a major list such as Spamhaus ZEN affects delivery at Gmail and Outlook within hours. A minor list that most receivers ignore has little practical impact.
Why is the result unavailable instead of clean?
The provider refused the query from this network or did not reply. That is not evidence of a clean result, so the tool reports it separately rather than counting it as a pass.
Can I check a whole IP range?
Run the check per address. Each query needs its own reversal, so a range is a series of lookups rather than one.
Do blocklists affect website visitors?
Only if the list is also used to filter web traffic. Most of the major lists exist for mail, so a listing mainly blocks your outbound email.
How long does delisting take?
Hours for automated lists after you fix the cause, one to two days for providers that review by hand. Spamhaus can take longer for repeat entries.