Enter an IPv4 address to check
Real DNSBL lookups via Cloudflare DoH (Google DoH fallback). Nothing stored or logged.
What this tool does
Free IP blacklist checker -- check IP address against 25 DNSBL spam and abuse blacklists
This free IP blacklist checker queries any IPv4 address against 25 major DNS-based Blackhole Lists (DNSBLs) simultaneously using real DNS protocol lookups -- the same mechanism that mail servers use in production to filter incoming connections. The tool covers the most important blacklists for email deliverability including Spamhaus ZEN (the most widely-deployed DNSBL globally), SpamCop, Barracuda BRBL, SORBS, UCEPROTECT at all three levels, DroneBL, Abuse.ch, and more. Results include the listing type (spam, exploit, or reputation), the raw return code where available, and an overall reputation verdict.
Each DNSBL lookup works by reversing the IP address octets and appending them to the blacklist zone name, then performing a DNS A record query via Cloudflare DNS over HTTPS (with Google DoH as fallback). An A record response means the IP is listed; an NXDOMAIN response means it is not. The return code in the A record response (typically in the 127.0.0.x range) encodes the reason for listing. For Spamhaus, 127.0.0.2 indicates a direct spam source, 127.0.0.4 indicates an exploited or infected host, and 127.0.0.10 or 127.0.0.11 indicates a policy block for dynamic or residential IPs. Lookups are batched in parallel groups of 5 with a live progress indicator.
Email deliverability is directly tied to IP reputation. Even a single listing on a major blacklist like Spamhaus can cause hard rejections at a large proportion of corporate mail servers and stricter filtering at consumer mailbox providers. Regular IP reputation monitoring is essential for any business sending transactional or marketing email, and for IT administrators maintaining shared hosting environments, corporate mail servers, or outbound SMTP relays. Use this tool before launching a new sending IP, after a security incident, or any time you experience unexpected delivery failures.
What the blacklist categories mean
Spamhaus ZEN
The most widely deployed DNSBL. Combines SBL (spam sources), XBL (exploits/botnets), and PBL (policy/dynamic IPs) in a single zone.
SpamCop BL
Compiled from spam reports submitted by users and traps. Volatile -- listings typically expire within 24-48 hours of no new reports.
Barracuda BRBL
Barracuda Networks' IP reputation list, queried by enterprise mail gateways. Based on sending reputation and abuse reports.
SORBS
System for filtering Out RFC-ignorant Mail Systems. Covers spam sources, dynamic IPs, open proxies, and web form abuse separately.
UCEPROTECT
Three-level list: Level 1 for individual IPs, Level 2 for netblocks with multiple bad IPs, Level 3 for entire ASNs with poor reputations.
DroneBL
Focuses on compromised systems, open proxies, and botnet-infected machines. Relevant for servers sending directly rather than through a relay.
Spam/Exploit types
Spam listings mean the IP sent unsolicited email. Exploit listings mean the IP is running a vulnerable service or is part of a botnet -- requires remediation.
Return Codes
A record responses (127.0.0.x) encode the listing reason. Different codes from the same DNSBL indicate different severities and causes.
Reputation lists
Barracuda BRBL and SPFBL use composite reputation scoring rather than event-based listing. Removal requires submitting a reputation review request.
Backscatterer
Lists IPs sending bounce messages to forged senders -- a sign of poorly configured mail servers accepting mail for non-existent recipients.
Examples
IP blacklist result examples -- what different outcomes mean and how to act
These examples illustrate the four possible result states and what each means for your email deliverability and server reputation.
PassClean IP -- not listed anywhere
IP: 198.51.100.42
Listed: 0 / 25 checked
Verdict: Clean
Listed: 0 / 25 checked
Verdict: Clean
This IP has no blacklist listings across all 25 queried DNSBLs. Mail sent from this IP will not face DNSBL-based blocks at any major mail server. Good IP reputation is a baseline requirement for reliable inbox delivery, though other factors like authentication and sending history also matter.
WarningPBL listing -- residential or dynamic IP
IP: 203.0.113.15
Listed: 1 / 25 -- Spamhaus ZEN (127.0.0.10 -- PBL)
Verdict: Caution
Listed: 1 / 25 -- Spamhaus ZEN (127.0.0.10 -- PBL)
Verdict: Caution
A Spamhaus PBL listing means the IP is in a range designated for end-user devices that should not send email directly to mail servers. This is common for residential broadband and dynamic IP ranges. The correct fix is not delisting, but routing outbound email through a proper SMTP relay or mail service rather than sending directly. If this is a static server IP incorrectly in the PBL, contact your ISP.
FailSpam listing -- mail server sending spam
IP: 192.0.2.88
Listed: 2 / 25 -- Spamhaus SBL, SpamCop BL
Verdict: Poor
Listed: 2 / 25 -- Spamhaus SBL, SpamCop BL
Verdict: Poor
Listed on two spam-source blacklists, meaning this IP has been observed sending unsolicited bulk email. Email from this IP is likely being rejected or marked as spam at most corporate mail servers and consumer providers. Investigate for compromised accounts, unauthorized relaying, or malware. After fixing the root cause, submit delisting requests to Spamhaus and SpamCop directly from their websites.
FailCritical -- exploit listing, compromised server
IP: 203.0.113.99
Listed: 5 / 25 -- Spamhaus XBL (127.0.0.4), CBL, DroneBL, SORBS, UCEPROTECT L1
Verdict: Critical
Listed: 5 / 25 -- Spamhaus XBL (127.0.0.4), CBL, DroneBL, SORBS, UCEPROTECT L1
Verdict: Critical
Multiple exploit-type listings indicate this server is likely running malware, an open proxy, or is part of a botnet. The Spamhaus XBL return code 127.0.0.4 specifically identifies infected or compromised hosts. Do not attempt delisting until the server has been fully audited and cleaned. Email from this IP will be rejected by virtually all mail servers until the listings are resolved. This situation requires immediate security remediation before any deliverability steps.
InfoShared hosting IP -- listed due to other tenants
IP: 198.51.100.200 (shared hosting)
Listed: 1 / 25 -- Barracuda BRBL
Verdict: Caution
Listed: 1 / 25 -- Barracuda BRBL
Verdict: Caution
A Barracuda BRBL listing on a shared hosting IP often reflects the behavior of other customers on the same server rather than your own sending. If you are on shared hosting and seeing unexpected delivery issues, consider moving to a dedicated IP or using a dedicated transactional email service with their own clean IP pools. Submit a Barracuda reputation review at barracudacentral.org to begin the removal process.
FAQ
Frequently asked questions about IP blacklists, DNSBL lookups, and email reputation
What is an IP blacklist checker?
An IP blacklist checker is a tool that queries your IP address against multiple DNS-based Blackhole Lists (DNSBLs) simultaneously to determine whether your IP has been flagged for sending spam, hosting malware, or other abusive behavior. Mail servers worldwide consult these lists in real time when deciding whether to accept, reject, or junk incoming email. This tool checks against 25 major blacklists including Spamhaus ZEN, SpamCop, Barracuda BRBL, SORBS, and more, giving you a complete picture of your IP's reputation across the email ecosystem.
How does a DNSBL blacklist lookup work technically?
A DNSBL (DNS-based Blackhole List) lookup works by reversing the IP address octets and appending them to the blacklist's zone name, then performing a standard DNS A record query. For example, to check the IP 192.0.2.1 against zen.spamhaus.org, the tool queries 1.2.0.192.zen.spamhaus.org. If an A record is returned (typically in the 127.0.0.x range), the IP is listed. The return code often encodes the specific reason for listing — for example, Spamhaus returns 127.0.0.2 for SBL (spam source), 127.0.0.4 for XBL (exploits/malware), and 127.0.0.10 for PBL (policy/dynamic IPs).
What should I do if my IP is blacklisted?
First, identify and resolve the root cause before requesting delisting. Common causes include an open mail relay on your server (allows anyone to send email through it), compromised user accounts sending spam, malware or a botnet on your network, or abnormally high email sending volumes triggering automated listing. Once the underlying issue is fixed, visit the website of each blacklist you appear on and submit a removal request. Most major lists like Spamhaus and SpamCop have automated delisting tools that process requests within 24 hours for IPs with a clean post-fix history.
What is Spamhaus ZEN and why does it matter most?
Spamhaus ZEN (Zero Enhanced Network) is a combined DNSBL zone that merges three separate Spamhaus lists into one: SBL (Spamhaus Block List, covering spam sources), XBL (Exploits Block List, covering compromised machines and botnets), and PBL (Policy Block List, covering IP ranges that should not be sending direct-to-MX email such as residential and dynamic IPs). Spamhaus is queried by an enormous proportion of the world's mail servers, making a ZEN listing the single most damaging blacklist appearance. Many enterprise mail systems will hard-reject email from any IP listed on Spamhaus.
How long does delisting take?
Delisting timelines vary by blacklist. Spamhaus processes automated SBL and CBL removals within minutes to hours after the issue is resolved and the form is submitted. SpamCop listings expire automatically after approximately 24 hours of no new spam reports. Barracuda BRBL typically responds within 12-24 hours. UCEPROTECT listings at Level 1 auto-expire after around 7 days of clean behavior, while Level 2 and 3 can persist longer as they are based on network-level patterns rather than individual IP behavior. Some smaller lists may take several days or require manual review.
Why is my IP blacklisted if I don't send spam?
There are several common reasons an IP can be blacklisted without the owner knowingly sending spam. Shared hosting environments mean your IP may be shared with dozens or hundreds of other customers, and the actions of one bad actor can affect everyone. Dynamic IP addresses from ISPs are often pre-listed on policy lists like Spamhaus PBL because they are not expected to deliver email directly to mail servers. Compromised servers or devices on your network may be part of a botnet and sending spam without your knowledge. Email forwarding configurations can also cause backscatter, which some lists track.
What is the difference between spam blacklists and exploit blacklists?
Spam blacklists (like Spamhaus SBL, SpamCop, SORBS Spam) list IPs that have been observed sending unsolicited bulk email. They are typically based on trap hits (spam sent to honeypot addresses) or user-submitted spam reports. Exploit blacklists (like Spamhaus XBL, CBL, DroneBL) list IPs that are running open proxies, infected with malware, or participating in botnet activity - regardless of whether they have sent spam. An exploit listing often means your server or network is compromised. Reputation lists (like Barracuda BRBL) combine multiple signals into a composite score rather than listing based on a single event.
How does IP blacklisting affect email deliverability?
When a receiving mail server connects to your IP, it queries one or more DNSBLs before accepting the message. If your IP is listed, the server may reject the connection outright with a 5xx SMTP error (permanent failure), defer the message with a 4xx error (temporary failure, will retry), silently accept but route to spam/junk folder, or accept the message but apply additional content filtering. Major providers like Gmail, Microsoft 365, and Yahoo use their own internal reputation systems in addition to public blacklists, so a blacklist listing can also trigger stricter filtering at these platforms. Even a single Spamhaus listing can cause immediate delivery failures at a large proportion of corporate mail servers.
Can a clean result guarantee email delivery?
No. A clean blacklist result means your IP is not currently listed on any of the 25 checked public DNSBLs, but email deliverability depends on many additional factors. Major mailbox providers like Gmail, Outlook, and Yahoo maintain their own internal IP reputation systems that are not publicly queryable. Your domain reputation, DMARC/DKIM/SPF authentication, email content, engagement metrics (open rates, spam complaint rates), and sending history all affect deliverability independently of blacklist status. A clean IP is a necessary but not sufficient condition for reliable inbox placement.
What is the Spamhaus PBL and should I be concerned about a PBL listing?
The Spamhaus Policy Block List (PBL) lists IP address ranges that should not be sending outbound email directly to mail servers. This includes residential broadband IP addresses, mobile data IPs, and dynamic IP ranges allocated to end users by ISPs. A PBL listing does not mean your IP has sent spam - it simply means your IP type is not intended for direct email sending. The correct fix is not to request delisting, but to route your outbound email through a proper SMTP relay or mail server. If you are running a legitimate mail server on a static IP that is incorrectly listed on PBL, Spamhaus does have a process for ISPs and businesses to remove static IP blocks from the PBL.
Related Email & Security Tools
Need a disposable email address?Generate a free, instant throwaway -- zero signup, zero trace.
Get Free Temp Mail ->