How Email Blacklists Work: DNSBL Lookups, IP and Domain Lists

To check if your domain is blacklisted, find the IP addresses that actually send your mail, look each one up on the major DNS blocklists (DNSBLs), and look up the domain itself on domain-based lists such as the Spamhaus DBL. A result only matters if it comes from a list that big receivers use and the code means "listed", not "query refused".

Our free blacklist checker does the IP part for you in one go. This guide explains what is happening behind that check, so you can read the results properly and work out whether a listing is your problem, your host's problem, or not a problem at all. If you already know you are listed and want the removal steps for each list, our companion guide on getting delisted covers that in detail.

How a DNS blocklist actually works

A DNSBL is a DNS zone. The list operator publishes an entry for every IP address it considers a spam risk, and mail servers check incoming connections by making an ordinary DNS query. The convention is documented in RFC 5782.

To check the IP 203.0.113.25 against a list at bl.example.org, the receiving server:

1. Reverses the octets: 25.113.0.203.
2. Appends the list's zone: 25.113.0.203.bl.example.org.
3. Asks for an A record.

If the answer is NXDOMAIN (the name doesn't exist), the IP is not listed. If the answer is an address in 127.0.0.0/8, usually 127.0.0.2 or similar, the IP is listed. Many lists also publish a TXT record at the same name explaining why, often with a link to a lookup page.

That's the whole mechanism. It's fast, cheap and cacheable, which is why almost every mail server in the world uses it.

Run the check yourself

You can do exactly what a mail server does from your own computer:

# macOS / Linux
dig +short 25.113.0.203.bl.spamcop.net A
dig +short 25.113.0.203.bl.spamcop.net TXT

# Windows
nslookup 25.113.0.203.bl.spamcop.net

No output from dig (or "Non-existent domain" from nslookup) means not listed. RFC 5782 asks every IP list to keep 127.0.0.2 permanently listed as a test entry, so this query should always return an answer and is a quick way to confirm a list is working:

dig +short 2.0.0.127.bl.spamcop.net

IP lists vs domain lists

Blocklists come in two flavours, and you need to check both.

An IP listing usually causes an outright rejection with a bounce that names the list. A domain listing is quieter: the message may be accepted and then filtered to junk because a link in it points to a listed domain. That link might be your own website, a link shortener, or a tracking domain from your newsletter platform.

So a clean IP check doesn't prove your domain is clean. Look up the domain at check.spamhaus.org, which handles both IPs and domains.

Which IP should you check?

This is where most people go wrong. "My domain" can involve several different IPs:

• Your inbound mail servers, the hosts in your MX records. You can see them with our MX lookup. These matter if you run your own mail server, because the same machine usually sends as well as receives.
• Your outbound sending IPs. For Google Workspace or Microsoft 365 these belong to Google or Microsoft and are shared with millions of senders.
• Your web server. On most shared hosting, contact forms, WooCommerce order emails and WordPress password resets go out from the web server's own IP using PHP's mail function, not through your mailbox provider.
• Your newsletter or CRM platform, which sends from its own pools of IPs.

The reliable way to find the real sending IP is to look at the headers of a message you sent. The bottom-most Received: line added by the recipient's provider shows the IP that connected to it. Our guide on how to read email headers walks through this, and the email header analyzer pulls the hops out for you without uploading anything.

Our blacklist checker takes a domain and checks the IPv4 addresses behind both its MX hosts and its website. On shared hosting the website IP is very often the IP your forms send from, so that row is worth reading carefully.

Reading the return codes

Different answers mean different things. Treating every answer as "listed" is a common mistake, and so is treating every answer as "clean".

Spamhaus ZEN

ZEN combines Spamhaus's IP lists into one zone. Its documented return codes include:

The Spamhaus DBL, its domain list, answers with codes in the 127.0.1.x range.

Error codes that are not listings

Spamhaus restricts free use of its public mirrors. If you query it through a large public resolver such as 8.8.8.8 or 1.1.1.1, you get an error answer rather than real data. Spamhaus documents three of these:

• 127.255.255.252: the zone name in the query is mistyped.
• 127.255.255.254: the query came through a public or open resolver, or from an address with generic reverse DNS. Spamhaus refuses it.
• 127.255.255.255: the resolver has made too many queries.

This is why one online checker says "listed on Spamhaus" while another says "clean". A badly written tool sees 127.255.255.254 and reports a listing. For that reason our checker doesn't query Spamhaus at all: its free terms don't cover a public lookup service, so we link you to Spamhaus's own free checker for your IPs and domain instead.

Which listings actually matter?

There are well over a hundred public blocklists, and receivers choose which ones to trust. A listing only hurts if the people you email use that list.

• Spamhaus is the one that matters most. A ZEN or DBL listing will cause real delivery problems with many business mail servers.
• Microsoft and Google run their own internal reputation systems. Their blocks show up in bounces (for example Microsoft's 5.7.606 to 5.7.649 range), not on public lists. See our guide to email bounce codes.
• Barracuda BRBL matters if your customers use Barracuda appliances or cloud filtering, which is common in schools, local government and mid-sized firms. Barracuda asks organisations to register before querying its list, so many free checkers can't test it reliably.
• SpamCop is driven by user reports and listings expire automatically 24 hours after the last report.
• UCEPROTECT Level 1 lists individual IPs; Levels 2 and 3 list whole ranges and provider networks. Few large receivers block on Levels 2 and 3, and UCEPROTECT sells paid express delisting, which reputable lists don't. Don't pay for it.

If you're listed somewhere obscure but mail to Gmail, Outlook and your key customers is arriving, don't panic. Note it, fix any cause you can find, and move on.

Why shared hosting IPs get listed

This is the most common reason a small business finds itself on a list without having sent any spam.

A typical cPanel shared server hosts hundreds of websites on one IP address. By default, every one of those sites sends its form notifications and order emails from that same IP. If a single site on the server is compromised, for example through an outdated WordPress plugin, the attacker can push thousands of spam messages out through the server in an hour. Blocklists see spam coming from the IP and list it. Every other customer on that server inherits the listing.

Other causes on shared servers:

• A contact form without CAPTCHA being used to send spam "confirmation" emails to third parties.
• A hosting customer emailing a bought list full of spam-trap addresses.
• Poor reverse DNS: the IP has a generic or missing PTR record, which some lists and receivers treat as suspicious on its own.

You can't fix another customer's site. What you can do:

1. Stop sending from the shared IP. Configure your website to send through authenticated SMTP, either via your Google Workspace or Microsoft 365 mailbox, or via a transactional email service. On WordPress, an SMTP plugin does this in a few minutes. Your form mail then leaves from your provider's well-managed IPs.
2. Tell your host. Send them the listing details. A good host will find the compromised account and request removal, and they're the only party that can for SBL listings.
3. Make sure SPF reflects reality. Once your site sends through your mailbox provider, remove the host's IP or include: from your SPF record if nothing else uses it. Our SPF checker shows what is currently authorised.
4. Ask to move server, or move host, if the same IP keeps getting listed.

If the listed site is yours, read our guide to signs your website was hacked before asking for removal, or you will be relisted within days.

When the IP is Google's or Microsoft's

If your mail goes through Google Workspace or Microsoft 365 and a checker shows one of their IPs on a minor list, there's nothing for you to do. You can't request removal for IPs you don't control, and these providers manage their own reputation. If you're getting actual bounces, the cause is far more likely to be your domain: missing authentication, a DMARC failure, or complaint rates. Our guide on why emails go to spam covers those.

A quick checking routine

1. Send a test email to a Gmail address and open the headers. Note the sending IP.
2. Run your domain through the blacklist checker to cover your MX and web server IPs.
3. Look up the sending IP and your domain at check.spamhaus.org.
4. Read any bounces for list names or provider codes.
5. If listed on a list that matters, find and fix the cause, then follow the removal steps in our delisting guide.

MakeItFlow doesn't monitor blocklists. Its free audit does check the MX, SPF, DKIM and DMARC setup that affects whether receivers trust you, and Website Monitoring (Starter plan and up) re-scans saved sites daily or weekly and emails you when the score changes.

FAQ

What does 127.0.0.2 mean in a blacklist check?

It means the IP is listed. On RFC 5782-style lists, any answer in the 127.0.0.0/8 range is a listing, and the last octet often says which sub-list or reason applies. On Spamhaus ZEN, 127.0.0.2 specifically means the SBL.

Why does a checker say I'm on Spamhaus when Spamhaus says I'm not?

The checker probably queried Spamhaus through a public resolver and got 127.255.255.254, which is Spamhaus refusing the query, then reported it as a listing. Always confirm on check.spamhaus.org before acting.

Can my domain be blacklisted if my IP is clean?

Yes. Domain lists such as the Spamhaus DBL, SURBL and URIBL look at domains in the sender address and in links. A compromised website or a spammy link shortener in your emails can get a domain listed while every IP is clean.

My website shares an IP with other sites. Should I worry?

Only if your site sends email from that IP. Website visitors aren't affected by email blocklists. Route your form and order emails through authenticated SMTP and the shared IP's mail reputation stops mattering to you.

Is it bad that my office broadband IP is on the PBL?

No. The PBL lists address ranges that ISPs say shouldn't deliver mail directly, which covers most broadband. Your email client sends through your provider's servers, so the listing has no effect unless you run your own mail server on that connection.

How often should I check blacklists?

Check when something changes: bounces mentioning a list, a sudden drop in replies, or a security incident. A monthly spot check is plenty for most small businesses that send through a major mailbox provider.