IP Blacklist Checker (DNSBL)

About IP Blacklist Checker

Whether an address is on the blocklists that actually stop mail, with what a listing on each one means.

A DNSBL is queried by reversing the address under the list's zone and asking for a record. An answer means listed; no answer means not. The answer itself carries the reason, which differs per list — which is why the codes are reported rather than reduced to a yes.

The list of lists is deliberately short. A checker that queries eighty zones produces a wall of results in which two matter, and makes almost any address look bad: several of the long-tail lists are abandoned, several are pay-to-delist, and some answer positively for every address queried. Each of the ones here is one somebody's mail is genuinely being rejected by.

A list that does not answer is reported as no answer rather than as clean, which is the distinction that matters when a result is used to decide something.

Where it helps

• Asks only lists that real receivers act on, so a hit means something.
• Reports each list's own reason where it publishes one.
• Distinguishes a list that said no from a list that did not answer.
• Explains what a listing on each specific list implies, since they are not interchangeable.

Limits

• IPv4 only. Almost no list publishes IPv6 zones, and querying them would return a clean result for every address — which would mean nothing while looking like good news.
• A clean result is a snapshot. Listings appear and expire continually, and a check from one network may differ from another if a resolver is caching.
• Delisting is each list's own process, and this does not do it for you.
• Being clean does not mean mail is delivered — reputation at the big providers is largely private and does not appear on any public list.

Frequently asked questions

Which address should I check?

The one your mail actually leaves from, which is usually not your web server and often not yours at all. Send yourself a message and read the topmost Received header: the address there is what receivers see.

I am listed. What now?

Read the reason first — most listings are automatic and say what triggered them. Fix the cause, which is usually a compromised account, an open relay, or a mailing list sent to stale addresses. Then use the list's own delisting page. Delisting before fixing the cause gets you relisted, usually faster.

Why so few lists?

Because a long list is worse than a short one here. Several widely-published DNSBLs answer positively for any address queried, several have been abandoned with their zones still resolving, and at least one exists to sell delisting. A checker that includes them makes every address look bad, which is the same as telling you nothing.

Related tools

• Reverse DNS Lookup — The PTR record for an address, and whether it confirms itself
• Email Authentication Checker — SPF, DKIM, DMARC and MX for a domain, read together
• IP Lookup — Resolve addresses and reverse DNS for a host or IP
• Email Header Analyzer — The delivery path, the authentication results, and what a forgery looks like
• DNS Lookup — Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records
• Port Checker — Test whether TCP ports accept connections

More Network & DNS tools

• DNS Lookup — Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records
• IP Lookup — Resolve addresses and reverse DNS for a host or IP
• Port Checker — Test whether TCP ports accept connections
• Nmap Port Scanner — Scan a host's common TCP ports, Nmap style, and see what each open service says it is
• Ping (TCP) — Measure connection latency with repeated TCP probes
• What Is My IP — Your public address, and what a browser reveals about you
• WHOIS — Registry records for a domain, an IP address or an AS number
• DNS Propagation Checker — The same name asked of resolvers worldwide, and of the zone's own servers
• Email Authentication Checker — SPF, DKIM, DMARC and MX for a domain, read together
• Email Header Analyzer — The delivery path, the authentication results, and what a forgery looks like
• DKIM Lookup — A domain's DKIM keys, for a selector or by trying the common ones, and whether each is worth anything
• DMARC Lookup — A domain's DMARC policy, and what it actually asks receivers to do
• Reverse DNS Lookup — The PTR record for an address, and whether it confirms itself
• Reverse IP Lookup — What an address says about itself: its name, its certificate, its network
• Traceroute — Every hop between this server and a host, with the time each one took
• Broadband Speed Test — Download, upload, latency and jitter, measured from this tab
• HTTP Headers — Grade a site's security headers from A+ to F, see every response header, and get the fix for your server
• Redirect Checker — Follow a URL's redirects hop by hop, and flag loops, downgrades and temporary redirects doing a permanent job
• IP Address Converter — Write an IPv4 or IPv6 address as an integer, hex, binary, expanded or mapped form, and see what kind it is
• MAC Address Lookup — Find the manufacturer behind a MAC address, and see what kind of address it is
• MAC to IP Converter — Build the IPv6 address a MAC forms with SLAAC, recover the MAC from one, or find a MAC's IP in an ARP table
• IP to MAC Lookup — Find the MAC address behind an IP: computed for multicast and EUI-64 addresses, or read from an ARP table
• DNSSEC Checker — Whether a domain's DNSSEC validates, and if not, whether it is the DS, a key, an algorithm or an expired signature