IP Blacklist Checker

What This Tool Checks

This tool queries 15 major spam blocklists (DNSBLs) plus the DNSWL allowlist in real time. Each query is a live DNS lookup against the operator's authoritative servers - no caching, no proxying, no third-party intermediary.

The Blocklists We Query

• Spamhaus ZEN - the most widely respected blocklist; combines SBL (spam sources), XBL (compromised hosts), PBL (policy block), and CSS.
• Barracuda - used by Barracuda's commercial filters + many ISPs.
• SpamCop - community-driven, fast-aging listings.
• SORBS - broad coverage including dynamic IP ranges and open proxies.
• UCEPROTECT (L1/L2/L3) - per-IP, per-/24, per-ASN. L3 listings are common for shared-hosting IPs.
• Mailspike - reputation-based, aggregates many signals.
• PSBL - passive spam block list.
• DroneBL - compromised hosts and botnets.
• Spamrats RATS - multi-category spam reputation.
• Backscatterer - sources of backscatter (misdirected bounces).
• GBUdb Truncate - aggressive but fast-aging.
• S5H, EFnet RBL - additional reputation sources.
• DNSWL (allowlist) - being listed here is GOOD - your IP has earned positive reputation.

How DNSBL Lookups Actually Work

For each blocklist, we reverse the IP octets and prepend them to the blocklist's zone, then query a DNS A record:

IP being checked: 192.0.2.5
Reversed:         5.2.0.192
Query:            5.2.0.192.zen.spamhaus.org

If A record returns 127.0.0.X > LISTED (the X identifies the sublist)
If query returns NXDOMAIN     > not listed

Sometimes a TXT record returns the listing reason (e.g., "Currently sending spam, see https://..."). We surface that when present.

What a Listing Actually Means

Not all listings are equal:

• Spamhaus SBL - confirmed spam source. Severe. Most major mailbox providers reject mail from SBL-listed IPs outright.
• Spamhaus XBL - compromised/infected host. Severe. Indicates an open proxy or botnet member.
• Spamhaus PBL - policy block (e.g., dynamic IPs that shouldn't send). Less severe but blocks mail to most ISPs.
• UCEPROTECT-1 - your specific IP. Medium severity.
• UCEPROTECT-2 - your /24 has too many bad senders. Often not your fault; common for cloud IPs.
• UCEPROTECT-3 - your ASN has too many bad senders. Almost certainly not your fault; rarely used by reputable filters.
• Barracuda - used by Barracuda commercial filters + many SMB/MSP setups. Real deliverability impact.
• SpamCop - fast-aging (24-72h) so often resolves on its own if you fix the cause.

If you're listed on Spamhaus ZEN or Barracuda, take it seriously - fix the root cause and submit delisting requests. If you're only listed on UCEPROTECT-3 or one of the smaller lists, the deliverability impact is minor.

Frequently Asked Questions