Theme

Popular tools

IP Blacklist Checker

Check an IP, mail server or domain against 27 live blacklists and reputation lists. See why you're listed, who owns the address and how to delist.

Asked live through Google and Cloudflare DNS · each list's own test entry checked every time · refused or unanswered lists never count as clean
27 lists live

IPv4 or IPv6. A domain or e-mail address checks its mail servers and its web address.

Try

Sent to the blocklists below as DNS questions, through Google and Cloudflare DNS. Kept 10 minutes, then dropped.

The 27 lists we ask

Spam sources

18
Lists of addresses that sent spam: reported by people, caught by spam traps or scored across many mailboxes.
  • SpamCopSpamAssassin default
    Cisco
  • MailspikeSpamAssassin default
    Mailspike
  • PSBLSpamAssassin default
    Passive Spam Block List (surriel.com)
  • UCEPROTECT Level 1
    UCEPROTECT-Network
  • Spam Eating MonkeyRspamd default
    SpamEatingMonkey.com
  • GBUdb Truncate
    ARM Research Labs
  • Hostkarma
    Junk Email Filter
  • InterServer RBL
    InterServer
  • s5h.net
    s5h.net
  • NordSpam
    The NordSpam Project
  • SPFBL
    SPFBL.net
  • ZapBL
    ZapBL
  • 0spam
    The 0spam Project
  • JIPPG RBL
    JIPPG (Japan)
  • NoSolicitado
    NoSolicitado.org
  • KEMPT
    Kempt.net
  • anonmails.de
    anonmails.de
  • abuse.ro RBL
    abuse.ro

Backscatter

2
Lists of servers that bounce or auto-reply to forged senders. Not spam: misdirected mail.
  • Backscatterer
    UCEPROTECT-Network
  • SEM Backscatter
    SpamEatingMonkey.com

Not checked

Lists we name but don't ask, and why, so a missing answer never reads as clean.
  • Spamhaus
    Not asked: its terms don't cover a free public lookup. Its own page answers for this address.
    Check at Spamhaus

Infected and attacking

3
Lists of addresses that attacked servers: password guessing, malware, open proxies, scans.
  • blocklist.deRspamd default
    blocklist.de
  • DroneBL
    The DroneBL Team
  • Blocked Servers
    BlockedServers.com

Policy lists

4
Not a spam verdict: facts about the address, such as a home range, its whole network or a Tor exit.
  • UCEPROTECT Level 2
    UCEPROTECT-Network
  • UCEPROTECT Level 3
    UCEPROTECT-Network
  • abuse.ro PBL
    abuse.ro
  • Tor exits (dan.me.uk)
    dan.me.uk

What is an IP blacklist (DNSBL)?

An IP blacklist, or DNSBL (DNS-based blocklist), is a list of addresses that sent spam, attacked servers or shouldn't send mail directly, published as a DNS zone so any mail server can look an address up in milliseconds. Receiving servers ask one or more lists for every connection, then reject the message or add to its spam score when the address is listed.

The question is the address written backwards in front of the list's zone: to check 198.51.100.77 on SpamCop, a server asks for 77.100.51.198.bl.spamcop.net. No such name (NXDOMAIN) means not listed; an address in 127.0.0.0/8 means listed, and its last number says why. IPv6 addresses are asked as 32 reversed hex digits (RFC 5782).

The lists block nothing themselves: each receiving server's admin decides which lists to trust and what a listing costs a message. Every list must list 127.0.0.2 and never 127.0.0.1, its built-in test, which this checker asks with every check.

The address
198.51.100.77
Reversed + The list's zone
77.100.51.198.bl.spamcop.net
The question77.100.51.198.bl.spamcop.net A ?

Two possible answers

Listed127.0.0.2

SpamCop's code: reported as spam in the last 24 hours

Not listedNXDOMAIN

The name doesn't exist: the address isn't on the list

Every list's test: 2.0.0.127.bl.spamcop.net must answer 127.0.0.2

One lookup, as a mail server makes it: the documentation address 198.51.100.77 on SpamCop's zone. Every list on this page is asked the same way.

Is my IP blacklisted? How to read the result

Type the address in the box above, or use Your IP. Every list answers in one of six ways, and only two of them say something about the address: listed and not listed. A list that refuses or stays silent tells you nothing, so it never counts as clean.

The verdict names the major lists first. The chart under it shows every list as a cell as wide as its weight, so one SpamCop listing outweighs three small ones at a glance, and the score compares the listed weight with the weight that answered.

IP blacklist check result: a mail server listed on SpamCop and two smaller lists, a chart of every list and the fix planIP blacklist check result: a mail server listed on SpamCop and two smaller lists, a chart of every list and the fix planThe verdictMajor lists first, with their marks, then the smaller ones, then policy notes and the link to Spamhaus's own checker.The weight chartEvery list as a cell sized by its weight: red listed, green not listed, blue policy, hatched when it refused or didn't answer.The fix planBuilt from the listings: the cause first, then each list's removal step and how long it takes.About this addressThe network, the reverse DNS name and whether it points back, the home range, Tor, and the mail domain's SPF and DMARC.
A blacklist check of a documentation address: the verdict, every list as a cell sized by its weight, and the fix plan. Select a number to see what each part shows.
77.100.51.198.bl.spamcop.net
→ 127.0.0.2
ListedSpamCop

The list has the address. The code says why, and the list's TXT note often links to its own page about it.

77.100.51.198.psbl.surriel.com
→ NXDOMAIN
Not listedPSBL

The list answered and doesn't have the address. Counted only when the list's own test entry answered too.

77.100.51.198.pbl.abuse.ro
→ 127.0.0.9
Policyabuse.ro PBL

A fact about the address, not an accusation: a home range, its whole network, a Tor exit. Never counted as spam.

77.100.51.198.zen.spamhaus.org
→ 127.255.255.254
RefusedSpamhaus

The list refused the question. Spamhaus answers this to big public resolvers; checkers that read it as "not listed" are wrong.

77.100.51.198.bl.nordspam.com
→ —
No answer

Nothing came back in time, through Google or Cloudflare. Unknown, never clean: check again in a minute.

Spamhaus · Not checked
Not checkedSpamhaus

A list we name but don't ask: its terms don't allow a free public lookup, or it has no zone for IPv6.

The six answers with real codes. Only Listed and Not listed are answers about the address; the score leaves the rest out as unknown.

Spamhaus refuses public resolvers with 127.255.255.254 and Google's with no answer at all, and says plainly that this code must not be read as listed. Checkers that ask through Google or Cloudflare and show it as "not listed" give a false all-clear for the list that matters most.

IP reputation check: which blacklists matter?

The ones receiving servers actually use. SpamAssassin's default rules ask Spamhaus ZEN, SpamCop, PSBL and Mailspike; Rspamd's ask Spamhaus ZEN, Mailspike, Spam Eating Monkey and blocklist.de. Outlook.com and Yahoo both name Spamhaus in their rejections. A listing on one of these costs mail; a listing on a small personal list rarely does.

Each list here has a weight from that: who filters with it by default, what mailbox providers name, and the list's own scope. Lists of weight 6 or more are major. Policy lists weigh nothing: they describe the address, they don't accuse it.

ListWeightSpamAssassinRspamd
SpamhausSpamhaus ZEN: the list most servers use. Not checked here (terms); check it at Spamhaus.Not checked
SpamCopSpam · Cisco8–
MMailspikeSpam · Mailspike6–
PSBLSpam · Passive Spam Block List (surriel.com)5–
blocklist.deAttacks · blocklist.de5–
DroneBLAttacks · The DroneBL Team5––
UCEPROTECT Level 1Spam · UCEPROTECT-Network4––
SSpam Eating MonkeySpam · SpamEatingMonkey.com4–
GGBUdb TruncateSpam · ARM Research Labs3––
HHostkarmaSpam · Junk Email Filter3––
InterServer RBLSpam · InterServer2––
Ss5h.netSpam · s5h.net2––
NordSpamSpam · The NordSpam Project2––
SPFBLSpam · SPFBL.net2––
ZapBLSpam · ZapBL2––
0spamSpam · The 0spam Project2––
JJIPPG RBLSpam · JIPPG (Japan)1––
NNoSolicitadoSpam · NoSolicitado.org1––
KKEMPTSpam · Kempt.net1––
anonmails.deSpam · anonmails.de1––
Aabuse.ro RBLSpam · abuse.ro1––
BBlocked ServersAttacks · BlockedServers.com1––
BackscattererBounces · UCEPROTECT-Network1––
SSEM BackscatterBounces · SpamEatingMonkey.com1––
UCEPROTECT Level 2Policy · UCEPROTECT-NetworkNo weight: context only––
UCEPROTECT Level 3Policy · UCEPROTECT-NetworkNo weight: context only––
Aabuse.ro PBLPolicy · abuse.roNo weight: context only––
Tor exits (dan.me.uk)Policy · dan.me.ukNo weight: context only––
Show all 27 lists
Every list we ask, by weight, and whether the two big open-source filters ask it by default (SpamAssassin's live ruleset and Rspamd's rbl.conf, read on 2026-10-22).

Why is my IP blacklisted?

Because something at that address did what a list watches for. The cause decides the fix: a removal request without fixing it only gets the address listed again.

An infected device or a stolen password

Malware on a PC, phone or router behind the address sends spam or attacks other servers; a cracked mail password sends through your own server.

  • blocklist.de
  • DroneBL
  • Aabuse.ro RBL
  • BBlocked Servers

Mail to spam traps

Old, scraped or bought address lists hit addresses that never signed up for anything: the traps the lists run themselves.

  • PSBL
  • UCEPROTECT Level 1
  • SSpam Eating Monkey
  • ZapBL

People reporting the mail as spam

SpamCop lists addresses its users report; Mailspike and GBUdb score what they see across many mailboxes.

  • SpamCop
  • MMailspike
  • GGBUdb Truncate
  • HHostkarma

Bounces to forged senders

A server that accepts spam and bounces it later, or auto-replies to it, sends mail to people who never wrote: backscatter.

  • Backscatterer
  • SSEM Backscatter

Sending straight from a home line

Mail servers expect home and mobile ranges to send through the provider's server. Policy lists mark these ranges; it isn't a spam listing.

  • Aabuse.ro PBL
  • SPFBL

Spam from your neighbours

A whole network block or provider gets listed when too many of its addresses spam, the address you checked included.

  • UCEPROTECT Level 2
  • UCEPROTECT Level 3

A VPN, proxy or Tor exit

Shared exits carry other people's traffic: Tor exits are listed for what they are, abused VPNs and open proxies for what passed through.

  • Tor exits (dan.me.uk)
  • DroneBL
Causes and the lists that catch them. Red lists accuse the address; blue ones only describe it.

How to remove your IP from a blacklist

Fix the cause first, then let each list do what it says. Most listings expire by themselves within days once the cause stops; the rest have a form.

  1. 1

    Fix the cause

    Clean the infected device, change the stolen password, close the open relay, stop the bounces.

  2. 2

    Check again here

    Listings that expire on their own disappear from the result as each list drops them.

  3. 3

    Request removal where the list asks for it

    Use the removal link on the list's row: its own form or lookup page.

  4. 4

    Give it time

    Each list's own time is on the timeline. A request before the fix gets the address listed again.

  1. Ss5h.netAt onceAt once
  2. PSBLAbout 30 minAbout 30 min
  3. Tor exits (dan.me.uk)Within an hour of the Tor relay going offlineWithin an hour of the Tor relay going offline
  4. MMailspike6–36 h6–36 h
  5. SSpam Eating MonkeyReviewed within 24 hReviewed within 24 h
  6. NordSpam1–48 h1–48 h
  7. SpamCop24 h after the last report24 h after the last report
  8. KKEMPTA day, longer for repeatsA day, longer for repeats
  9. GGBUdb Truncate1–2 days, automatic1–2 days, automatic
  10. blocklist.de48 h without attacks48 h without attacks
  11. InterServer RBL5 days5 days
  12. UCEPROTECT Level 17 days after the last spam7 days after the last spam
  13. Backscatterer4 weeks4 weeks
How long removal takes on each list, from its own pages: a request you make (filled) or a listing that expires once the cause stops (outlined).

Never pay a third party for removal: Spamhaus says no removal ever costs money and any offer to remove a listing for a fee is a scam. UCEPROTECT sells an express removal, but its Level 1 listings expire for free 7 days after the last spam: fixing the cause and waiting costs nothing.

Email blacklist check: is your mail server set up right?

An email blacklist check is the same check run on the address your mail leaves from: its IP, not your e-mail address. Type the domain or an e-mail address and the checker finds its mail servers (MX) and checks them, with the domain's web address.

Not being listed is half the job. Gmail requires the sending IP to have a PTR name that points back to it (forward-confirmed reverse DNS, FCrDNS), and Yahoo asks for a meaningful, non-generic name. The result's right column checks both and, when the name has a domain, whether its SPF allows the address and whether it publishes DMARC.

Forward-confirmed

192.0.2.25PTRmail.example.comA✓ same address

No reverse DNS

198.51.100.77PTRno PTR record
  • A PTR name is set for the address
  • The PTR name points back to the address (FCrDNS)
  • The name isn't a generic home or pool name
  • The domain's SPF names the address
  • The domain publishes DMARC
  • Not listed on a major list
Forward-confirmed reverse DNS: the address's PTR name must resolve back to the same address. 192.0.2.25 passes; 198.51.100.77 has no name at all.

Do Gmail, Outlook and Yahoo use blacklists?

All three judge senders by their own reputation data first. Public lists still matter: Google tells senders to stay off them, and Outlook.com and Yahoo name Spamhaus when they reject mail.

Gmail

Gmail's own IP reputation decides, and a very low one gets mail rejected. Google's sender guidelines still say to make sure a shared IP isn't on any internet blocklist, and require matching forward and reverse DNS.

In the bounce
550 5.7.1
Where to fix it
Google's sender guidelines

Outlook and Microsoft 365

Microsoft keeps its own blocked senders list: the bounce reads 550 5.7.606–649 and the fix is the delist portal at sender.office.com. Outlook.com's OU-001 block points to Spamhaus for removal.

In the bounce
5.7.606–649 · OU-001
Where to fix it
sender.office.com

Yahoo

Yahoo names a Spamhaus listing as a cause of permanent 5xx rejections, defers mail from addresses or ranges with poor reputation, and asks for meaningful, non-generic reverse DNS names.

In the bounce
5xx: listed by Spamhaus
Where to fix it
senders.yahooinc.com
What each mailbox provider publishes about blocklists, from its own postmaster pages.

Two of the three name Spamhaus, which this page can't ask: check it on Spamhaus's own page from the row in the result.

Domain blacklist check

Type a domain or an e-mail address and the checker finds its mail servers (MX records), resolves them to addresses, adds the domain's web address and checks up to four addresses against every list.

Domain lists (Spamhaus DBL, SURBL, URIBL) list domain names seen in spam, not addresses. None of them allows a public lookup through Google's or Cloudflare's resolvers today: DBL is under Spamhaus's terms, SURBL needs an agreement and asks not to be used for sender addresses, URIBL refuses public resolvers. So the result says they aren't checked instead of calling the domain clean. For a link in a message, the link safety checker shows where it really goes and who blocks it.

SPF's ip4: ranges can hold thousands of addresses, too many to check one by one: check the servers that actually send.

The domainexample.com
  1. Mail servers (MX) · 10mx1.example.com192.0.2.2527 lists live
  2. Mail servers (MX) · 20mx2.example.com192.0.2.2627 lists live
  3. Web address (A)example.com192.0.2.8027 lists live
Domain lists: not checked yet
  • Spamhaus DBL
  • SSURBL
  • URIBL

Each address against every list

What a domain check asks: example.com's two mail servers and its web address, each checked like a typed address.

How to check a blacklist from the command line

Ask the list's zone for the address written backwards: an answer in 127.0.0.0/8 means listed, NXDOMAIN means not. Try it with the test entry, which every list must list:

Your resolver matters: through Google or Cloudflare, Spamhaus answers 127.255.255.254 or nothing at all. Ask Spamhaus through a resolver on your own network, or on its own page.

dig +short 2.0.0.127.bl.spamcop.net A

macOS and Linux. Add TXT instead of A to read the list's note.

What the test entry answers
$ dig +short 2.0.0.127.bl.spamcop.net A
127.0.0.2
$ dig +short 2.0.0.127.bl.spamcop.net TXT
"Blocked - see https://www.spamcop.net/bl.shtml?127.0.0.2"
$ dig +short 77.100.51.198.bl.spamcop.net A
(nothing: NXDOMAIN, not listed)

Blacklists we don't check, and why

We'd rather name a list than show a result we can't stand behind. These are the lists other checkers still show, and why this one doesn't.

ListStatusWhy
Spamhaus ZEN and DBLTermsFree for non-commercial use only; refuses Google's and Cloudflare's resolvers. The result links to Spamhaus's own checker.
Barracuda BRBLRegistrationAnswers only DNS servers registered with Barracuda; public resolvers can't be registered.
Abusix Mail IntelligenceNeeds a keyNeeds an API key in every question; refuses everyone else.
SpamRATSTermsNon-commercial use only, an API key, and "do not use a free DNS service".
Validity Sender ScoreRegistrationAnswers registered users only; 127.255.255.255 to everyone else.
DNSWLTermsNo redistribution without written approval; public resolvers get 127.0.0.255.
V4BLTermsForbids passing any part of its lists to anyone else.
SURBL and URIBLDomain listDomain lists: SURBL needs an agreement and isn't for sender addresses; URIBL refuses public resolvers.
SORBSRetired2024-06-05Closed by Proofpoint; every question now answers NXDOMAIN.
NNiX SpamRetired2025-01-16Switched off; its nameservers point at documentation addresses.
CBLRetired2021Merged into Spamhaus XBL; asking both counts one listing twice.
WWPBLRetired2024Shut down; old mail servers still send it millions of questions a day.
KKISA-RBLRetired2024-01-31South Korea's national list ended.
IINPSRetired2020Shut down; its delegation says so.
AAHBL and emailbasuraUnreliableAnswer "listed" for every address since they closed.
FFabelsourcesRetiredIts domain is unregistered: anyone could buy it and make it list every address.
JJustSpamUnreliableLists Cloudflare's 1.1.1.1 resolver.
BBrukalai blackUnreliableLists Google's 8.8.8.8 resolver.
SSwiNOG DNSRBLUnreliable2026-10-29Its test entry 127.0.0.2 stopped answering and listings now come back as 127.0.0.10, so a clean answer can't be confirmed.
Lists other checkers show and this one doesn't, each from its own pages or a test of its zone on 2026-10-22.

IP Blacklist Checker FAQ

Is this IP blacklist check free?

Yes, with no account: 20 checks a minute per network, and a result is kept only 10 minutes, for repeat checks. Each check asks 27 blocklists live through Google and Cloudflare DNS, with every list's own test entry asked alongside so a list that refuses or stops working shows as refused instead of clean. A domain check counts once for each address it checks, up to four.

How do I check my IP reputation?

Type the address above, or press Your IP for your own. The check asks 27 public blocklists and two reputation lists (Mailspike and Hostkarma), then shows its network, reverse DNS, whether it's a Tor exit and who the address block is registered to. Services such as Cisco Talos and Spamhaus keep their own reputation data, and the result links to them. We don't add a score of our own.

Why does a list say "refused"?

The list didn't answer the question honestly. Some lists refuse big public resolvers: Spamhaus answers them 127.255.255.254, Validity 127.255.255.255, others SERVFAIL or REFUSED. A refused list tells you nothing about the address, so it counts as unknown, never as clean. If a list keeps refusing, check the address on that list's own page.

What does 127.0.0.2 mean?

It is the test entry every blocklist must list (RFC 5782): checking 127.0.0.2 shows each list answering "listed" as it should. As an answer, 127.0.0.2 is the most common code for "listed"; each list's code table says what its other codes mean, from spam traps to open proxies. Codes in 127.255.255.0/24 are errors, never listings.

Why is my home IP on Spamhaus PBL or another policy list?

Policy lists such as Spamhaus PBL and abuse.ro PBL list ranges that providers hand to homes and phones, which shouldn't send mail straight to other servers. It isn't an accusation of spam. Send mail through your provider's or mail host's server (port 587 with a login) and the listing stops mattering. Browsing and websites aren't affected.

How long does delisting take?

It depends on the list: SpamCop drops a listing 24 hours after the last report, UCEPROTECT Level 1 after 7 days, Backscatterer after 4 weeks; PSBL removes on request within about half an hour, Mailspike in 6 to 36 hours. Most lists expire on their own once the cause stops. Each row in the result shows its list's own time.

Should I pay UCEPROTECT for express delisting?

No. UCEPROTECT Level 1 listings expire for free 7 days after the last spam UCEPROTECT saw, and Level 2 and 3 clear when the neighbouring addresses or the provider's network stop sending spam, which no payment changes for good. Fix the cause and wait. Spamhaus, for its part, never charges for removal and calls paid removal offers scams.

Can I check an IPv6 address?

Yes. Type it as you see it and the checker asks the lists that publish IPv6 data: blocklist.de, DroneBL, Spam Eating Monkey, Hostkarma, InterServer, s5h, NordSpam, SPFBL, abuse.ro and the Tor exit list. Lists without an IPv6 zone show "not checked", never "not listed". Each IPv6 question is the address's 32 hex digits, reversed.

Does a blacklisted IP affect my website or browsing?

Mostly not: these lists are built for mail servers. Websites rarely check them, and Spamhaus warns against blocking website visitors by its PBL. A listing on an attack list such as blocklist.de or DroneBL can still get the address blocked by some firewalls and forums, and a Tor exit is blocked by many sites.

Why does a website say my IP has been banned?

The site, or a security service in front of it, refused the address, not you. Addresses are shared: a mobile or carrier-grade NAT address serves many customers at once, so one user's failed logins can lock out the others, and detection services flag VPN and data-centre addresses as likely anonymizers. Check the address here, then try another network or turn the VPN off.

What is the difference between a DNSBL and an RBL?

None in practice. RBL, the Real-time Blackhole List, was the first such list, started in 1997, and "RBL" is a Trend Micro service mark, so the generic name is DNSBL (DNS-based blocklist). Both mean a list of addresses that any server can query over DNS. DNSWL is the opposite: a list of known good senders.

How often should I check, and can I be alerted?

Check after a mail campaign, a security incident or a bounce that names a list, and before moving mail to a new server. Lists add addresses within minutes and most drop them within days, so a weekly check catches most problems. Alerts when a list adds or drops your address are coming to DNS Robot.

Missing something?Suggest a feature or a new tool

More email and IP tools