Email Blacklists: How to Check If You’re Listed and Get Removed

An email blacklist is a DNS-based list of IP addresses or domains that receiving mail servers consult to decide whether to reject, junk or accept your mail. The technical names are DNSBL and RBL; RFC 5782 calls them “DNS Blacklists and Whitelists”, and Spamhaus now says “blocklist”. If you are listed, some receivers will bounce or filter your messages. To check, run your sending IP and domains through a multi-list checker, or query the lists yourself with dig. To get removed, fix whatever caused the listing first, then use the operator’s own removal process. Spamhaus states that removal never costs anything.

How DNS blocklists answer a query

A DNSBL is a DNS zone. A mail server that receives a connection from 203.0.113.7 reverses the octets, appends the list’s zone name and looks up the result. RFC 5782 states the rule: “The entry’s name is created by reversing the order of the octets of the text representation of the IP address, and appending the domain name of the DNSxL.”

If the address is listed, the lookup returns an A record in the 127.0.0.0/8 range, and the exact value says why. If it is not listed, the lookup returns NXDOMAIN, because per the RFC there must be no records for an unlisted address. Many lists also publish a TXT record that explains the listing.

Two kinds of list exist:

• IP lists such as Spamhaus ZEN or SpamCop judge the server that connects.
• Domain lists (the RFC calls them RHSBLs, right-hand-side blacklists) judge domain names found in the message, such as the sending domain or domains in links. For these, “the names of their entries MUST contain the listed domain name followed by the name of the DNSxL”, for example example.com.dbl.spamhaus.org.

That second type is why a clean IP does not guarantee clean delivery. A link domain on a domain list can get a message filtered even when the sending server is fine.

The lists that matter and how each one works

Each operator publishes its own rules. This table covers only what the operators’ own sites say.

List	What it lists	Why you land on it	How removal works
Spamhaus SBL	IPs	IPs that “appear to Spamhaus to be under the control of, used by, or made available for use by spammers and abusers”	The ISP in charge of the IP sends the removal request, after the cause is resolved
Spamhaus XBL	IPs	Signs of compromise: malware, brute force, mail relay with stolen credentials	Self-service at check.spamhaus.org, or automatic expiry once the behavior stops; it re-lists if the problem continues
Spamhaus CSS	IPs	Low-reputation email: unsolicited mail, poor list hygiene, compromised accounts or CMS	Self-service, but the cause “MUST be identified and corrected” first; listings normally expire three days after the last spam detection
Spamhaus PBL	IPs	Policy list of end-user ranges from which email should never be sent directly to the final destination	Self-service at check.spamhaus.org
Spamhaus ZEN	IPs	SBL, CSS, XBL and PBL combined in one query	Remove from the component list that appears
Spamhaus DBL	Domains	Domains showing signs of spam or malicious activity	Request at check.spamhaus.org
Barracuda BRBL	IPs	Generated by automated systems	Web form on barracudacentral.org; requests are “typically investigated and processed within 12 hours” with a valid explanation
SpamCop SCBL	IPs	IPs that have “transmitted reported email to SpamCop users”	Automatic: without more reports, a listed address stays “for only 24 hours”
UCEPROTECT	IPs (Level 1), allocations (Level 2), ASNs (Level 3)	Level 1 is single IPs; levels 2 and 3 cover wider ranges	See its Removal Policy page; check what applies before paying anyone
Invaluement	IPs (ivmSIP) and domains (ivmURI)	ivmSIP: IPs that send mostly spam; ivmURI: domains in links in spam	Delist requests page on invaluement.com
URIBL	Domains	Domains that appear in spam, not where it was sent from	Lookup page is open; submitting a delist request requires a login
SURBL	Domains	Domains of malicious or abused sites	Start from its lookup page

Three details from that table matter in practice.

The PBL is not a penalty. Spamhaus says “the IPs in this dataset are not necessarily ‘bad’ – simply, they should never be sending email.” A PBL hit usually means you are sending directly from a residential or dynamic range instead of authenticating through a mail server.

ZEN is a bundle. Spamhaus describes it as “the combination of all Spamhaus’ free IP-based DNSBLs into one single” list, so the answer’s last digits tell you which component list matched.

SORBS is gone. Proofpoint confirmed that SORBS “was decommissioned on June 5, 2024, and the service no longer contains reputation data.” A SORBS entry in an old checker or old advice is stale.

On fees, Spamhaus is blunt: “There is never any charge or fee associated with removing any Spamhaus listing. Any offer from anyone to remove any Spamhaus listing for a fee is a scam.”

Signs your sending IP or domain is listed

Blocklist problems show up in bounces first. Look for:

• A 550 5.7.1 rejection that names a list, a zone such as zen.spamhaus.org, or a lookup URL in the text.
• A bounce-back message from one corporate domain or small ISP while Gmail delivery looks normal.
• A sudden drop at specific receivers right after a compromised-account incident, a new IP going live or a bulk send to an old list.
• Mail that lands in spam only for recipients behind a particular filtering gateway.

None of these is proof alone. If the cause could be content, authentication or volume, read why emails go to spam before you assume a listing.

How to check if you’re on an email blacklist

Step 1: Collect what to check

Check your sending IP addresses, your From domain and any link or tracking domains. To find the sending IP, open a message you sent to a test mailbox and read the Received headers: the first hop outside your own network shows the IP the receiver saw.

Step 2: Use a multi-list checker

• MXToolbox Blacklist Check tests a mail server IP address against DNS-based email blacklists.
• Spamhaus IP and Domain Reputation Checker (check.spamhaus.org) covers Spamhaus’s own lists and is where self-service removal starts.
• MultiRBL (multirbl.valli.org) describes itself as a free multiple DNSBL lookup and FCrDNS check tool, so it also verifies that your forward and reverse DNS match.

Step 3: Query the list yourself with dig

For the IP 203.0.113.7 (a documentation address), reverse the octets and append the zone:

dig +short 7.113.0.203.zen.spamhaus.org

For a domain, prepend it to the zone:

dig +short example.com.dbl.spamhaus.org

No output means NXDOMAIN, so not listed. An answer is a return code. Illustrative example for a listed IP:

127.0.0.3

For ZEN, Spamhaus documents these codes: 127.0.0.2 is SBL, 127.0.0.3 is CSS, 127.0.0.4 is XBL, 127.0.0.10 and 127.0.0.11 are PBL, 127.0.0.9 is DROP and 127.0.0.30 is BCL. For DBL, 127.0.1.2 is a low-reputation domain, 127.0.1.4 phishing-related, 127.0.1.5 malware-related and 127.0.1.6 a botnet C&C domain. RFC 5782 requires IPv4 lists to carry a test entry for 127.0.0.2, so querying 2.0.0.127 against a list’s zone shows what a hit looks like on that list.

The public resolver trap. Spamhaus blocks queries to its free public mirrors that arrive through large public resolvers. In its words: “When you query the free public mirrors via a public or open resolver or an IP address with generic, unattributable reverse DNS, we can’t determine the volume of queries you are making.” The answer you get is 127.255.255.254, defined as “Query via public/open resolver/generic unattributable rDNS”. Two related error codes are 127.255.255.252 (typing error in the DNSBL name) and 127.255.255.255 (excessive number of queries). None of these says anything about reputation, so a script that treats any 127.x answer as “listed” will report false positives. Query through your own recursive resolver, or use Spamhaus’s free Data Query Service.

Step 4: Do not confuse reputation tools with blocklists

Google Postmaster Tools, Microsoft SNDS and Cisco Talos are not DNSBLs. Google says Postmaster Tools monitors “information about outgoing email that you send to personal Gmail accounts, and about the domains and IP addresses you use to send email”, with spam rate and reputation dashboards. Microsoft’s SNDS “gives you the data you need to understand and improve your reputation at Outlook.com.” Talos offers IP and domain reputation lookup. A bad score in one of them does not mean you are on a public blocklist, and a clean blocklist result does not mean your reputation is fine. See Google Postmaster Tools and sender reputation for the other side.

How to get removed from an email blacklist

Fix the cause before you ask for delisting. Spamhaus says that for CSS, “whatever caused the problem MUST be identified and corrected before removing an IP”, and that the IP is re-listed if the problem continues. The same logic applies everywhere.

1. Find which list and why. Read the bounce text, then run the IP and domain through a checker. Note the list name and any TXT reason.
2. Stop the source. Typical causes: a compromised mailbox or CMS, an open relay (how to test your server for one), a purchased or scraped list, spam traps in an old segment, missing SPF/DKIM/DMARC, or a missing PTR record. Rotate SMTP credentials and patch the hole.
3. Use the operator’s own removal route. Spamhaus listings go through check.spamhaus.org (SBL removals come from the ISP in charge of the IP), Barracuda through its web form, URIBL through a logged-in delist request. SpamCop and CSS entries expire on their own if nothing new is reported.
4. Write a specific request. Say what happened and what you changed. Barracuda states that “requests without valid information will be ignored. Multiple requests will also be ignored.”
5. Monitor for a week or two. Re-check the IP and domains, and watch bounces for the same list name.

Do not pay a third party to delist you. If you send through an ESP, the provider handles IP listings. Whether that applies to you depends on a shared or dedicated IP: on a shared IP, other senders can put the address on a list, and you ask your provider to act.

How to stay off blacklists

Prevention is mostly list hygiene and plumbing:

• Collect addresses with double opt-in and never buy lists.
• Remove hard bounces immediately to avoid hitting recycled addresses and spam traps.
• Set up email authentication and matching forward and reverse DNS.
• Keep complaints low and watch Postmaster Tools.
• Warm up new IPs gradually instead of sending your full volume on day one.
• Lock down SMTP credentials and rotate them after any suspected leak.

The rest of the checklist lives in email deliverability best practices.

Do Gmail and Microsoft use public blacklists?

Both run their own reputation systems, and their sender tools (Postmaster Tools, SNDS) report on those rather than on public lists. Google’s sender guidelines also tell senders on shared IPs to “make sure the shared IP address isn’t on any internet blocklist”, because “messages sent from IP addresses on a blocklist are more likely to be marked as spam.” Smaller providers and corporate filters are where a blocklist hit most visibly turns into a hard bounce, so check the bounce text for a list name.

Frequently Asked Questions