IP & Network
Spam blacklist check
Scan IP against 15+ DNSBL blacklists in parallel.
About this tool
A spam DB check tells you whether an IP address is listed on any of the major DNS blacklists used by mail servers and abuse filters around the world. We query 16 well-known zones in parallel — Spamhaus ZEN, SpamCop, Barracuda, SORBS, CBL, UCEPROTECT levels 1–3, PSBL, manitu, Mailspike, DroneBL, GBUdb, abuse.ch and s5h — and stream their answers as they arrive.
Each zone is queried with a reverse-octet DNS request: for IP 1.2.3.4 we ask 4.3.2.1.zen.spamhaus.org for an A record. A reply (typically 127.0.0.x) means listed; NXDOMAIN means not listed; a timeout or refused answer is reported as unknown for that zone only — the rest keep going. Where a zone returns a listing we follow up with a TXT query so you can read the human-readable reason next to the verdict.
What you can do with it
- Diagnose mail deliverability. If outbound from a mail server is bouncing or going to spam, the first thing the recipient checks is your IP against these same lists. Run it yourself first and you will see what they see.
- Vet a new server before sending. A fresh hosting IP can be on UCEPROTECT level 2/3 inherited from the previous tenant or the entire ASN — better to know on day zero than after launch.
- Investigate a suspicious peer. Looking at a connecting IP in your firewall logs? A multi-zone listing with a TXT reason (e.g. "snowshoe spam", "exploited host") tells you what kind of trouble it is.
- Confirm a delisting request. After you submit removal forms to Spamhaus / SpamCop, re-run the check periodically — when the zone drops the listing, our cache will reflect it within 30 minutes.
Reading the result
"Listed" with a TXT reason is the actionable case: follow the link the zone provides to file a removal. "Listed, no reason" still counts as a listing — many zones omit TXT for performance. "Not listed" is what you want for every zone. "Unknown" usually means the zone resolver was rate-limiting our request from this server (some zones aggressively block bulk queriers); re-run in a few minutes. Results are cached for 30 minutes per IP so refreshes are instant and we do not hammer the upstream zones.Frequently asked questions
Which blacklists do you check?
Sixteen public DNSBLs grouped by purpose: Spamhaus ZEN (composite — combines SBL, XBL, PBL), SpamCop, Barracuda, SORBS aggregate + spam, CBL (abuseat — botnets/proxies), UCEPROTECT levels 1/2/3 (single-IP → ASN-wide escalation), PSBL, manitu (NiX), Mailspike, DroneBL, GBUdb truncate, abuse.ch combined, and s5h. The mix covers volunteer-driven, commercial-mail-filter and ASN-reputation styles, so a multi-zone listing is a strong signal — a single zone listing is often false-positive worthy of investigation but not panic.
Why does one zone say "unknown"?
Two reasons. First, some zones (notably SORBS, UCEPROTECT) rate-limit queries from servers that send too many lookups per second — our IP can be temporarily ignored. Second, the zone may be down or returning
SERVFAIL on the day. Either way, "unknown" is isolated: the other 15 zones return their verdicts normally, and a re-run in a few minutes usually clears it. Treat "unknown" as no information — neither clean nor dirty.
How do I get delisted if I am on a list?
Each zone has its own removal procedure — click through to the zone (e.g.
spamhaus.org/lookup, spamcop.net/bl.shtml, uceprotect.net/en/index.php?m=6&s=10) and submit a request from the listed IP itself. Most major lists (Spamhaus, SpamCop) auto-expire if the abusive behaviour stops; UCEPROTECT requires payment for instant removal but ages out for free in roughly 7 days. Before requesting removal, fix the underlying issue (compromised account, open relay, malware-infected device on your network) — listings repeat fast otherwise.
Does this work for IPv6?
No. DNSBL coverage of IPv6 is essentially zero — most zones never published an IPv6 dataset. The reverse query for IPv6 would also need to traverse a much longer hex-nibble path (
2001:db8::1 → 32 nibbles) and most zones reply NXDOMAIN by default, which is meaningless. We accept only IPv4 addresses on this tool. If you need to vet an IPv6 sender, the Privacy Check tool covers VPN/Tor/hosting indicators that are IPv6-aware.
How fresh are the answers?
We cache each IP's full result for 30 minutes. Within that window, refreshes are instant and we do not re-query the upstream zones. The TTL is deliberately short for spam DBs — listings come and go faster than for hosting/geolocation data. After 30 minutes the next request runs the full parallel pool again. If you just submitted a delisting request and want to verify it took effect, wait the 30 minutes (or change the URL — different IP, different cache key) before re-running.