Blacklist Check

DNSBLs are queried over ordinary DNS. To check 203.0.113.5 against a list, you reverse the octets and append the list's zone, producing 5.113.0.203.zen.spamhaus.org, then ask for its A record. No answer means not listed. An answer in 127.0.0.0/8 means listed, and the final octet says why. Spamhaus, for instance, uses different codes for confirmed spam sources, hijacked ranges and addresses that should never send mail directly.

That design is why DNSBLs became universal: the query costs a mail server one cached DNS lookup, needs no account or API key, and answers in milliseconds during the few seconds it has to decide.

It also creates a limitation worth knowing about. The major lists rate-limit or refuse queries arriving from large public resolvers, because free bulk lookups are not what they are funded for. When that happens they return an error code in 127.255.255.0/24 rather than a listing. This tool spots those codes and marks the zone Skipped. Reporting a refusal as a clean result would be misleading, and reporting it as a listing would be worse. If a zone you care about shows Skipped, check it directly on that provider's own site.

The common case is a compromised machine. A malware infection on any device behind your connection can send spam through it, and to the outside world that traffic is indistinguishable from you sending it. Small offices and home networks are listed this way far more often than through anything anyone did deliberately.

Misconfiguration is next. An open relay, meaning a mail server that forwards mail for anyone, gets found and abused within hours of appearing on the internet. An unprotected web contact form gets used the same way.

Then there is policy listing, which catches people who have done nothing wrong at all. Several lists include entire residential and dynamic ranges on principle, because home connections are not supposed to deliver mail directly to other servers. If you run a mail server on domestic broadband, you will be listed, and the listing is working as designed.

Finally, reputation is partly shared. Some lists escalate to a whole block when abuse from a range persists, so an address can be caught by a neighbour at the same hosting provider. UCEPROTECT is the best-known example, and its wider lists are treated with corresponding scepticism.

Fix the cause before you request anything. Every list re-checks, and a delisting granted while the problem is still running gets reversed within days, often with a longer minimum listing period the second time round.

Finding the cause means auditing what can send mail from your address: scan devices on the network, confirm the mail server is not an open relay, check for compromised mailboxes sending spam with valid credentials, and look at whether any web form allows arbitrary sending.

Then follow each provider's own process, because they differ. CBL and several automated lists delist on their own once the abuse signal stops, usually within a few days. Others need a request through a form on their site. Spamhaus runs its own removal centre and will normally act quickly for a genuine one-off, but it expects the underlying issue to be fixed and takes a firmer view of repeat listings.

While you are there, fix what keeps you off lists in the first place: reverse DNS matching your mail server's hostname, and correct SPF, DKIM and DMARC records for the sending domain. None removes a listing, but their absence makes every future deliverability problem harder to argue.

Not all lists carry equal weight. Spamhaus ZEN and CBL are used almost universally and a listing on either has immediate, visible consequences. SpamCop and Barracuda are widely consulted. Others are used selectively or as one scored signal among many, so a listing there may cost you nothing measurable.

Most receiving servers also combine DNSBL results with authentication checks, content scoring and their own history for your address, rather than rejecting on a single hit. A minor listing alongside otherwise healthy mail is a very different situation from a Spamhaus one.

One thing this check cannot tell you is whether a domain is blocked. DNSBLs list IP addresses. A separate system, URIBLs, covers domains found in message bodies, and a domain can be blocked while its sending address is completely clean.