IP Blacklist Checker for Public IPv4 Addresses
Check a public IPv4 against DNSBL spam and abuse lists. See listed, clean, blocked or error results, then use the response code and provider guidance to decide the next step.
What this IP blacklist checker checks
This page is a focused DNSBL lookup for public IPv4 addresses. It answers whether the address appears on selected spam and abuse blocklists, what each response means and who usually needs to fix it.
Public IPv4 only
The lookup uses reversed IPv4 DNS queries. It does not test domains, URLs, IPv6 addresses or private LAN ranges such as 192.168.x.x and 10.x.x.x.
DNSBL provider evidence
The checker queries Spamhaus ZEN, SpamCop, Barracuda, SpamRATS, UCEPROTECT, Blocklist.de, PSBL and SORBS-style DNSBL zones where available.
Codes and TXT details
When a provider returns a response, the report shows DNSBL status, response codes and TXT details so you can distinguish abuse, policy and lookup limits.
No stored reports
The API is stateless. It runs the DNS lookups for the submitted public IPv4 address and returns the current result without saving a blacklist history.
How to check if an IP is blacklisted
Use the internet-facing address that sends mail or appears in your server logs. The result is most useful when you compare the listed providers with your own evidence.
Enter the public IPv4 address
Use the exact address you want to investigate. For a mail problem, check the outbound sending IP from the SMTP header or mail provider dashboard.
Run the DNSBL lookup
The checker queries each DNSBL in parallel and records listed, not listed, query blocked or lookup error states with response timing.
Match results to evidence
Use response codes, TXT records, bounce messages and server logs together before opening a delisting request or changing infrastructure.
How to read DNSBL blacklist results
DNSBL output is not a universal reputation score. The confidence depends on whether a provider returned a listing, did not list the address, blocked the query or failed to answer.
| Result | Confidence | Meaning | Next action |
|---|---|---|---|
| Listed | High for that provider | The DNSBL returned a code for the IP. The address is currently published by that provider as a spam, abuse or policy signal. | Read the provider detail, fix the cause, document the change and request delisting from the correct owner. |
| Not listed | Good but narrow | The provider did not publish a listing for this IP at lookup time. Other private filters may still score it differently. | Keep checking bounce text, sender authentication, volume and recipient-specific filtering if delivery still fails. |
| Query blocked | Incomplete | The DNSBL appears to have blocked or rate-limited this lookup path, often because public resolvers are restricted. | Recheck later, use an authorized resolver or verify directly with the provider before making a final decision. |
| Lookup error | Incomplete | The DNS query timed out, the resolver failed or the provider was unavailable during the check. | Retry the lookup and confirm DNS resolution works before treating the missing result as clean. |
DNSBL providers covered in this lookup
The checked lists focus on spam, compromised hosts, abusive traffic and policy ranges. Receiver policies vary, so use provider identity and response details rather than counting lists only.
| Provider | DNSBL zone | What it signals | How to use the result |
|---|---|---|---|
| Spamhaus ZEN | zen.spamhaus.org | High-impact spam, botnet, exploit and policy listings used by many mail systems. | Read the exact response code first because SBL, CSS, XBL and PBL listings require different fixes. |
| SpamCop Blocking List | bl.spamcop.net | Recent spam sources based on user complaints, spam traps and automated reports. | Check recent outbound mail, compromised mailboxes and sudden volume spikes before waiting for expiry. |
| Barracuda Reputation Block List | b.barracudacentral.org | Email gateway reputation signals for abusive senders and suspicious traffic. | Use it as a receiver-facing deliverability warning and review sender identity plus complaint history. |
| SpamRATS / UCEPROTECT | all.spamrats.com / dnsbl-1.uceprotect.net | Sender setup problems, shared network abuse and direct-to-MX mail from risky ranges. | Check PTR, HELO, open relay exposure and whether the network owner must handle delisting. |
| Blocklist.de / PSBL | bl.blocklist.de / psbl.surriel.com | Compromised hosts, attack traffic, spam traps and abuse-feed evidence. | Look for malware, brute-force traffic, infected web apps or unauthorized outbound connections. |
| SORBS DNSBL legacy | dnsbl.sorbs.net | Legacy spam, open proxy, dynamic range and historical abuse signals. | Treat as supporting evidence and compare with current bounce text before prioritizing cleanup. |
Spamhaus ZEN response codes explained
Spamhaus is often the highest-impact result in a DNSBL report. Its returned 127.0.0.x code tells you whether the issue is abuse, malware, an exploit source or a policy range.
| Response code | Meaning | Next action |
|---|---|---|
| 127.0.0.2 | SBL listing: a verified spam source, spam service or related abuse infrastructure. | Stop the abusive traffic, secure the system and use the Spamhaus listing page for evidence and removal steps. |
| 127.0.0.3 | CSS listing: poor sending behavior, compromised mail source or suspicious outbound patterns. | Audit recent campaigns, authentication, bounce rates and compromised accounts before requesting removal. |
| 127.0.0.4 | XBL listing: infected host, botnet activity, open proxy or exploited system behavior. | Remove malware, patch exposed services and confirm outbound abuse has stopped before retesting. |
| 127.0.0.10 / 127.0.0.11 | PBL listing: policy range that normally should not send direct-to-MX email. | Use your ISP mail relay or an authenticated email provider instead of trying to delist a dynamic home IP. |
Match the blacklist cause to evidence and owner
A delisting request is stronger when it names the cause, shows what changed and reaches the party that controls the IP range or mail system.
| Likely cause | Evidence to check | Fix before delisting | Who usually acts |
|---|---|---|---|
| Compromised mailbox | SMTP logs, login history, unusual recipients and sudden send volume. | Reset passwords, revoke sessions, enable MFA and remove suspicious forwarding rules. | Mailbox admin or mail provider |
| Malware or botnet traffic | Endpoint alerts, outbound connections, IDS logs and repeated DNSBL codes. | Clean devices, patch services, block malicious egress and monitor for recurrence. | System owner or security team |
| Open relay or proxy | External relay tests, proxy scans, exposed SMTP or unauthenticated sending. | Close the relay, require authentication and restrict access to trusted networks. | Server administrator |
| Shared hosting abuse | Multiple customers on one outbound IP, provider abuse notices and mixed domains. | Ask the host to isolate the sender, move to a clean IP or remove the abusive tenant. | Hosting provider |
| Recycled IP history | Newly assigned ISP or VPS address with listings before your first send. | Open a provider ticket, request a clean address or wait after proving no new abuse. | ISP, VPS host or network owner |
| Dynamic or residential policy range | PBL-style result, residential reverse DNS or dynamic pool assignment. | Send through an authenticated relay instead of direct-to-MX from the home connection. | ISP or sender administrator |
Delisting checklist before you submit a removal request
Do these checks before asking a blacklist provider to remove the IP. Repeated requests without a fix can slow review or cause relisting.
Save the exact provider and code
Record the DNSBL name, response code, TXT record and timestamp so the provider can identify the listing you mean.
Stop the source of abuse
Patch the server, remove malware, close relays, rotate credentials and verify outbound traffic has returned to normal.
Repair mail identity
Confirm PTR, HELO, SPF, DKIM and DMARC align with the domain that sends mail from this IP.
Use the right requester
Some providers require the ISP, VPS host or network owner to request delisting because they control the address block.
Allow propagation time
After approval, many DNSBL updates appear within 24-72 hours. Retest from more than one resolver if results disagree.
Clean DNSBL result but email still fails?
A clean public DNSBL report only removes one class of risk. Mail can still bounce or land in spam because of identity, content, volume, private filtering or recipient policy.
Bounce messages often name the real reason: SPF fail, DMARC reject, throttling, content policy, reputation score or a private blocklist.
PTR, HELO, SPF, DKIM and DMARC should align. Missing or mismatched identity can hurt delivery even when DNSBLs are clean.
New IPs, sudden traffic spikes, high bounce rates and low engagement can trigger filtering without a public blacklist listing.
Gmail, Outlook, corporate gateways and regional providers may apply private scoring that does not appear in public DNSBL checks.
When not to use this checker
Use this tool for public IPv4 DNSBL evidence. Choose another diagnostic path when the question is about a domain, URL, IPv6 address, malware site or full sender reputation score.
This report does not score domains, URLs, brands or content. Use DNS and mail authentication checks for domain identity problems.
The current DNSBL workflow is built for reversed IPv4 lookups. IPv6 reputation needs provider-specific handling.
There is no single global IP reputation number. Each blacklist and recipient system has its own data and policy.
A blocked or error result is not a clean result. It means that provider could not be verified through this lookup path.
When a DNSBL lookup is the right check
Email deliverability triage
Check the outbound sending IP when messages bounce, land in spam or disappear without a clear SMTP error.
New server or IP handover
Test a VPS, dedicated server, static IP or new mail provider before moving production email onto it.
Incident response cleanup
After a compromise, verify whether the public IP was listed and track whether remediation changed the external signal.
ISP or host escalation
Use provider names and response codes when asking your ISP, host or mail service to investigate a bad address.
Privacy note
This checker sends only the submitted public IPv4 address to a stateless API route, performs DNSBL lookups and returns the current result. The app has no database and does not store reputation reports.