How to check if an IP or domain is blacklisted
To check whether an IP address or domain is blacklisted, query it against the DNS-based blocklists (DNSBLs) that mail servers consult, which a blacklist check tool does against dozens of lists at once. A listing usually means mail from that address is being rejected or filtered, and the fix is to find what triggered it before requesting delisting.
What a DNS blacklist is
A DNSBL is a list of addresses published as DNS records. A receiving mail server takes the sending IP, reverses it, appends the blocklist's domain, and asks DNS whether a record exists. If it does, the sender is listed, and the answer usually encodes a reason code. The whole exchange takes a single DNS query, which is why the technique is used at all: it lets a mail server decide in milliseconds, before accepting a message.
The lists themselves are run by independent operators with different policies. Some list only addresses caught sending spam to a trap address. Some list entire ranges of consumer or dynamic IP addresses on principle, because legitimate mail should not originate there. Some list based on compromised machines, open relays or malware traffic. There is no central authority and no single list that matters everywhere, so "am I blacklisted" is really "am I on the lists my recipients use".
How to check
The easy way is a tool that queries many lists in one pass and shows which ones respond. Doing it by hand for a single list looks like this, with the IP octets reversed:
# checking 198.51.100.25 against a list at dnsbl.example.org
dig +short 25.100.51.198.dnsbl.example.org A
dig +short 25.100.51.198.dnsbl.example.org TXTAn empty answer means not listed. An A record, typically in the 127.0.0.x range, means listed, and the last octet is the operator's reason code. The TXT record usually carries a human-readable explanation and a link to the delisting page, which is the part you need.
Check the right address. For email, that is the public IP your mail server sends from, which is often not the same as your website's IP. Check every address you send from, including a backup MX and any transactional mail service you use on your own domain.
IP lists, domain lists and reputation systems
- IP blocklists list the sending address. This is the classic DNSBL and the one most likely to cause outright rejection.
- Domain blocklists (URIBLs) list domains that appear inside message bodies, not the sender. A domain can be listed because spammers advertise it in mail sent from someone else's machines entirely, which means you can be listed without ever sending the mail.
- Reputation systems run by large mailbox providers are not public lists at all. They score senders continuously on complaint rates, bounce rates and authentication, and they produce the version of this problem you cannot look up: mail is accepted and delivered to spam. No public lookup shows these, which is why "not on any blacklist" and "delivering to the inbox" are different statements.
Web reputation and malware lists are a fourth category. They affect browser warnings and search visibility rather than mail, and a site can appear on one after being compromised, long after the compromise has been cleaned up.
What to do when you are listed
- Read the reason first. The TXT record or the list's website says why. Requesting delisting without fixing the cause gets you relisted, often with a longer penalty.
- Find what is sending. Check mail server logs for volume spikes and for messages you did not send. The usual causes are a compromised mailbox account, a vulnerable contact form or CMS being used as a relay, a misconfigured open relay, or a machine on your network infected and sending directly.
- Stop it, then verify. Change the compromised credentials, patch or disable the form, close the relay, remove the infection. Confirm the outbound volume is back to normal before doing anything else.
- Fix the authentication basics. Valid SPF, DKIM signing, a DMARC record, matching forward and reverse DNS for the sending IP, and a hostname in the HELO that resolves. Several lists will not delist a host that fails these, and reputation systems weigh them heavily.
- Request delisting. Use the operator's own form. Most have a self-service removal for a first listing; some remove automatically after a quiet period. Be specific about what was wrong and what you changed.
- Watch for the relisting window. Repeat listings escalate. Recheck after a few days and again after a couple of weeks.
If the listing is on a range rather than your single address, the fix is not yours to make. Contact your hosting provider, because the entire block is affected. If your IP was recently reassigned to you, the listing may belong to whoever had it before, and delisting requests explaining that are usually accepted.
Catching a listing while the cause is still in the logs
Blacklisting is one of the failures nobody notices in time. Nothing on your server breaks. Mail simply stops arriving, and the first signal is often a customer saying they never got the message, days later. Scheduled blacklist monitoring rechecks your addresses against the lists on an interval and alerts on a new listing, so you find out while the cause is still traceable in the logs rather than weeks after. DNS blacklist monitoring runs those checks continuously, the blacklist check tool runs a one-off scan, and how to find who hosts a website shows how to get the abuse contact for the network involved.