Blacklist Checker

Check whether an IPv4 address — or the first A record of a domain — is listed on five widely-used DNSBLs: Spamhaus ZEN, SpamCop, Barracuda BRBL, CBL and SORBS. Bulk mode handles up to 100 targets in one pass.

Free to use, no signup. On the next page you confirm before we run the check.

What this check returns

Target: The IP address or hostname you submitted.
IP: The resolved IPv4 address that was actually checked.
Listed: Whether the address appears on any blacklist.
Lists: Which specific blacklists the address was found on.
Verdict: Plain-language summary of the check result.

IP & domain blacklist (DNSBL) checker

Find out whether an IP address — or the A record of a domain — is currently listed on the major IP-based DNSBLs that email providers query when deciding whether to deliver, quarantine or reject a message. Submit up to 100 targets in one bulk check; the result table tells you exactly which lists, if any, have you on them.

What is a DNSBL?

A DNSBL (DNS-based blackhole list, sometimes RBL — Realtime Blackhole List) is a list of IP addresses with a track record of sending spam, malware, phishing or other abuse. The list is published over DNS: looking up {reversed-ip}.{zone} returns an A record if the IP is listed and an NXDOMAIN if it isn't. That makes it trivial for mail servers to consult dozens of lists per inbound message — which they do.

Which DNSBLs do we query?

This tool queries five widely-used IP-based DNSBLs per target. We do not query URI/domain-based lists such as SURBL or URIBL — those serve a different purpose (URL reputation inside message bodies) and would inflate the result table with apples-and-oranges hits.

zen.spamhaus.org: Spamhaus ZEN — the umbrella zone that combines SBL (known spam operations), XBL (compromised / hijacked hosts) and PBL (addresses that shouldn't be sending email directly). One of the most influential lists in the world; a ZEN listing affects delivery to almost every major mailbox provider.
bl.spamcop.net: SpamCop — community-reported spam sources. Listings expire automatically once reports stop arriving, but they bite while active.
b.barracudacentral.org: Barracuda Reputation Block List (BRBL) — aggregated reputation data from Barracuda's email security appliances. Influential anywhere Barracuda is in the inbound path.
cbl.abuseat.org: CBL — the Composite Blocking List, focused on machines participating in spam-spewing botnets and trojans. Functionally part of Spamhaus XBL today.
dnsbl.sorbs.net: SORBS — Spam and Open Relay Blocking System. Covers open relays, hijacked nets and known spam sources. Known for an aggressive listing policy.

What this tool returns

Target: The IP or hostname you submitted, verbatim.
IP: The IPv4 address actually checked. For a hostname this is the first A record returned by the resolver. IPv6 isn't covered — DNSBL coverage of v6 space is thin anyway.
Listed: YES when the IP appears on any of the five DNSBLs, no when it doesn't.
Lists: Comma-separated list of the specific DNSBL zones that returned a hit, or — when none did. We don't surface the per-zone return code, only the listing fact.
Verdict: Plain-language summary — clean or on N list(s).

Why monitor DNSBLs?

Email deliverability

A single Spamhaus ZEN listing can drop your delivery rate to most inboxes overnight. The earlier you spot it, the shorter the period your legitimate mail is being blocked or sent to spam folders.

Sender reputation

Reputation persists after delisting. Each listing makes future delistings harder and lengthens the path back to "trusted sender" with the big mailbox providers.

Compromise detection

An unexpected listing is often the first sign of a compromised account or a malware-infected host inside the network. The blacklist tells you something is sending; the log files tell you what.

Shared-IP hygiene

On shared sending IPs, your neighbours can drag the reputation down with you. Bulk-check the whole pool regularly and you'll know which IPs to stop using.

How an IP ends up listed

Sending real spam (purchased lists, scraped addresses, no opt-in).
A compromised mailbox / SMTP credentials being abused.
A malware infection turning a server into a relay.
An open relay / mis-secured submission port.
Poor list hygiene — bounces and complaints over thresholds.
Sudden volume changes on a non-warmed IP.
Missing or broken SPF / DKIM / DMARC raising the spam-score floor.
On a shared IP, somebody else's behaviour — not yours.

How to get delisted

Find the cause. Don't request delisting until you know why the listing happened — the operator will relist immediately if the behaviour continues.
Fix the underlying issue. Rotate compromised credentials, clean malware, secure the relay, prune the list.
Use the operator's delisting page. Each DNSBL publishes its own delisting procedure (Spamhaus, SpamCop and Barracuda all have self-service forms). Follow theirs, not generic advice.
Provide evidence when asked. Logs showing the compromise was closed, policy changes, explanations of what changed. Operators delist when they believe the problem is resolved.
Monitor afterwards. Re-run this tool periodically. A repeat listing within days is treated much more harshly than a fresh one.

Preventing future listings

Implement and maintain SPF, DKIM and DMARC — see the deliverability check.
Only send to opted-in addresses; honour unsubscribes immediately.
Warm new IPs gradually — don't start at full volume.
Watch bounce and complaint rates as leading indicators of trouble.
Secure the sending infrastructure: 2FA on accounts, current patches, no open relay.
Process feedback loops from major mailbox providers.
Re-check blacklist status regularly with this tool.

Bulk mode

Drop up to 100 IPs or hostnames in the textarea, one per line. Each row is checked against all five DNSBLs and the result lands in a single comparison table you can scroll and export as CSV / JSON / YAML / XML. Useful for agencies managing many clients, ESPs auditing their whole IP pool, and post-incident sweeps.

Limitations

Only IPv4 is checked; DNSBL coverage of IPv6 is sparse.
Only the first A record is checked when you submit a hostname — round-robin/load-balanced pools need each IP submitted explicitly.
We query five DNSBLs, not "dozens". The set is curated for relevance — Spamhaus, SpamCop, Barracuda, CBL and SORBS — rather than long-tail.
URI/domain-based lists (SURBL, URIBL) are not checked here — they classify URLs in message bodies, not sending IPs.
A "not listed" result is a snapshot, not a guarantee — providers also apply their own reputation systems that don't show up in DNSBLs.

Related tools

Pair this with the email deliverability check (MX / SPF / DMARC), DNS records lookup for the underlying records, WHOIS & RDAP lookup for registrar & abuse contact, and domain & IP lookup for GeoIP / ISP / ASN on the IPs you're checking.

Get started

Paste an IP, a hostname, or up to 100 of either in the form above. Single submissions render as a detail card; bulk submissions as a side-by-side table you can export. No signup required.