IP Blacklist Checker

Server assisted New Internet Security & Privacy

Enter the public address your mail server or website sends from, and the Mutqan server asks each DNS-based blocklist (DNSBL) about it by querying the reversed address in the list's zone through public DNS-over-HTTPS resolvers. Every list is reported on its own — listed, not listed, refused the query, failed, or not checked — and a list that gave no usable answer is never counted as clean.

Privacy: The domain, address or URL you enter is sent from the Mutqan server to the public data service named on this page (a registry, a resolver, a certificate log or a measurement network). Nothing is stored.

What is a DNS blocklist and how is an IP address checked against it?

A DNS blocklist (DNSBL) is a list of IP addresses, usually of spam sources or compromised hosts, published as a DNS zone so that any mail server can query it cheaply. The address is reversed and looked up under the list's zone (1.2.3.4 becomes 4.3.2.1.zone): NXDOMAIN means not listed, and an answer inside 127.0.0.0/8 means listed, with the last octet encoding the reason (RFC 5782). Lists can also refuse a query with special codes, which says nothing about the address.

How to use IP Blacklist Checker

  1. Enter the public IPv4 or IPv6 address to check — for a mail server, the address it sends mail from.
  2. Press Check blocklists. The lists are asked at the same time and usually answer within a few seconds.
  3. Read the Result column row by row: only "Listed" and "Not listed" are answers about the address.
  4. If the address is listed, fix the cause first, then use that list's own removal process.

IP Blacklist Checker features

  • Queries SpamCop, PSBL, UCEPROTECT Level 1 and the Barracuda Reputation Block List without a key, plus Spamhaus ZEN when a Data Query Service key is configured on the server
  • IPv4 and IPv6 addresses, reversed for the query as RFC 5782 describes (nibble by nibble for IPv6)
  • Keeps listed, not listed, refused, failed and not-checked apart — a list that gave no usable answer is never counted as clean
  • Shows each list's return code and its own reason text when the list publishes one
  • Recognises the lists' error answers (127.255.255.x, 127.0.0.1) so a refusal is not mistaken for a listing
  • Refuses private, reserved and documentation ranges with an explanation, and accepts the 127.0.0.2 test entry

Inputs and outputs

Inputs

  • IP address — one public IPv4 or IPv6 address, without a port or a prefix length.
  • 127.0.0.2 — the test entry every list carries, to see what a listing looks like.

Outputs

  • Summary — how many lists list the address, how many answered, how many gave no usable answer and how many were not checked.
  • Blocklists — one row per list: name, zone, result, return code and the list's own reason text.
  • Query details — the address, its version, the reversed form used in the queries and the resolvers that carried them.
  • What this means — the result in plain words, with what to do next.

IP Blacklist Checker example

The lists' own test address

Input:

127.0.0.2

Output:

Listed on: 4 · Lists that answered: 4 · No usable answer: 0 · Not checked: 1
SpamCop Blocking List — bl.spamcop.net — Listed — 127.0.0.2
Passive Spam Block List — psbl.surriel.com — Listed — 127.0.0.2
UCEPROTECT Level 1 — dnsbl-1.uceprotect.net — Listed — 127.0.0.2
Barracuda Reputation Block List — b.barracudacentral.org — Listed — 127.0.0.2
Spamhaus ZEN — zen.spamhaus.org — Not checked — needs a key on the server
This is the test address every list lists on purpose (RFC 5782): a "Listed" result here shows the lists answering, not a problem.

How to read the IP Blacklist Checker results

Listed — the list holds an entry for the address, so servers that use that list may reject or junk mail from it. The return code and reason say why; for Spamhaus ZEN, SBL means a spam source, XBL a compromised host and PBL an end-user range not meant to send mail directly.

Not listed — that list answered and had no entry for the address at the moment of the check.

Refused the query or Lookup failed — no information about the address: neither listed nor clean. Run the check again later.

Not checked — needs a key: Spamhaus ZEN is asked only when the server holds a Data Query Service key; without it the result says nothing about Spamhaus.

A PBL listing is a policy, not an accusation: providers list their home and mobile ranges so that only their mail servers send mail directly.

When to use IP Blacklist Checker

  • Mail from your server suddenly bounces or lands in spam and you want to know whether its sending address is blocklisted.
  • Before moving mail to a new VPS or cloud address, checking that the address you were given carries no listing.
  • After cleaning up a compromised mailbox or device, confirming whether the lists still hold the address.
  • Looking up the sending address that appears in the headers of a suspicious message.

Troubleshooting

  • "This is not a public address" — private (10.x, 172.16–31.x, 192.168.x), loopback, CGNAT and documentation addresses are never listed. Look up your public sending address instead.
  • Every list shows "Lookup failed" — the resolvers or the lists did not answer in time. Wait a minute and check again.
  • A rate-limit message — the checks allowed per minute for your connection are used up. Wait, then run it again.
  • A provider says your address is listed but this page shows no listing — it may use a list not checked here (Spamhaus ZEN without a key, for example) or its own reputation data.

Frequently asked questions about IP Blacklist Checker

Which blocklists are checked?

SpamCop, PSBL (Passive Spam Block List), UCEPROTECT Level 1 and the Barracuda Reputation Block List are queried without a key. Spamhaus ZEN is queried only when a Spamhaus Data Query Service key is configured on the server; otherwise it is shown as "Not checked — needs a key". SORBS shut down in June 2024 and is not queried; SURBL and URIBL list domains rather than addresses and need an agreement, so they are not queried either.

Does "not listed" mean my IP address is clean?

It means only that the lists which answered had no entry for the address at that moment. Lists that refused the query, failed or were not checked are shown separately and never count as clean. Other blocklists exist, and mailbox providers such as Gmail and Outlook also rely on their own reputation data that no public lookup can see.

Why does a list show "refused the query"?

Some lists refuse queries that arrive through large public resolvers or exceed a volume limit, and answer with a special error code (such as 127.255.255.254 or 127.0.0.1) instead of a listing. That answer says nothing about your address, so it is shown as refused — neither listed nor clean.

My address is listed. How do I get it removed?

Fix the cause first — a compromised mailbox or device, an open relay, an unprotected web form that sends mail — or the listing will return. Then follow the list's own removal process on its website; some lists, such as SpamCop, drop entries on their own once the reports stop.

Why is 127.0.0.2 listed everywhere?

It is the test entry every IPv4 DNS blocklist must contain (RFC 5782, section 5). Checking it shows what a listing looks like and proves the lists are answering; it says nothing about any real address.

Can I check a private address such as 192.168.1.10?

No. Blocklists only record public addresses, so the tool refuses private, loopback, link-local, reserved and documentation ranges. Look up the public address your server sends mail from — for a mail server, the address in the Received header of a message it sent.

Technical notes

A DNS blocklist is queried with ordinary DNS (RFC 5782): the address is reversed — 203.0.113.25 becomes 25.113.0.203 — and looked up as an A record under the list's zone. NXDOMAIN means not listed; an answer inside 127.0.0.0/8 means listed, and its last octets encode the reason. An IPv6 address is reversed nibble by nibble into 32 labels.

Some answers inside 127.0.0.0/8 are errors, not listings: Spamhaus returns 127.255.255.254 to queries that arrive through public resolvers and 127.255.255.255 for excessive volume, and some lists answer 127.0.0.1 when they refuse a resolver (RFC 5782 forbids listing 127.0.0.1). These are reported as "refused the query".

The queries leave the Cloudflare edge through Google Public DNS over HTTPS, with Cloudflare 1.1.1.1 as the second try. When a list answers "listed", its TXT record is read for the reason text. RFC 6471 describes the operational practices expected of list operators, including how listings and removals should work.

Limitations and methodology

Five address lists are covered — four without a key and Spamhaus ZEN with one. Many smaller lists exist, and the large mailbox providers use private reputation systems no lookup can see.

Domain lists (SURBL, URIBL, Spamhaus DBL) are not queried, so a listed domain in your messages is not detected here.

The result is a snapshot taken from the Cloudflare edge through public resolvers. A list may update minutes later, and may answer a public resolver differently from a mail server that subscribes to its data.

Security and privacy

The address you enter is sent from the Mutqan server to Google Public DNS (or Cloudflare 1.1.1.1) as DNS queries under each list's zone, so the list operators see a query for that address arriving from a public resolver. Nothing is stored.

References