Email blacklist checker

Run an email blacklist check on a domain, an email address or a mail server’s IPv4 address. The checker above finds the servers that receive mail for the domain, asks five IP blacklists and one domain blacklist whether they list them, and shows for each list what it covers, the result and where to request removal. It runs in your browser over DNS-over-HTTPS. Spamhaus isn’t queried; the table links to its own lookup.

How the email blacklist check works

A DNS blacklist (DNSBL, also called a blocklist) is published as a DNS zone. To ask whether an IPv4 address is listed, a receiving server reverses its octets and looks up that name under the list’s zone. RFC 5782 gives the example: for 192.0.2.99 in bad.example.com, “the name of the DNS entry would be 99.2.0.192.bad.example.com”. On SpamCop’s list, the checker asks for the A record of the first name below; a domain list takes the domain in front of its zone, as in the second:

99.2.0.192.bl.spamcop.net
example.org.dbl.nordspam.com

An address in 127.0.0.0/8 as the answer means listed; the RFC says the value is “conventionally” 127.0.0.2. NXDOMAIN, a name that doesn’t exist, means not listed.

For a domain, the checker queries:

1. Mail servers: the MX hosts (up to five, by priority) and their IPv4 addresses.
2. Website: the domain’s own A record.
3. The domain itself on the domain list, plus the registered domain if you entered a subdomain.

Before it trusts a “not listed”, it asks every list for its test entry. RFC 5782 says IPv4 lists “MUST contain an entry for 127.0.0.2 for testing purposes” and domain lists an entry for the name TEST. If a list doesn’t answer its own test entry, it is refusing or filtering the resolver, and the result is “Could not check” rather than a false all-clear.

Swipe sideways to see the whole table →

MX servers receive mail; they don’t always send it. If your mail leaves through Google Workspace, Microsoft 365 or an email service, the sending IP belongs to that provider. Send yourself a message, find the sending IP in the headers with the email header analyzer and enter it here. A listing on a shared IP is for your provider to fix, so send them the result.

Which blacklists are checked

Swipe sideways to see the whole table →

SpamCop and NordSpam document 127.0.0.2 as their “listed” answer; PSBL, UCEPROTECT and 0spam answer their test entry with 127.0.0.2 too. The checker counts any answer in 127.0.0.0/8 as a listing and shows the code it got, except 127.0.0.1 and the 127.255.255.x refusal codes.

These lists were chosen because their published terms allow free DNS lookups without registering a resolver or using a key. “Anybody is free to use PSBL.” NordSpam may be used “free of charge for both commercial and non-commercial purposes” and asks to be contacted above 10,000 queries a day. 0spam is free for all uses, commercial included, up to 4,000 requests per 5 seconds. UCEPROTECT serves its lists over DNS and suggests rsync only for systems with more than 100,000 requests a day. SpamCop’s usage pages set no registration or volume limit and ask users who like the list for a donation. Even so, the checker caps itself at five checks a minute per visitor.

What each list means and how to delist

SpamCop

The SpamCop Blocking List (SCBL) has “IP addresses which have transmitted reported email to SpamCop users”. It lists only the machines that sent the mail; it “does not list websites or email addresses used to receive replies in reported email” (what the SCBL is). There is no removal request: “IPs are automatically delisted after 24 hours with no new spam reports” (dispute resolution), and the change can take up to four hours to reach SpamCop’s mirrors. SpamCop asks people not to write in for early delisting after a fix. It also “encourages SCBL users to tag and divert email, rather than block it outright”, so a listing doesn’t always mean rejection. Find out what was reported (a hacked mailbox, a script on a web server, a campaign to an old list), stop it and wait.

PSBL

An IP is listed “because it delivered an email to one of the spamtrap addresses that feed PSBL”. Most listed addresses are end-user machines infected with malware; a dynamic IP may have been used by someone else before. “Removal of IP addresses from the list can be done by anyone”: enter the IP on psbl.org, and PSBL says it “should be gone from the DNS servers within half an hour”. Without a request, entries expire automatically a few weeks after the trap hits stop. PSBL uses the DNSWL.org whitelist to keep known good mail servers off the list, so a mail server that keeps getting listed can apply there.

UCEPROTECT Level 1

Level 1 “lists single IP’s only”. An IP is listed automatically when it tries to deliver mail to UCEPROTECT’s spamtraps, breaks an SPF record by forwarding, or is involved in port scans or probes. Every Level 1 entry “expires automatically 7 days after the last spam email from it hits our SPAMTRAPS”. UCEPROTECT also offers paid express delisting per IP; it is optional, and once the cause is fixed, waiting costs nothing. Its Level 2 and Level 3 lists cover whole allocations and networks (ASNs), so an entry there can come from neighbors on your provider’s network. This checker doesn’t query them; ask your provider if their lookup page shows one.

NordSpam and NordSpam DBL

NordSpam tracks spam mainly aimed at Nordic and European countries and publishes an IP list and a domain list. Delisting is a “strictly manual procedure”: the IP block owner, or for a domain the domain’s own mail address, sends a plain-text request in English to the address on the delist page and explains what was done to stop the spam. Requests with a valid explanation are usually handled within 1 to 48 hours, and “all delistings from the reputation databases are free of charge”.

0spam

0spam lists IPs for mail sent to its spam traps, for messages “flagged several times by our network users as spam” and for mail its machine-learning filters classify as spam. To get off the main list, stop the source, create an account and submit a removal request that explains what you changed (instructions). Removal costs nothing: “DNSBL service and removals are 100% for free for all uses”.

Lists this checker doesn’t query

• Spamhaus. The free public mirrors are for “non-commercial use by small and medium sized organisations”, and queries must come from an identifiable network: a resolver on your own network or a public resolver that supports ECS (fair use policy). Through a public resolver, Spamhaus answers 127.255.255.254, “Query via public/open resolver/generic unattributable rDNS” (return codes), or NXDOMAIN, which looks exactly like “not listed”. Commercial use needs a paid subscription. Look up your IP and domain at check.spamhaus.org.
• SURBL. The free query service is for organizations with fewer than 1,000 users or 250,000 messages a day, and “does not include embedding our data in any way into products or services for which a fee is charged” (usage policy).
• URIBL. The public mirrors are meant for “low volume end users”; resolvers that send too many queries get 127.0.0.1 or NXDOMAIN back (about URIBL).
• SpamRATS. Queries need an API key, and the terms say “Do NOT use a free DNS service for queries” (terms).

The email spam checker runs a different test: send it a real message, and it checks the IP the message left from and the domains linked in it against blocklists.

Why you got listed

• Spamtrap hits. Traps are addresses that never signed up for anything. Mail to them usually means a list was bought, scraped or kept too long. The spam traps guide explains the types and how to avoid them.
• Spam reports. SpamCop listings come from recipients who reported the mail.
• A compromised machine or account. PSBL says most of its listings are infected end-user machines. A hacked mailbox or a stolen SMTP password produces the same pattern.
• Forwarding. UCEPROTECT lists IPs that forward mail in a way that breaks the original sender’s SPF record.
• Someone else’s mail. On a shared IP at a hosting company or email service, every customer’s mail counts. A dynamic or newly assigned IP may carry a listing from its previous user.

Fix the cause before you request removal, or the next trap hit lists you again:

1. Read the bounces. Rejections because of a listing usually come as 554 5.7.1 or 550 5.7.1 and name the list in the text after the code; the SMTP error codes reference explains the rest.
2. Find what sent the mail: check mail logs for unknown senders and volume spikes, change passwords, scan for malware.
3. Clean the list: remove addresses that bounce or never engaged, and verify old ones with the bulk email verifier before the next campaign.
4. Make sure SPF and DMARC pass with the SPF checker and the DMARC checker, then request delisting where a list needs a request.

Monitoring your domain and IP reputation

Public blacklists are only part of your reputation. Gmail, Microsoft and Yahoo keep their own data, and you see it only through their tools and your bounces:

emailvalidation.io doesn’t offer blacklist monitoring or alerts: this checker looks up the lists only when you run it. To keep an eye on your reputation:

• Run this check again after a fix, after moving to a new IP or email service, and whenever 5.7.x rejections rise. A link such as /tools/email-blacklist-checker/?domain=yourdomain.com runs the check straight away, so you can bookmark it.
• Google Postmaster Tools shows spam rate, reputation, authentication and delivery errors for mail to personal Gmail accounts, once you verify your domain with a TXT or CNAME record. Days with too little mail show no data (Postmaster Tools help).
• Your bounce logs show trouble first. A rising share of policy rejections points to reputation; a rising share of unknown users points to list decay and a higher email bounce rate.

The email deliverability guide covers the rest of the monitoring tools, including Microsoft SNDS and Yahoo’s complaint feedback loop.

Sources

Checked October 10, 2026: RFC 5782, DNS Blacklists and Whitelists; SpamCop: blocking list, how to use it, what the SCBL is, dispute resolution; PSBL: home, how to use, FAQ; UCEPROTECT: DNS usage, Level 1 policy, Level 1 removal, lookup; NordSpam: home, usage, delisting; 0spam: home, Q&A, removal; Spamhaus: fair use policy, return codes, public resolvers; SURBL usage policy; URIBL; SpamRATS terms; Google Postmaster Tools help.