IP Blacklist Check

IP Blacklist Check

Enter an IP address or a hostname in IP address or hostname and click Check. IPv4 addresses are checked against 42 blocklists. IPv6 addresses are checked against the 11 of those that accept IPv6 lookups.

You can paste what you have without tidying it first: a URL like https://203.0.113.7/login or an address with a port like 203.0.113.7:25. A range is accepted too, but only the address written before the slash is checked: 203.0.113.15/24 checks 203.0.113.15, and 203.0.113.0/24 checks 203.0.113.0, not the other 255 addresses in the block. For a hostname such as mail.example.com, every address it points to is checked, IPv4 and IPv6, each with its own report.

Stop cancels a check that’s still running, and Clear starts over.

Example: 8.8.8.8

8.8.8.8 is Google’s public DNS server. The report says it isn’t on any blocklist:

• reverse DNS: dns.google (points back to this address) shows the name the address carries, and confirms that the name leads back to the same address. More on why that matters below.
• listed on 0 of 42.
• Could not check: three lists (Hostkarma, s5h.net and DrMX) didn’t answer in time. Their rows say so instead of counting them as listings. A second run usually fills them in.
• Not listed on the other 39, from Spamhaus ZEN and SpamCop down to the Tor exit node list.

How a blocklist lookup works

Blocklists answer through DNS, the same system that turns names into addresses. To check 203.0.113.7 on Spamhaus ZEN, the tool reverses the address and asks for the name 7.113.0.203.zen.spamhaus.org:

• No such name means the address isn’t listed.
• An answer like 127.0.0.2 means it is, and the last number says why. Each list has its own codes. The report translates them into words and also shows the raw code, along with a link to that list’s lookup or delisting page.

IPv6 addresses are looked up the same way, with all 32 hex digits written out in reverse. Only some lists support that, which is why IPv6 is checked against 11 lists rather than 42.

A list can also fail to answer: it might be slow, return a DNS error, or refuse the query. Spamhaus, for example, refuses lookups made through big public DNS resolvers. That’s why the report keeps Could not check separate from Listed. A failed lookup tells you nothing about the address.

Reverse DNS and “points back”

Every IP can carry a name, set by whoever owns the address. It’s called reverse DNS, or a PTR record. The report shows it and checks one more thing: whether that name, looked up normally, leads back to the same address. When it does, the report says points back to this address. This is called forward-confirmed reverse DNS.

For a mail server, this is often as important as the blocklists. Google’s sender guidelines require valid forward and reverse DNS, and many other receivers reject mail from addresses without it. Look out for:

• No reverse DNS at all. Common on fresh servers, and often enough on its own to get mail refused.
• A generic name like 203-0-113-7.dynamic.isp.example. Filters read it as a home connection.
• A name that doesn’t point back. The PTR says mail.example.com, but mail.example.com points somewhere else.

The PTR record is set by the owner of the IP address, not in your domain’s DNS. For a server, that means your hosting provider’s control panel or a support request. IP to Hostname shows reverse DNS on its own.

Not every list is about email

Some of the 42 lists track things other than spam, so a listing doesn’t always mean an address sent junk mail:

• Spamhaus ZEN combines several lists: known spam sources, machines infected with malware, and home and mobile ranges that shouldn’t send mail directly (the PBL). The code tells you which one applies.
• DroneBL lists hacked machines and open proxies. It’s used mostly by chat networks and forums, not mail servers.
• Tor exit nodes is just what it says. Websites use it to block or challenge Tor traffic, and a listing isn’t a judgment of the address.
• Backscatterer lists servers that send bounce messages to forged senders, a side effect of how a mail server is configured rather than of spam it sent.
• UCEPROTECT levels 2 and 3 list whole blocks of addresses or entire networks because of their neighbours. The report shows these separately from listings of the address itself, because fixing your own server won’t clear them.

When to check an IP

• Before you use a new server. VPS and dedicated server IPs are reused, so check the one you’ve been given before you set up mail on it. If the previous tenant left it listed, it’s easier to ask for a different address than to clear someone else’s history.
• When your mail is being refused. Check the IP your mail actually leaves from. You’ll find it in the Received: lines of a message you sent. To check a whole domain and its mail servers at once, use the Email Blacklist Check, which also covers domain blocklists.
• When an address shows up in your logs. Check where spam comments, login attempts or form abuse are coming from. A listing on DroneBL or the Tor list explains a lot. ASN Lookup shows which network the address belongs to.
• For your own connection. Get your address from What’s My IP. A PBL listing there is normal for home internet.

If the address is listed

Read the explanation first: it tells you whether the list judged this address or its neighbourhood, and why. For a listing of the address itself:

1. Find and fix the cause. Typical causes are a hacked account sending mail, malware, or an abused form.
2. Use the link in the listing’s row to request removal. Many lists also expire listings on their own once the problem stops.
3. Check again to confirm.

On a home connection with a changing IP, a listing may belong to whoever had the address before you. Restarting the router often gets you a new one.

FAQ

My IP is listed, but I don’t run a mail server. Why?

Most likely it’s on the PBL, which covers home and mobile connections in general, or it’s a Tor exit or a shared address. If the listing is for spam or malware (Spamhaus’s infected-machine list, for instance), a device on your network may be compromised. That’s worth checking even if mail isn’t your concern.

Does checking an address notify its owner?

No. The checks are DNS queries from our server to the blocklists, and the address itself is never contacted.

Can I check a whole range at once?

No. Only the address before the slash is checked. To check other addresses in the range, enter them one at a time. If you’re seeing listings that cover a whole block, look at the UCEPROTECT level 2 row: that list judges the block, not the single address.

What about domain blocklists?

They’re a separate kind of list and need a domain rather than an address. The Email Blacklist Check checks a domain against 15 of them, along with all its mail servers.

How do I find the IP behind a hostname?

Enter the hostname here and all its addresses are checked. To just see the addresses, use Hostname to IP.