---
title: Is my IP blacklisted? How to check a mail server with the Blacklist Check
description: Your mail bounces with "blocked using Spamhaus" or quietly lands in spam, and you suspect a blocklist. To check if your IP is blacklisted, look up your sending server's address on the DNS blocklists receivers use. Here's how to do it with the free Blacklist Check, what a clean, listed or refused answer means, and how to get delisted.
canonical: https://watchfor.io/blog/how-to-check-if-your-ip-is-blacklisted
---

# Is my IP blacklisted? How to check a mail server with the Blacklist Check

2026-10-04 · WatchFor Team · Guides · guides, email, deliverability

Your mail bounces with "blocked using Spamhaus" or quietly lands in spam, and you suspect a blocklist. To check if your IP is blacklisted, look up your sending server's address on the DNS blocklists receivers use. Here's how to do it with the free Blacklist Check, what a clean, listed or refused answer means, and how to get delisted.

To check if your IP is blacklisted, look up the address your mail server
sends from on the DNS-based blocklists (DNSBLs, also called RBLs) that
receiving servers consult before accepting mail. Each list answers one
question: is this IPv4 address listed or not? A listing on a major list such
as Spamhaus explains bounces like `554 5.7.1 ... blocked using
zen.spamhaus.org`. A clean result means you should look elsewhere,
usually at SPF, DKIM and DMARC.

The free [Blacklist Check](/blacklist-checker) queries the blocklists from a
WatchFor server whose DNS resolver the lists accept, and shows each list's
verdict side by side. No signup.

## What this tool answers

*Is this mail server's address on a blocklist right now?* Reach for it when a
bounce message names a blocklist, when delivery to one provider suddenly
drops, after you get a new server or IP from a cloud provider (recycled
addresses can carry an earlier tenant's history), or after a compromised
account sent spam from your network.

## A real example

### Checking if a mail server's IP is blacklisted after a bounce

Typical report: a customer forwards a bounce that says your message was
"blocked using" a list, and someone has to answer whether the server is
really listed and on which list. The important detail is *which* address to
check: the server that sends the mail, not your website.

To show the workflow on a neutral target we used one of Wikimedia's mail
servers. In the [Blacklist Check](/blacklist-checker) we entered the host
name `mx-in1001.wikimedia.org` and pressed **Check blacklists**:

![The Blacklist Check for mx-in1001.wikimedia.org: 0 of 4 lists checked report a listing, chip "4 clean", and dnsbl.sorbs.net 86 ms, bl.spamcop.net 135 ms, zen.spamhaus.org 237 ms and b.barracudacentral.org 411 ms all marked CLEAN](/blog/how-to-check-if-your-ip-is-blacklisted-result.webp)

The tool resolved the name to its IPv4 address (208.80.155.102; `dig -x`
confirms it maps back to `mx-in1001.wikimedia.org`) and asked four lists in
parallel. All four answered within 411 ms, and the summary reads **0 / 4**
with **4 clean**.

Read that carefully. Three of the answers carry weight:

| List | Answer | Weight |
| --- | --- | --- |
| zen.spamhaus.org | clean, 237 ms | The most widely used list. Combines Spamhaus SBL, XBL and PBL. |
| b.barracudacentral.org | clean, 411 ms | Used by Barracuda appliances and many corporate filters. |
| bl.spamcop.net | clean, 135 ms | Built from user spam reports; listings expire on their own. |
| dnsbl.sorbs.net | clean, 86 ms | **Shut down in June 2024.** Its domain no longer exists, so every lookup comes back "not found", which reads as clean. Ignore it. |

**The answer:** the server is not listed on Spamhaus, Barracuda or SpamCop,
so a blocklist is not why its mail would bounce. In that situation, read the
bounce again: a rejection that names your domain rather than an IP usually
means an authentication or DMARC failure, which the
[email authentication check](/email-policy-checker) diagnoses.

## How to read the results

| What you see | What it means |
| --- | --- |
| **0 / 4 lists checked** (green) | No list returned a listing. The number before the slash is the count of listings. |
| **N listings** (red) | At least one list has the address. The red row names the list. |
| **N clean** chip | Lists that answered "not listed" (an `NXDOMAIN` reply). |
| **N errored** chip (amber) | Lists that timed out, refused the query or failed. An error is not a listing; it means that list gave no answer. Re-run later. |
| **CLEAN / LISTED / TIMEOUT / REFUSED / ERROR** | The per-list verdict. **REFUSED** appears when a list blocks the resolver, with a hint; Spamhaus does this with the code `127.255.255.254`. |
| **ms** | How long that list took to answer. It doesn't affect the verdict. |
| **Target** | What was checked. A host name is resolved and its **first IPv4 address** is checked. IPv6 addresses and domain-based lists (such as the Spamhaus DBL) aren't covered. |

## More ways to use it

- **Before you send from a new server.** Check the IP the moment you get it,
  before it carries real mail. A listed address from a cloud provider is
  easier to swap than to clean.
- **After a compromised mailbox.** Once the password is reset and the queue
  is drained, check the outbound IP. SpamCop listings drop off on their own
  once reports stop; Spamhaus and Barracuda need the cause fixed first.
- **When a whole provider rejects you.** If only Microsoft or only Gmail
  bounces, and every list here is clean, the problem is that provider's own
  reputation system. Look at their postmaster tools rather than DNSBLs.
- **Checking a vendor's sending IP.** If invoices sent by your billing tool
  bounce, look at the IP in the bounce's `Received` header, not yours.

## Tips and gotchas

- **Check the sending IP, not your domain.** Typing `example.com` checks the
  address your *website* resolves to. Use the host name of the server that
  sends the mail, or the IP from the `Received:` header of a delivered
  message. The [email header guide](/blog/how-to-read-email-headers) shows
  where to find it.
- **Public resolvers get refused.** Spamhaus answers
  `127.255.255.254` ("query via public resolver") to lookups through
  `1.1.1.1` or `8.8.8.8`. A script that treats any `127.x` answer as a
  listing gets that wrong. The checker uses its own resolver, so its answers
  are real verdicts.
- **If you're listed, fix the cause, then ask for removal.** For Spamhaus,
  look the IP up at [check.spamhaus.org](https://check.spamhaus.org/), which
  names the listing (SBL spam source, XBL infected host, PBL "this range
  shouldn't send mail directly") and the removal path. A PBL listing on a
  home or dynamic IP means: send through your provider's relay instead.
  Barracuda has a removal request form; SpamCop delists automatically once
  reports stop.
- **Clean everywhere, still in spam?** Blocklists are one input. Missing
  DKIM, `p=none` DMARC and low sender reputation weigh as much. The
  [blacklist explainer](/blog/email-blacklists-rbl) and
  [why emails go to spam](/blog/why-emails-go-to-spam) cover the rest.

## Check it from the command line too

A DNSBL lookup is an ordinary DNS query: reverse the IP's four octets and
append the list's zone. An answer in `127.0.0.x` means listed; `NXDOMAIN`
means not listed:

```bash
dig +short -x 208.80.155.102
dig +noall +answer +comments @1.1.1.1 102.155.80.208.bl.spamcop.net A | grep status
```

```text
mx-in1001.wikimedia.org.
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 24011
```

By convention (RFC 5782) every list keeps a test entry, `127.0.0.2`, that is
always listed. Use it to see what a listing looks like; the TXT record
carries the reason:

```bash
dig +short @1.1.1.1 2.0.0.127.bl.spamcop.net A
dig +short @1.1.1.1 2.0.0.127.bl.spamcop.net TXT
```

```text
127.0.0.2
"Blocked - see https://www.spamcop.net/bl.shtml?127.0.0.2"
```

And here is the public-resolver trap. Asking Spamhaus through Cloudflare's
resolver returns a code, not a verdict:

```bash
dig +short @1.1.1.1 102.155.80.208.zen.spamhaus.org A
```

```text
127.255.255.254
```

That is Spamhaus refusing the query. Run the same lookup through your own
resolver, or use the checker.

## Keep watching it

A listing usually appears without warning, and you hear about it from
bounces days later. A [blacklist monitor](/blacklist-monitoring) checks your
mail server's IP on a schedule and opens an incident with **Listed on Any
RBL** the moment a list adds it. You can replace the built-in list with the
zones that matter to you, and point it at a dedicated resolver if a list
rate-limits shared ones.

## FAQ

**How do I know if my IP is blacklisted?**
Look up your sending server's IPv4 address on the major DNSBLs, at least
Spamhaus ZEN, Barracuda and SpamCop. Bounce messages that say "blocked
using" or "listed at" followed by a list name are the other giveaway.

**How long does it take to get removed from a blacklist?**
It depends on the list. SpamCop listings expire automatically once spam
reports stop. Spamhaus and Barracuda review removal requests, and they
expect the cause (an infected host, an open relay, a spamming account) to be
fixed first, or the listing comes back.

**Can a domain be blacklisted, not just an IP?**
Yes. Domain blocklists such as the Spamhaus DBL list domains that appear in
spam, for example in links. This tool checks IP lists only; for how SPF,
DKIM and DMARC protect your domain, see
[SPF, DKIM and DMARC explained](/blog/spf-dkim-dmarc-explained).

---

Canonical page: https://watchfor.io/blog/how-to-check-if-your-ip-is-blacklisted · All articles: https://watchfor.io/blog/all.md · Site guide: https://watchfor.io/llms.txt