About DNS blacklists
DNSBLs are DNS zones that answer for IPs known to send spam. Receivers query them at connection time; a listing means rejected or spam-foldered mail. We check Spamhaus ZEN, SpamCop, Barracuda, PSBL and UCEPROTECT Level 1, for IPv4 addresses. For a domain we check up to six IPv4 addresses from its A records and its MX hosts. Note: Spamhaus refuses queries from some public resolvers; those show as clean rather than listed.
Stopping the cause
Listings often start with a compromised mailbox or a script sending spam through your own servers. Outbound email filtering holds that mail before it leaves; it is in early access.
Blacklist check: questions
Why is my IP on a blacklist?+
Because the list saw spam or abuse from that address, or lists its whole range by policy. Common causes are a compromised account or server, an open relay, a shared IP that another customer abused, or an address in a residential or dynamic range, which Spamhaus lists in its PBL because such ranges should not send mail directly, not as evidence of spam.
How do I get my IP removed from a blacklist?+
Fix the cause first, then follow the removal process on the list's own website. Some lists expire a listing automatically once the spam stops, others need a request, and a request made before the cause is fixed usually ends in a quick relisting. EmailSecOps monitoring re-checks a domain's IPs at least once a day and alerts you to a new listing.
Which blacklists does this check cover?+
Five DNS blacklists: Spamhaus ZEN, SpamCop, Barracuda, PSBL and UCEPROTECT Level 1. Enter an IPv4 address, or a domain to check up to six IPv4 addresses from its A records and its MX hosts. IPv6 addresses and domain-based lists, such as URI blocklists, are not checked.
Why does this check show clean when another tool shows listed?+
Most often because Spamhaus refuses queries that reach it through large public DNS resolvers, and this check reports a refused query as clean rather than listed. Other tools may also query different lists or UCEPROTECT levels, or the listing may have changed between the two lookups. Spamhaus's own lookup page gives the definitive answer for its lists.
What is Spamhaus ZEN?+
Spamhaus's combined IP blocklist: one DNS query covers the SBL (known spam sources), the CSS (low-reputation sending IPs, part of the SBL), the XBL (hijacked and infected machines) and the PBL (ranges that should not send mail directly). The answer code shows which list matched, for example 127.0.0.2 for the SBL and 127.0.0.10 or 127.0.0.11 for the PBL.