How to check if your IP or domain is blacklisted (and read the answer)

A blocklist check is only useful if you check the right object. Three different things can be listed — the sending IP, the sending domain, and a domain that merely appears in your links — and they live on different kinds of list with different fixes. Before you open any checker, establish which IP actually sends your mail and which domains appear in a real message.

Find the object first

The sending IP is in the Received headers of a message you genuinely sent, not the IP of your laptop. Send yourself a message, view the original, and read the first Received header added by your own infrastructure:

Received: from mail.yourdomain.com (mail.yourdomain.com [203.0.113.9])
    by mx.example.net with ESMTPS id abc123

If you send through Google Workspace, Microsoft 365, SES, SendGrid, Mailgun or Postmark, that IP belongs to the provider. You cannot fix its reputation and you should not spend time on it — your exposure is domain-level.

The sending domain is the From domain, plus the Return-Path/envelope domain if it differs, plus any subdomain you send from. Each is evaluated separately: mail.yourdomain.com being clean says nothing about yourdomain.com.

Link domains are every domain a click can reach: landing pages, click-tracking hosts, unsubscribe hosts, CDNs, booking links, signature links.

Checking an IP

The direct way is a DNS query with the octets reversed, against the zone:

dig +short 9.113.0.203.zen.spamhaus.org        # Spamhaus combined IP zones
dig +short -t txt 9.113.0.203.zen.spamhaus.org # why, plus a reference URL
dig +short 9.113.0.203.b.barracudacentral.org
dig +short 9.113.0.203.bl.spamcop.net
dig +short 9.113.0.203.all.spamrats.com

An answer in 127.0.0.x means listed, and the last octet identifies the sub-list. No answer means not listed on that zone. The TXT record is where the reason lives, and it is the part checkers usually hide.

Two traps worth knowing:

• Public resolvers are blocked by some lists. Spamhaus refuses queries arriving from large public DNS resolvers and returns an error code in the 127.255.255.25x range. That means "query refused", not "listed". Query from your own resolver or use the web lookup.
• IPv6 queries use nibble format, not reversed octets, and many zones do not cover IPv6 at all.

For a map rather than a verdict, MultiRBL (multirbl.valli.org) queries over two hundred zones and checks forward-confirmed reverse DNS in the same pass. Read the result as "which of the lists that matter", not as a score.

Checking a domain

Domain lists take the domain itself, not reversed anything:

dig +short yourdomain.com.dbl.spamhaus.org
dig +short yourdomain.com.multi.surbl.org
dig +short yourdomain.com.multi.uribl.com

Check the From domain, every sending subdomain, your click-tracking host and your unsubscribe host. If you only check one domain, check the tracking host — shared tracking domains are the most common domain-level listing for senders on hosted platforms.

Reverse DNS, while you are here

Reverse DNS is not a blocklist, but a missing or mismatched PTR is why several lists have you, and why Gmail, Microsoft and Yahoo penalise you independently of any list.

dig +short -x 203.0.113.9          # should return mail.yourdomain.com.
dig +short mail.yourdomain.com     # should return 203.0.113.9

Both directions must agree — that is forward-confirmed reverse DNS. Also confirm your SMTP banner uses the same hostname, since a HELO that does not match the PTR is scored against you by common filters. PTR records are set by whoever owns the IP block, so the change happens at your host or ISP, never in your domain's DNS zone. A hostname containing the IP in digit form, or words like dhcp, pool or dsl, will get you listed on dynamic-range lists even when the record exists.

What not to do

• Do not check the IP your browser is using. Checkers default to it and it is almost never your mail server.
• Do not treat "listed on 3 of 212" as a problem. Identify the three. If none of them is a list receivers consult, you have a cosmetic result.
• Do not believe rows for dead lists. SORBS was shut down by Proofpoint on 5 June 2024 and still appears in checkers. Verify a list is live before acting on it.
• Do not check only on bad days. Listings appear and expire within hours. A monthly spot check will miss the incident that mattered.
• Do not stop at the blocklist. A clean check plus falling reply rates usually means an internal-reputation problem at a specific provider, which no lookup can show.

Make it continuous

Manual checks catch a problem when someone happens to look. Listings on report-driven lists often appear and expire inside a day, which means the check that finds them has to be scheduled, and it has to be paired with the thing a lookup cannot tell you: whether mail is landing.

MailPilot checks your sending domains and IPs against the lists receivers actually use, validates SPF, DKIM and DMARC, and measures per-provider inbox placement daily, so a listing arrives with evidence of whether it is costing you delivery.