IP Blacklisted? How to Check and Get Delisted

If your IP address is blacklisted, mail servers that consult DNS-based blocklists (DNSBLs) will reject or junk your email. To get delisted, find out which list has you and why, fix the underlying cause, and only then request removal. Many lists also expire entries on their own once the problem stops.

Blocklists are run by independent organisations, each with its own criteria and removal process. This guide explains how they work, which ones matter most, and a fix-then-delist workflow that keeps you from being listed again a week later.

How DNS blocklists work

A DNSBL is a DNS zone that publishes listed IP addresses. Receiving mail servers check the connecting IP by turning it into a DNS name: they reverse the four octets and append the list's zone. To check 192.0.2.25 against a list at zen.spamhaus.org, a server looks up:

25.2.0.192.zen.spamhaus.org.  IN  A

There are two possible results:

• NXDOMAIN (no such name) means the IP is not listed.
• An A record in 127.0.0.0/8, such as 127.0.0.2, means the IP is listed. The last octet says which sub-list or reason applies. Many lists also publish a TXT record at the same name with a short reason and a link to the removal page.

Because it is plain DNS, you can query a list yourself from a server that uses its own resolver:

dig +short 25.2.0.192.bl.spamcop.net A
dig +short 25.2.0.192.bl.spamcop.net TXT

IPv6 addresses work the same way, except that every hexadecimal nibble of the full 32-digit address is reversed, which is the same format used for reverse DNS. Our IP blacklist checker runs these queries against a set of widely used lists at once and shows any listing next to its return code.

The blocklists that matter most

Hundreds of DNSBLs exist, but a handful are used by most large mail providers and spam filters. They differ a lot in how you get on and how you get off.

The Spamhaus lists are combined in the ZEN zone, so a single lookup covers SBL, XBL and PBL. A PBL listing on a home connection is expected and not a sign that anything is wrong. It only becomes a problem if you try to run a mail server directly on that connection.

A UCEPROTECT Level 2 or 3 listing means other customers of your hosting provider or ISP are sending spam. You cannot fix that yourself; raise it with the provider and, if it persists, consider moving to a network with better abuse handling.

Common reasons an IP gets listed

A compromised device or botnet infection

The most common cause of an XBL-style listing. Malware on a PC, phone, NAS, IoT camera or WordPress site sends spam directly to port 25. On a home or office network every device shares one public IP, so a single infected machine gets the whole connection listed.

An open relay or abused mail account

A mail server that accepts messages from anyone to anyone is an open relay and is quickly found and abused by spammers. Far more common today is a valid account with a stolen password, used to send through authenticated SMTP.

A misconfigured mail server

Servers that send bounce messages to forged senders (backscatter), announce a bogus HELO name, or run poorly secured web forms and contact scripts generate the kind of traffic that hits spam traps.

Missing or generic reverse DNS

Without a PTR record, or with a generic one like 203-0-113-7.dyn.example.net, many receivers treat the IP as a residential connection. That leads to rejections and can feed into policy listings. Check yours with our reverse DNS lookup.

A bad neighbour on shared hosting

On shared hosting or cheap VPS ranges, another customer on the same IP or subnet may be the sender. Range-level listings are common on networks that are slow to deal with abuse.

Fix first, then request delisting

Requesting removal before fixing the cause usually fails: the IP gets relisted, and some lists make each later removal slower. Work through these steps in order.

1. Confirm the listing. Run the IP through our blacklist checker and Spamhaus's own lookup page. Note every list that has you and the return code or reason text.
2. Read the listing reason. Most lists explain why, sometimes with a timestamp or the kind of traffic seen. A botnet name points to malware; a spam-trap hit points to your mail stream.
3. Find the sending source. On a network, look for devices making outbound connections to port 25 that are not your mail server. On a Linux server, these commands help:

   # active outbound SMTP connections and the process behind them
   ss -tnp state established '( dport = :25 )'
   
   # how many messages are waiting in a Postfix queue
   postqueue -p | tail -n 1

4. Fix the cause. Clean or rebuild infected machines, reset compromised passwords, remove abused scripts, and block outbound port 25 at the firewall for everything except your real mail server.
5. Close any open relay. In Postfix, a safe baseline is:

   smtpd_relay_restrictions = permit_mynetworks,
       permit_sasl_authenticated, defer_unauth_destination

   Make sure mynetworks lists only your own hosts.
6. Fix identity records. Set a PTR record that matches your HELO name and resolves back to the same IP (forward-confirmed reverse DNS). Publish SPF, DKIM and DMARC; our SPF and DMARC checker shows what is live, and our guide to SPF, DKIM and DMARC explains how to set them up.
7. Request removal. Use each list's own removal page. Explain briefly what happened and what you changed. Lists with automatic expiry, such as SpamCop and UCEPROTECT Level 1, need no request.
8. Monitor. Re-check over the next few days. A quick relisting means the source is still active.

If you are not running a mail server

Home users usually discover a listing because a website or forum blocks them, or a friend's mail server rejects mail sent from a desktop client. In that case:

• A PBL listing alone is normal. Send mail through your email provider's submission server on port 587 with authentication, not straight to port 25.
• An XBL or similar listing means a device on your network is probably infected. Scan every computer, update router and IoT firmware, and change router admin passwords.
• If you are behind carrier-grade NAT, other customers share your public IP and may be the cause. Contact your ISP with the listing details.

Frequently asked questions

How long does it take to get off a blacklist?

It depends on the list. SpamCop entries expire about a day after reports stop and UCEPROTECT Level 1 expires after a quiet period. Spamhaus XBL self-service removals take effect quickly once the zone updates, while SBL tickets are reviewed by staff. Remember that receivers also cache DNS answers for the list's TTL.

Why does one checker show me listed and another does not?

Checkers query different sets of lists, and some lists refuse queries from public resolvers or high-volume users and return error codes that a careless tool can misread as a listing. Always confirm on the list's own website.

Can I change my IP to escape a blacklist?

Sometimes, on a dynamic connection, but it does not fix anything. If a device on your network is infected, the new IP will be listed too. Fix the cause first.

Does being blacklisted affect web browsing?

Mostly not. DNSBLs are used mainly for email, but some websites, forums and CDNs use similar reputation data, so you may see more CAPTCHAs or blocked sign-ups.