How to Check If an IP Is Blacklisted

A blocklist check is a DNS lookup. RFC 5782, which describes how DNS blocklists work, puts the method in one sentence: "The entry's name is created by reversing the order of the octets of the text representation of the IP address, and appending the domain name of the DNSxL." A listed address answers with an A record, conventionally 127.0.0.2. An address that is not listed has no record at all. Two things make a check lie: an error code read as a listing, and a list that has closed.

We read RFC 5782, Spamhaus' zone and error documentation, SpamCop's list page, Microsoft's delist page and five other guides on October 13, 2026, all from our server. We also ran the lookups ourselves, for the test addresses only.

Check an address in five steps

Reading a blocklist lookup

Build the name
203.0.113.5 against ZEN becomes 5.113.0.203.zen.spamhaus.org
No answer
the address is not on that list
127.0.0.x
listed; the last number names the list
127.255.255.x
the query failed; never a listing
Test the list
127.0.0.2 must answer, 127.0.0.1 must not

Source: RFC 5782 and Spamhaus' documentation, read October 13, 2026 · hproxy.comProxy.

How a DNSBL lookup works

A DNS blocklist answers through ordinary DNS. RFC 5782's own example takes the address 192.0.2.99 and a list called bad.example.com, which gives the name 99.2.0.192.bad.example.com. "Each entry in the DNSxL MUST have an A record." That answer is a code, and "The contents of the A record MUST NOT be used as an IP address." Lists "SHOULD have a TXT record that describes the reason for the entry", and mail servers often quote that text in their refusal.

By hand, the lookup is one command:

dig +short 5.113.0.203.zen.spamhaus.org

No output means the address is not listed there. Each line of output is one code.

Test the list before you trust it

Every list carries a known answer. RFC 5782 is strict about it: "IPv4-based DNSxLs MUST contain an entry for 127.0.0.2 for testing purposes. IPv4-based DNSxLs MUST NOT contain an entry for 127.0.0.1." Ask a list both questions before you read anything into its answer for a real address. We did, from our server.

Our terminal: SpamCop answers 127.0.0.2 for its test entry and nothing for 127.0.0.1; Spamhaus ZEN, asked through the public resolver 1.1.1.1, answers 127.255.255.254 for both; SORBS answers nothing even for its test entry. — Captured on our own server on October 13, 2026: test addresses only, no real address looked up.

SpamCop passed both checks. Spamhaus, asked through a public resolver, answered both with an error code, the trap explained below. SORBS answered nothing even for 127.0.0.2, so its silence about a real address means nothing.

Reading Spamhaus' answers

Spamhaus ZEN combines several lists. It "contains the SBL, CSS, XBL, and PBL blocklists", and a lookup "generally results in several distinct answers within the same DNS response packet, one for each dataset where the IP is listed". The last number says which list.

Spamhaus ZEN: what each answer means

Listings in 127.0.0.x; errors in 127.255.255.x, which say nothing about the address.
Answer	List or error	Kind
127.0.0.2	SBL	Listing
127.0.0.3	CSS	Listing
127.0.0.4	XBL	Listing
127.0.0.9	DROP, with SBL	Listing
127.0.0.10	PBL, by the ISP	Policy
127.0.0.11	PBL, by Spamhaus	Policy
127.0.0.30	BCL	Listing
…255.252	Typo in the zone name	Error
…255.254	Public resolver	Error
…255.255	Too many queries	Error

Spamhaus zone documentation and public mirror notice, read October 13, 2026; the error codes begin 127.255

The PBL needs a second look. Spamhaus describes it as "end-user IP address ranges from which email should never be sent directly to the final destination", and notes that "The PBL can list both dynamic and static IPs". Its addresses are not necessarily bad, in Spamhaus' own words; they simply should not deliver mail straight to other servers. A home connection on the PBL is normal. The SBL, CSS, XBL and DROP answers are the ones that point at abuse. Use of the Spamhaus lists "is free of charge for low-volume, non-commercial users".

The public-resolver trap

Since March 2021, Spamhaus answers some queries with errors instead of data. Its notice lists three: "127.255.255.252 | Typing error in DNSBL Name", "127.255.255.254 | Query via public/open resolver/generic rDNS" and "127.255.255.255 | Excessive Number of Queries". It asks operators to "check that no application uses these codes to reject email or for any other blocking or filtering of internet traffic".

Our capture shows the trap. Through 1.1.1.1, Spamhaus answered 127.255.255.254 for 127.0.0.1, an address no list may carry. A checker that reads every 127.x answer as a listing calls that address blacklisted. Our server's own resolver fared no better: six lookups for the test entry, ten seconds apart, all returned the same error. A hosting server's default resolver can count as public, so run your check through a resolver Spamhaus accepts, or use its own checker at check.spamhaus.org.

Lists that have closed

Blocklists end, and a closed list rarely says so in DNS. SORBS was one of the best-known. In June 2024 The Register reported it "shuttered by its owner, cyber security software vendor Proofpoint", whose statement read: "We can confirm that SORBS was decommissioned on June 5, 2024, and the service no longer contains reputation data." On October 13, 2026, its test entry returned nothing from our server, and www.sorbs.net no longer resolved. A checker that still asks SORBS reports every address as clean there.

Getting off a list

Fix the cause first, because each list has its own process and a listing without a fix comes back. Some lists clear themselves. SpamCop's list "is time-based, resulting in quick and automatic delisting of these sites when reports stop."

Mailbox providers also keep lists of their own, and no DNS lookup shows them. Microsoft 365 adds an address to its blocked senders list "If a source IP address is identified as a potential threat to the service". Its bounce reads "550 5.7.606-649 Access denied, banned sending IP", and removal goes through the delist portal at "https://sender.office.com for external message senders to request their removal from the blocked senders list."

What other guides get wrong

GlockApps (updated March 2025) suggests visiting "the most popular blacklists such as Spamhaus, SURBL, SORBS, Invaluement, and SpamCop". SORBS had closed nine months before that update.
Truelist (April 2026) tells readers to "Visit the SORBS lookup page and enter your IP address." The page went up almost two years after the closure.
MXToolbox tests an address "against over 100 DNS based email blacklists" and names none of them on the page. One ZEN lookup already covers four Spamhaus lists, and a closed list adds nothing.
IPVoid scans an address "through multiple DNS-based blackhole list (DNSBL) and IP reputation services". A listing is a record a list publishes, and a reputation score is an opinion; the page mixes the two.
HetrixTools asks "every active blacklist we monitor", which is the right instinct. It leaves out the error codes a reader meets when checking Spamhaus by hand.

When the address is a proxy exit

If you are checking a proxy exit instead of your own mail server, the useful question is what a site will make of that address. The free app on our proxy checker page tests a proxy from your own connection and scores its exit address with FFraud, from 0 to 100 with a reason, no key needed. Our page on what a clean IP is explains what to look for. Residential proxies from us cost $0.44 per GB, ISP proxies hold one static address, and how to check if a proxy is working covers the basic tests. A proxy exit on the PBL is expected, since home addresses belong there.

What we could not find out

Which lists each checker tool asks, and how it reads Spamhaus' error codes. Their pages do not say.
Barracuda's terms for its list. Its site refused our server.
What the private lists of mailbox providers contain. No DNS lookup shows them.
Anything about a real address. We looked up the test addresses only.

Our next check of these lists is due by January 13, 2027.

Sources

Every page below was read on October 13, 2026, from our server.

IRTF: RFC 5782, DNS Blacklists and Whitelists (February 2010).
Spamhaus: available zones and return codes, public mirror return codes (March 2021), ZEN and the Policy Blocklist.
SpamCop: the SpamCop Blocking List.
Microsoft: remove yourself from the blocked senders list.
The Register: Spam blocklist SORBS closed by its owner, Proofpoint (June 7, 2024).
Google Keyword Planner: worldwide monthly averages, pulled October 13, 2026.
Guides and tools we judged, read the same day and deliberately left unlinked: GlockApps, Truelist, MXToolbox, IPVoid and HetrixTools.

Frequently asked questions

How do I check if my IP is on a blacklist?

Query the address against a DNS blocklist. Reverse the four octets, append the list's zone and look up the A record: for 203.0.113.5 against Spamhaus ZEN, look up 5.113.0.203.zen.spamhaus.org. No answer means not listed. An answer in 127.0.0.x means listed, and the last number names the list. An answer in 127.255.255.x is Spamhaus refusing the query, never a listing. Run the lookup through a resolver Spamhaus accepts, or use its own checker.

Why does a public DNS resolver return the wrong blacklist result?

Spamhaus refuses queries that arrive through public or open resolvers and answers them with the error code 127.255.255.254, in place since March 2021. From our server on October 13, 2026, a lookup through 1.1.1.1 got that code even for 127.0.0.1, an address no list may carry, and our server's own resolver got it too. A checker that reads every 127.x answer as listed then calls every address blacklisted.

What does it mean if my IP is on the PBL?

That the address sits in an end-user range. Spamhaus' Policy Blocklist holds "end-user IP address ranges from which email should never be sent directly to the final destination", dynamic or static, often entered by the internet provider itself (answer 127.0.0.10) or by Spamhaus (127.0.0.11). Spamhaus says these addresses are not necessarily bad. For a home connection it is normal; it matters only if that address tries to deliver mail directly.

How do I get my IP off a blacklist?

Find which list holds it and fix the cause first, because each list has its own process and a listing without a fix comes back. Some lists clear themselves: SpamCop's is time-based, with automatic delisting once reports stop. Mailbox providers also keep private lists that no DNS lookup reveals. Microsoft's bounce reads "550 5.7.606-649 Access denied, banned sending IP", and its removal goes through the delist portal at sender.office.com.

Are all these blacklists still active?

No. SORBS, long a standard list, was decommissioned on June 5, 2024, by its owner Proofpoint's statement. On October 13, 2026, it returned nothing even for 127.0.0.2, the test entry every list must carry, so a checker still asking it reports every address as clean. Test any list with 127.0.0.2 before you trust its silence.

How do I check an IP on Spamhaus?

Two ways. Spamhaus' own checker at check.spamhaus.org looks up an address on its lists. By hand, query zen.spamhaus.org, which combines the SBL, CSS, XBL and PBL and answers once for each list that holds the address; the queries are free for low-volume, non-commercial users. Read 127.255.255.x answers as errors, and use a resolver Spamhaus does not count as public.

How to Check If an IP Is Blacklisted, Step by Step