Email Blacklist Check: See If You're Listed and Get Removed

An email blacklist check looks up your domain and your sending Internet Protocol (IP) address in the lists that mail servers consult. If either is listed, some servers refuse your email or send it to spam.

The usual first sign is a bounce that says "blocked using zen.spamhaus.org". The quickest check is Spamhaus's free checker at check.spamhaus.org: enter your domain and the IP address from the bounce. Only a handful of lists cause most refusals, and whether a listing is yours to fix depends on whose IP or domain it names.

What an email blacklist check looks for

Blacklist and blocklist mean the same thing: a list naming the IP address of a server that sent spam, or a domain name that turned up in spam. Spamhaus says blocklist, while the 2010 Request for Comments (RFC) on these Domain Name System (DNS) lists keeps the old word: "DNS Blacklists and Whitelists" (RFC 5782).

A clean IP tells you nothing about your domain, so a useful email blacklist check covers both. IP lists are consulted the moment a server connects. Domain lists are checked against your sender addresses, your headers and every link in the message (Spamhaus).

None of the lists in the table below names a single mailbox. "Is my email address blacklisted?" really asks whether the domain after the @ is listed, or the server your mail leaves from.

The blocklists most mail servers use

Spamhaus runs the lists most mail servers query, and its free IP lists are combined into one zone, ZEN (zen.spamhaus.org). Barracuda's list feeds Barracuda's own spam firewalls, and SpamCop's is built from spam reports.

List	What it lists	Common cause for a small business	How the listing ends
Spamhaus SBL (Spamhaus Blocklist)	IPs and ranges used by or for spammers	Rarely you; usually a host that tolerates spam	Only the network owner, such as your internet service provider (ISP), can ask for removal
Combined Spam Sources (CSS), part of SBL	IPs sending low-reputation email	Unwanted email, old lists, a hacked account or website	Normally expires three days after the last detection
Spamhaus XBL (Exploits Blocklist)	Hijacked or infected IPs	Malware on an office computer, a stolen mail password	Expires some time after the behaviour stops
Spamhaus PBL (Policy Blocklist)	End-user ranges, such as office broadband, that should not deliver mail directly	A device or script sending straight from your office connection	Send through your mail provider's server instead
Spamhaus DBL (Domain Blocklist)	Low-reputation domains	A hacked website, or a link to a listed domain	Expires when the activity stops; early removal on request
Barracuda Reputation Block List (BRBL)	IPs with a poor sending reputation	Spam from your server or network	Removal request, usually handled within 12 hours
SpamCop Blocking List (SCBL)	IPs whose mail SpamCop users or traps reported	Recipients reporting your email	Automatic, 24 hours after the reports stop

The table draws on Spamhaus's page for each list, including CSS and SBL, plus Barracuda Central and SpamCop's dispute page, all checked on 25 October 2026.

Spamhaus's advice is to look at your bounces before acting on any listing. Many lists have no real effect on delivery, and if nothing bounces, there is no problem (Spamhaus FAQ).

Two names that multi-list checkers still show deserve a note:

• SORBS (Spam and Open Relay Blocking System) is gone: its owner, Proofpoint, told The Register it decommissioned the service on 5 June 2024. Its test entry gave no answer when we queried it on 25 October 2026.
• UCEPROTECT Level 3 lists every IP of a whole provider network once enough of it sends spam. UCEPROTECT itself says such a listing points at your provider, and that fixing your provider's problems is not your job. It also sells immediate removal from Level 1; unpaid, a Level 1 listing expires seven days after the spam stops.

How a blocklist rejection looks in a bounce

A server that refuses mail because of a blocklist says so in its reply, and that reply comes back to you as a bounce.

A Postfix mail server, for example, refuses with this pattern by default. The address below comes from the range reserved for documentation:

554 5.7.1 Service unavailable; Client host [192.0.2.99] blocked using zen.spamhaus.org; Listed by XBL, see https://check.spamhaus.org/query/ip/192.0.2.99

Three parts of that line tell you what to do:

• The zone after "blocked using" names the list that refused you.
• The address in square brackets is the server that tried to deliver your email, so that is the IP to check.
• The text after it names the exact Spamhaus list and links to its lookup page.

Microsoft 365 keeps a list of its own and puts its removal address in the bounce (Microsoft Learn):

550 5.7.606-649 Access denied, banned sending IP [x.x.x.x]; To request removal from this list please visit https://sender.office.com/ and follow the directions.

One reason puts the fault at the receiving end: "Error: open resolver". The recipient's server asks Spamhaus through a public DNS service, gets an error code back and treats it as a listing.

Spamhaus warns that some mail servers wrongly reject all mail on these codes. You are not listed, so forward the bounce to whoever runs the recipient's email.

The numbers at the start, 554 and 5.7.1, follow the same rules as any other mailer daemon message.

Gmail publishes no blocklist to look up. It refuses or filters mail on its own data, and Postmaster Tools shows part of your sender reputation at Gmail.

How to run an email blacklist check

You need three things: your domain, any other domains your emails link to, and the sending IP. Without a bounce, ask your email provider which IP it sends from.

1. Run the domain and the IP through Spamhaus's IP and Domain Reputation Checker. It searches every current Spamhaus list, and Spamhaus says an address that does not show up there is on none of them.
2. If a bounce names Barracuda or SpamCop, check there too. Barracuda Central has an IP and domain lookup, and the SpamCop blocking list page takes an IP.
3. For the wider picture, a multi-list checker such as MXToolbox queries many lists at once. Read any red line against the table above before you act on it.

What the lookup does behind the checker

A blocklist lives in DNS, the system that turns domain names into addresses. To check 192.0.2.99, a mail server reverses the four numbers and asks for 99.2.0.192.zen.spamhaus.org.

A domain goes in unchanged, in front of the domain list's name (RFC 5782, sections 2.1 and 3).

An answer such as 127.0.0.2 or 127.0.1.2 means listed. No answer, which DNS reports as NXDOMAIN, means not listed. This is our own email blacklist check for mailgraf.com, run with dig on 25 October 2026:

$ dig +short mailgraf.com.dbl.spamhaus.org
$ dig +short dbltest.com.dbl.spamhaus.org
127.0.1.2

The first query returned nothing, so mailgraf.com is not on the DBL. The second asks about dbltest.com, the test domain Spamhaus keeps listed for this purpose (Spamhaus DBL FAQ).

We also checked the hostnames in our own newsletter links and postgraf.net, the domain behind the MailGraf domain option. None was listed.

Why Google and Cloudflare give the wrong answer

The same lookup can come back three ways, depending on which DNS service answers it. We ran it at 01:36 GMT that night through four services.

DNS service	Spamhaus test entry (must show as listed)	mailgraf.com	What the answer means
Our broadband provider's resolver	127.0.1.2, listed	No answer	Correct: not listed
Quad9 (9.9.9.9)	127.0.1.2, listed	No answer	Correct on our run
Google Public DNS (8.8.8.8)	No answer	No answer	Wrong: it would hide a real listing
Cloudflare (1.1.1.1)	127.255.255.254	127.255.255.254	An error code meaning "open resolver", not a listing

Spamhaus gives free access only for non-commercial use from a network it can identify. It blocks queries from some public DNS services (Spamhaus fair use policy). Quad9 is on its list of those (Spamhaus FAQ), so one correct night there proves little.

Test the service before you trust it. RFC 5782 requires every list to keep a test entry. On an IP list such as ZEN it is 127.0.0.2; on a domain list it is the name "test", as in test.dbl.spamhaus.org. If the test does not come back listed, your result means nothing; use the web checker.

How to get off a blocklist

Fix the cause first, then ask the list that holds the listing. Spamhaus re-lists automatically when it sees the activity again, and it may block people who keep filing removal requests (Spamhaus DBL FAQ).

1. Stop whatever triggered the listing. For XBL, find the infected device, change mail passwords, turn on two-step sign-in and delete forwarding rules nobody set up. For CSS or SpamCop, find the list or campaign that drew complaints and stop sending to it. For PBL, route mail via your provider's server with a login rather than straight from the office line.
2. If the DBL lists your own domain, a common cause is a compromised website. Spamhaus's steps: take the site offline if you can, remove infected files, update the content management system (CMS) and plugins, secure the server and change every password.
3. Request removal where the listing lives. For DBL, XBL and CSS, that is the Spamhaus checker. Barracuda's form asks for the server IP, your email address, a phone number and, optionally, a reason. Microsoft 365 uses its delist portal at sender.office.com.
4. Wait, then check again. An approved DBL removal takes effect within minutes, though some receiving systems take up to 24 hours to catch up. SpamCop's delisting can take up to 4 hours to reach every copy of the list.

When the listed IP belongs to your email provider

If you send through Microsoft 365, Google Workspace, your web host or an email platform, the IP in the bounce belongs to that provider, and only they can stop the traffic from it. SpamCop's advice to users in this position is to send the bounce to the provider and let it solve the problem.

Your part of an email blacklist check is then the domain: yours and every domain you link to.

A public link shortener puts its own domain in your email. Spamhaus notes that spammers use shorteners to slip past domain lists. Linking straight to your own site keeps every domain in the email under your control.

How MailGraf protects its sending IPs

On MailGraf, the platform runs the sending IPs, so the protection works account by account. Reputation Guard stops an account's sending for review once hard bounces reach 5% or spam complaints 0.1%, and pauses the account at 10% or 0.5%.

That catches a bad list early, before its complaints pile up against the platform's sending IPs. The Deliverability report shows the status as Delivery health: Healthy, Under review or Paused.

Provider performance in the same report splits sends, bounces and complaints by Gmail, Microsoft, Yahoo and others. Bounces rising at one provider alone point to that provider's own filtering rather than a list many servers share (Monitor delivery health).

Before a campaign goes out, Run a spam test on the Review & send step scores the email for blacklists, among other checks. It is available on packages that include spam tests (Understand the checks before you send).

The Block list inventory in the Deliverability report is a different thing. It holds the addresses MailGraf won't email again: hard bounces, complaints, unsubscribes, manual blocks and erasure requests.

How to stay off blocklists

Three habits keep you off these lists: mail only people who asked, act on complaints and clean old lists. Bought and scraped lists hold spam traps, complaints drive SpamCop listings, and Spamhaus names unwanted email and poor list hygiene among the causes of a CSS listing.

Make an email blacklist check of your domain a monthly habit, next to your other email deliverability checks, and run one before any large send. A listing then turns up in the checker before it turns up in your bounces.