Is your domain on an email blocklist? How to check and get delisted

First: are your emails bouncing, or landing in spam?#

A blocklist is a list of IP addresses or domains that some receiving mail servers check before they accept a message. People search “am I blacklisted?” for two different problems, and only one of them is usually a blocklist.

• Your mail bounces with a 5xx error (a refusal; a 4xx means “try again later”), often naming a list or a link: a blocklist is likely. Read on.
• Your mail arrives but lands in spam: start with why emails go to spam. Gmail does not say which lists it consults, though its sender guidelines warn that mail from an IP on an internet blocklist is more likely to be marked as spam, so check your sending IP too.^[2]

Two words decide who has to act. Your IP address is the number of the server that sent the mail; if you use a sending service or a business mailbox provider, that server is usually theirs. Your domain is your name, such as yourshop.com, and it is always yours.

When a listing matters, and whose it is#

• It matters when receivers you mail use the list. Your bounces tell you which ones do. A listing on an obscure list that no bounce mentions may block nobody you write to.
• The Spamhaus PBL is not an accusation. It lists ranges that should not send mail directly, such as home broadband, and Spamhaus says those addresses “are not necessarily ‘bad’”.^[8] Send through a mail server or a sending service instead. If you run a mail server on a static IP in a listed range, you can remove that one address yourself at check.spamhaus.org.^[8]
• A domain listing can come from a domain in your links. Domain lists check every domain in the message, not just yours. A shared link shortener or a shared click-tracking domain that someone else abused can drag your mail down with it. A tracking domain of your own, such as links.yourshop.com, avoids sharing that risk.

How to check, step by step#

1. 1

   Read the bounce

   Find the 5xx code and the text after it. A blocklist rejection usually names the list or gives a link to it.

2. 2

   Find the sending IP address

   Take it from the bounce, or from the Received headers of a copy of your mail that did arrive; on a sending service, send a copy to your own mailbox. That address, not your website's, is what IP lists check.

3. 3

   Look up the IP and the domain

   Use each list's own web checker, such as check.spamhaus.org and Barracuda's lookup. Only if you query by DNS yourself: ask through a DNS server you run, never a public one such as 8.8.8.8. Spamhaus refuses public servers, and the refusal can look like a listing or like a clean result.

4. 4

   Decide whose job it is

   Your own server's IP, your domain and your link domains are yours to fix. A listed IP that belongs to your sending service is theirs.

5. 5

   Fix the cause, then ask once

   Clean the compromised machine, close the open relay or stop mailing the bad list, then request removal once where the list asks for a request.

A rejection that names a list reads like this one, from a receiving server running Postfix with Spamhaus. It arrives in your mailbox as an “Undeliverable” or “Mail delivery failed” message, or in a sending service’s message log:^[20]

554 5.7.1 Service unavailable; Client host [192.0.2.99] blocked using zen.spamhaus.org;
    Listed by PBL, see https://check.spamhaus.org/query/ip/192.0.2.99

The sending IP is the one in square brackets. Tracing a missing email shows how to find it in the full headers of a copy that arrived.

Microsoft runs its own blocked-senders list rather than a public one. A bounce from a Microsoft 365 business mailbox reading 550 5.7.606-649 Access denied, banned sending IP names its delist portal, which can take up to 24 hours or longer. A 5.7.511 bounce cannot use the portal: you email delist@microsoft.com instead, and consumer Outlook.com addresses have a separate delisting form.^[10]

Not every rejection that looks like a blocklist is one, and delisting requests fix none of these. Gmail requires the sending IP to have a reverse (PTR) record whose hostname resolves back to the same IP; the last two lines of the dig block below check both.^[2] Gmail’s 550 5.7.26 refuses unauthenticated mail, such as mail that fails the sender’s DMARC policy, and 421 4.7.28 throttles you because Gmail sees an unusual rate of mail from you: a reputation warning, not a listing.^[21] Microsoft’s 550 5.7.515 refuses a domain that sends 5,000 or more messages to its consumer mailboxes without passing SPF, DKIM and DMARC.^[22]

How blocklists work, for administrators#

This section is for whoever runs the mail server or the monitoring. If that is your provider, skip to the major lists.

Most blocklists are DNSBLs (also called RBLs). Receiving servers and spam filters look up each connecting IP, and the domains in each message, then reject, score down or ignore the answer. The lookup is plain DNS, described in RFC 5782 (an Informational RFC): reverse the IP’s four numbers, add the list’s zone, and ask for an address record. A listed entry answers, conventionally in 127.0.0.0/8, and a TXT record at the same name can give the reason. IPv6 addresses are written out in full and reversed one hex digit at a time. RFC 5782 asks every list to keep a test entry that always answers, and Spamhaus’s do, so you can tell a working lookup from a blind one: 127.0.0.2 on an IPv4 list, ::ffff:7f00:2 on an IPv6 list, and the name test on a domain list.^[1] Spamhaus’s domain list answers in 127.0.1.x and keeps dbltest.com listed for testing too.^[4]

# Ask through a resolver you run, not a public one (see below).
# First the list's test entry. If it does not answer, no other answer means anything.
dig @your-own-resolver +short 2.0.0.127.zen.spamhaus.org A

# Is 192.0.2.99 on Spamhaus ZEN? Reverse the four numbers, add the list's zone.
dig @your-own-resolver +short 99.2.0.192.zen.spamhaus.org A

# No answer          → not listed
# 127.0.0.2          → SBL       127.0.0.3      → CSS
# 127.0.0.4          → XBL       127.0.0.9      → DROP (also on the SBL)
# 127.0.0.10 or .11  → PBL: a range that should not send directly; not an accusation
# 127.255.255.254    → you asked through a public resolver
# 127.255.255.252    → typo in the zone      127.255.255.255 → too many queries
# None of the last three is a listing.

# A domain, on the Spamhaus Domain Blocklist. Its test entry is the name "test".
dig @your-own-resolver +short test.dbl.spamhaus.org A        # must answer 127.0.1.2
dig @your-own-resolver +short example.com.dbl.spamhaus.org A
# 127.0.1.2 → spam    127.0.1.4 → phish    127.0.1.5 → malware    127.0.1.6 → botnet
# 127.0.1.102 to .106 → a legitimate domain that was abused, such as a hacked site
# 127.0.1.255 → you asked the DBL about an IP address, which it does not list

# Not a blocklist at all, but a common rejection: reverse DNS that does not match.
dig +short -x 192.0.2.99              # the PTR: a hostname, such as mail.yourshop.com
dig +short mail.yourshop.com A        # must give 192.0.2.99 back

Some answers inside 127.0.0.0/8 are errors, not listings. Spamhaus answers 127.255.255.254 to a query that came through a public or open resolver, and says its error codes “must not be taken to imply that the object of the query is ‘listed’”. Free use is limited to low-volume, non-commercial queries that do not come from a public resolver or an IP with generic reverse DNS, which rules out most cloud servers; other use needs a subscription, such as Spamhaus’s Data Query Service (DQS). A resolver that only forwards to a public one is refused too; it has to look names up itself.^[3] A non-commercial sender with low query volumes may qualify for a free DQS account instead, and its data includes Zero Reputation Domains, Spamhaus’s list of newly registered or newly observed domains.^[5]

A public resolver can also fail silently. To check yourself on a schedule, test each list against its test entry first, then look up your own IPs and domains. The script takes IPv4 and IPv6 addresses, and treats any answer outside a list’s listing range as an error, so a refusal is never recorded as a listing:

import { isIPv6 } from "node:net";
import { Resolver } from "node:dns/promises";

// A recursive resolver you run. Public resolvers are refused, sometimes silently.
const resolver = new Resolver({ timeout: 5000, tries: 2 });
resolver.setServers([process.env.RESOLVER ?? "127.0.0.1"]);

// Each list's zone, its RFC 5782 test entries, and the answers that mean "listed".
// With a Data Query Service key, use the zones your account gives you; never commit the key.
// Anything else (127.255.255.x, or 127.0.1.255 for an IP sent to the DBL) is an error.
const LISTS = {
  ip: {
    zone: "zen.spamhaus.org",
    tests: [reversed("127.0.0.2"), reversed("::ffff:7f00:2")],
    listing: /^127\.0\.0\.\d+$/,
  },
  domain: { zone: "dbl.spamhaus.org", tests: ["test"], listing: /^127\.0\.1\.(?!255$)\d+$/ },
};

// IPv4: the four numbers reversed. IPv6: all 32 hex digits, reversed one at a time.
// Either way the answer is an A record: a 127.x code, not an address.
function reversed(ip) {
  if (!isIPv6(ip)) return ip.split(".").reverse().join(".");
  const [head, tail = ""] = ip.split("::");
  const groups = (part) => (part ? part.split(":") : []);
  const zeros = Array(8 - groups(head).length - groups(tail).length).fill("0");
  const hex = [...groups(head), ...zeros, ...groups(tail)].map((g) => g.padStart(4, "0"));
  return [...hex.join("")].reverse().join(".");
}

async function lookup(kind, name) {
  const { zone, listing } = LISTS[kind];
  let codes;
  try {
    codes = await resolver.resolve4(`${name}.${zone}`);
  } catch (error) {
    if (error.code === "ENOTFOUND" || error.code === "ENODATA") return []; // not listed
    throw error;
  }
  const errors = codes.filter((code) => !listing.test(code));
  if (errors.length > 0) throw new Error(`${zone} answered ${errors} for ${name}: an error code`);
  return codes;
}

export async function checkLists({ ips = [], domains = [] }) {
  // Each list must answer for its test entries. Silence means a blind resolver, not a clean result.
  for (const [kind, { zone, tests }] of Object.entries(LISTS)) {
    for (const test of tests) {
      if ((await lookup(kind, test)).length === 0) throw new Error(`${zone}: no answer for ${test}`);
    }
  }
  const listed = [];
  for (const ip of ips) {
    for (const code of await lookup("ip", reversed(ip))) listed.push({ ip, code });
  }
  for (const domain of domains) {
    for (const code of await lookup("domain", domain)) listed.push({ domain, code });
  }
  return listed; // empty means nothing listed
}

We ran it on 17 October 2026 three times, asking about four names: the IPv4 test entry and dbltest.com, which must come back listed, and the documentation address 2001:db8::99 and example.com, which must not. Through two public resolvers, one returned no answer for the test entry, which a naive script reads as “not listed”, and the other returned the refusal code; the self-test stopped both. The third run asked one of Spamhaus’s own nameservers directly, which is what a resolver you run does on your behalf; we did that only for this demonstration, since the fair-use terms expect your own resolver. Every answer came back as expected:

# checkLists({ ips: ["127.0.0.2", "2001:db8::99"], domains: ["dbltest.com", "example.com"] })
RESOLVER=8.8.8.8:
Error: zen.spamhaus.org: no answer for 2.0.0.127
RESOLVER=1.1.1.1:
Error: zen.spamhaus.org answered 127.255.255.254 for 2.0.0.127: an error code
RESOLVER=149.28.204.60 (a.gns.spamhaus.org, for this demonstration only):
[
  { ip: '127.0.0.2', code: '127.0.0.2' },
  { ip: '127.0.0.2', code: '127.0.0.10' },
  { ip: '127.0.0.2', code: '127.0.0.4' },
  { domain: 'dbltest.com', code: '127.0.1.2' }
]

The Spamhaus Domain Blocklist “ONLY lists domains”,^[6] and URIBL says it lists domains that appear in spam, “NOT where they were sent from”.^[7]

The major blocklists, and how each one delists#

Sources for each row: Spamhaus’s pages for the SBL, XBL, CSS and DBL^{[9][12][13][6]}, Barracuda’s removal page^[14], SpamCop’s FAQ^[15], UCEPROTECT’s Level 1 policy^[16], SURBL’s and URIBL’s own pages^[17][7], and Proofpoint’s blocked-IP FAQ.^[18] SORBS, once a common list, was shut down on 5 June 2024, so a checker that still reports it is out of date.^[19]

The table covers lists anyone can look up for free. Others are sold to filter operators by subscription, such as invaluement’s IP lists (ivmSIP and ivmSIP/24) and its domain list (ivmURI). If a bounce names one, its lookup page also takes delisting requests for an IP address or a domain.^[25]

Getting delisted: fix it first, ask once#

A list that sees the same behaviour again lists you again, and some treat repeated requests as noise: Barracuda says multiple requests “will also be ignored”.^[14] Find the cause first:

• A compromised machine or account sending through your server, the usual cause of an XBL listing. Clean it and change its passwords.
• An open relay: a mail server that forwards mail for anyone. How SMTP works explains what a relay should accept.
• A bad list: bought, scraped or old addresses that include spam traps. Sign-up forms that bots fill in add traps too: double opt-in keeps unconfirmed addresses off your list, and a bot check on the form stops most fake sign-ups. Never mail a bought or scraped list, even to confirm it. Stop sending to it, and read how to retire inactive subscribers.
• Complaints: lists that rely on reports, such as SpamCop, follow your spam complaint rate.

How to stay off blocklists, and notice early#

• Check on a schedule, not after the bounces. Run a check like the one above daily for your own sending IPs and weekly for your domains, and alert on any new answer. If you do not run servers, the checkers and dashboards here need no code.
• Watch bounces by code. A sudden run of 4.7.x deferrals or 5.7.x rejections from one provider is the earliest sign. Hard vs soft bounces covers each code.
• Mail only people who asked, and stop mailing people who never engage. Lists that run spam traps catch senders who mail addresses nobody signed up with, so list hygiene is what keeps you off them.
• Watch the providers’ own dashboards. Google Postmaster Tools shows the spam rate Gmail users report for your mail,^[2] and Microsoft shows data for IPs you are responsible for in its Smart Network Data Services (SNDS).^[11]

If you send through Rasket on shared IP addresses, send the bounce to our support. Every bounce also reaches your webhook as an email.bounced event with the receiver’s reply in data.bounce.diagnosticCode, so you can alert on replies that name a list (webhook events).^[23] Click tracking is set per domain: once the domain’s Tracking record verifies, tracked links use your own name, links.yourshop.com by default, and our shared tracking address until then. The tracking docs list the one CNAME record to add.^[24]