IP Blacklist Checker

Check any IPv4 or IPv6 address against 20 DNS-based blacklists for spam, botnet, and abuse listings.

More Tools

IP Blacklist Checker — DNSBL Reputation Lookup for IPv4 and IPv6

IP Blacklist Checker queries 18 DNS-based blackhole lists (DNSBLs) to determine whether an IPv4 or IPv6 address is flagged for spam, botnet activity, or abuse. For each list, it submits a DNS A record query per RFC 5782 and returns one of three statuses: LISTED, OK, or NOT CHECKED. Lists checked include SpamCop, Barracuda Reputation, DroneBL, UCEPROTECT, MailSpike, and Blocklist.de. Queries run in parallel — results arrive in seconds. Checked IPs are not stored.

Protocol	DNS A record query (RFC 5782) via a public recursive resolver
Lists checked	18 DNSBLs per query — spam, botnet, and relay categories
IPv6 support	Full — nibble-reversed query per RFC 5782 §2.4
Query timeout	2 seconds per DNSBL; NOT CHECKED if no response or the query is refused
Caching	Results kept in memory for up to 1 hour per IP to reduce DNSBL load
Data retention	Checked IPs are not written to disk or logged

How to Use the IP Blacklist Checker

Check any IPv4 or IPv6 address against 18 DNS-based blacklists (DNSBLs) for spam, botnet, and abuse listings.

Enter an IP Address

Type any public IPv4 or IPv6 address into the input field. Private ranges such as 192.168.x.x and 10.x.x.x have no DNSBL entries and cannot be checked.

Complete verification and submit

Solve the CAPTCHA and click the Check Blacklists button. The tool queries all 18 DNSBLs in parallel — results typically appear in under five seconds.

Review the Results Table

Each row shows one DNSBL, its status (LISTED, OK, or NOT CHECKED), and a brief description of what that list tracks.

Investigate Any Listings

For any LISTED entry, note the DNSBL name and visit that list's website directly to review the listing reason and submit a removal request.

Verify Removal

After requesting delisting, re-run the check to confirm the address no longer appears on that DNSBL. Some lists auto-expire listings within 24–48 hours with no further reports.

What the Results Mean

Status	Meaning	What to Do
OK	The IP address is not listed on this DNSBL.	No action required for this list.
LISTED	The IP appears in this DNSBL's database, flagged for spam, botnet traffic, or policy violation.	Visit the DNSBL's website, review the listing reason, remediate the cause, and submit a removal request.
NOT CHECKED	The list did not answer in time, refused the query, or returned an answer that is not a valid listing code.	Re-run the check later. NOT CHECKED never means the IP is listed.

How IP Blacklist Lookup Works

DNS-based blackhole lists (DNSBLs) distribute IP reputation data using the DNS infrastructure per the protocol documented in RFC 5782. Rather than querying a central database, each lookup constructs a DNS hostname by reversing the IP address and appending the DNSBL zone name, then submitting a DNS A record query to that hostname.

For an IPv4 address, each octet is reversed and the DNSBL zone is appended. Checking 192.0.2.1 against zen.spamhaus.org produces the query 1.2.0.192.zen.spamhaus.org. An NXDOMAIN response means the IP is not listed. An A record response between 127.0.0.2 and 127.0.0.255 confirms a listing — the specific value encodes the listing type within that DNSBL. Answers such as 127.255.255.254 are error codes (for example, Spamhaus refusing queries from public resolvers) and are never treated as listings.

For IPv6 addresses, the full 128-bit address is expanded, each nibble is reversed, and the result is formatted as a dotted-nibble string before the DNSBL zone is appended (RFC 5782 §2.4). All lookups run as parallel DNS queries with a 2-second timeout per query. Every few hours each list is self-tested with the RFC 5782 test address 127.0.0.1; a list that reports it as listed is skipped until it recovers, so a broken list can never produce false results.

DNSBL Categories — What Each Type Flags

Category	What It Flags	Examples in This Tool
Spam Source	IPs caught sending unsolicited email directly	SpamCop, MailSpike, 0Spam
Botnet / Exploit	Compromised hosts in botnets, infected with malware, or running open proxies	DroneBL, Blocklist.de
Policy (Dynamic IP)	Residential or dynamically assigned IPs not authorized to send email directly	Spamhaus PBL — check directly at Spamhaus
Open Relay / Proxy	Misconfigured mail servers or proxy servers that allow spam relay	SpamRats All
Aggregator	Combines multiple sub-lists into a single zone for efficient querying	Spamhaus Zen (SBL + XBL + PBL) — check directly at Spamhaus

How to Do an IP Blacklist Check Without an Online Tool

DNSBL lookups are standard DNS A record queries. To check an IP manually, reverse the octets and append the DNSBL zone. The examples below check 192.0.2.1 against bl.spamcop.net — substitute any IP and any DNSBL zone from the table above.

Windows — Command Prompt

nslookup 1.2.0.192.bl.spamcop.net

NXDOMAIN = not listed. A response from 127.0.0.2 to 127.0.0.255 = listed. A 127.255.255.x response is an error code, not a listing.

Windows — PowerShell

Resolve-DnsName 1.2.0.192.bl.spamcop.net -Type A

A QueryNotFound result means the IP is clean on that list.

Mac / Linux — dig

dig 1.2.0.192.bl.spamcop.net A +short

No output = not listed. An address from 127.0.0.2 to 127.0.0.255 = listed. Check multiple DNSBLs by repeating the command with different zone names (b.barracudacentral.org, dnsbl.dronebl.org, etc.).

The online tool checks all 18 DNSBLs simultaneously from a neutral external resolver — results may differ from your local DNS resolver due to caching or split-horizon DNS configurations.

Common Uses for IP Blacklist Checker

Mail server administrator investigating delivery failures. A system administrator notices that outbound email from a company mail server is being rejected by Gmail and Microsoft 365 with a 550 error citing a blacklist. Running the mail server's public IP through the blacklist checker immediately identifies which DNSBL flagged it — in this case SpamCop — providing the exact list and removal URL needed to begin the delisting process.

VPS or dedicated server operator checking a new IP assignment. A developer provisions a new cloud server and is assigned a public IP by the hosting provider. Before configuring outbound email, running the IP through the blacklist checker confirms whether the previous tenant left a reputation problem — a common occurrence with recycled IP addresses in shared hosting environments.

Security analyst investigating a suspicious traffic source. A network engineer reviewing firewall logs identifies repeated connection attempts from an external IP. Running that IP through the blacklist checker reveals it is listed on DroneBL (botnets and abuse) and Blocklist.de (attack sources), confirming the IP as a known threat actor and justifying a permanent firewall block.

Frequently Asked Questions

What does it mean if my IP address is blacklisted?

A blacklisted IP address appears in one or more DNS-based blackhole lists (DNSBLs) — databases that track IP addresses flagged for sending spam, participating in botnets, operating open relays, or hosting malware. Mail servers query these lists before accepting incoming email: a listing causes messages from that IP to be rejected or filtered to spam. Being listed does not always indicate current malicious activity — IPs can be flagged due to previous owners, compromised devices on the same network, or shared hosting with abusive neighbors.

How accurate is the IP blacklist check?

Each result reflects the list's answer at the time of the check; repeat checks of the same IP within one hour may be served from a short-lived cache. LISTED is shown only when a list returns a listing code (127.0.0.2–127.0.0.255, per RFC 5782); OK means the list answered that the IP is not listed. NOT CHECKED means the list did not answer in time, refused the query, or returned an unexpected answer — it never means the IP is listed. Spamhaus is not queried because it refuses queries sent through public DNS resolvers; use Spamhaus's own lookup for that list.

Why is my home IP address showing as blacklisted?

Residential IP addresses are routinely listed on policy-based DNSBLs such as Spamhaus PBL (Policy Block List) because ISPs assign them dynamically and they are not authorized to send email directly. This is expected and intentional — it does not indicate your device has sent spam. If you send email through your ISP or a provider such as Gmail or Outlook, these listings have no effect on your email deliverability. They only affect direct email transmission from your IP address, which residential connections are not designed to do.

What is the difference between a blacklist and a blocklist?

Blacklist and blocklist describe the same concept — a DNS-based database of IP addresses flagged for malicious or unwanted activity, queried via the protocol defined in RFC 5782. The term blocklist is preferred by some organizations to avoid negative connotations, but both terms appear throughout the industry and are used interchangeably by Spamhaus, SpamCop, and Barracuda. Every list this tool checks can correctly be called either.

Do you store or log the IP addresses I check?

IP addresses you check are not written to disk or added to any history. To avoid overloading the blocklists, the result for an IP is kept in memory for up to one hour so repeat checks can reuse it, then it is discarded. Each check reverses the IP and sends it to every DNSBL zone as a DNS A record query through a public recursive resolver.

How do I get my IP address removed from a DNSBL?

First, resolve the underlying issue: remove malware, close open relays, stop bulk sending, or contact your ISP if the listing is policy-based. Then visit the DNSBL's website directly — Spamhaus, SpamCop, and Barracuda all operate public removal centers. Some lists auto-expire listings after 24–48 hours with no further reports. Never pay for removal: legitimate DNSBLs do not charge delisting fees, and paid-removal services are invariably scams.

What Is an IP Address? — Understand the addressing system that DNSBLs use to identify and track individual hosts across the internet.

What Is a VPN? — A VPN routes your traffic through a different IP address. If that IP is blacklisted, your email and connections may still be blocked — learn when a VPN helps and when it does not.