# IP and Domain Blacklist Checker

Check an IPv4/IPv6 address, a domain's mail-server IPs (scope mx, a or both) or a domain name (scope domain) against a curated registry of live DNS blocklists: Spamhaus ZEN and DBL, SpamCop, Barracuda, UCEPROTECT 1-3, PSBL, Mailspike, DroneBL, URIBL and others (dead lists such as SORBS are excluded). Returns per list listed, clean, error or refused, the decoded return code, the TXT reason and the delisting link, plus a weighted summary. A refusal (for example Spamhaus 127.255.255.254 for public resolvers) means the list did not answer and is never counted as listed or clean. At most 3 IPs per domain.

**Not for:** Monitoring over time, or mailbox-provider reputation (Gmail, Outlook), which no public list shows.

- Tool id: `blacklist-checker`
- Category: email
- Execution: fanout
- MCP tool `blacklist_check` at https://lookupowl.com/mcp
- REST `GET https://lookupowl.com/api/v1/tools/blacklist-checker` (or POST a JSON body)
- OpenAPI: https://lookupowl.com/api/openapi.json

## Input

| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| `target` | string | yes |  | A public IPv4 or IPv6 address, or a domain. A URL or e-mail address is reduced to its host. Private and reserved addresses are refused. max length 253 |
| `scope` | "mx" \| "a" \| "both" \| "domain" | no | `"mx"` | For a domain: mx = check its mail servers' IPs (default), a = the IP of the domain itself, both = both, domain = check the domain name against domain blocklists (Spamhaus DBL, URIBL, ...). Ignored for an IP address. |

## Output

Results are wrapped in an envelope: `tool`, `version`, `requestId`, `data`, `summary`, `meta` (cache status, timing), `permalink`. `data` has these fields:

| Field | Type | Description |
|---|---|---|
| `target` | string |  |
| `mode` | "ip" \| "domain" |  |
| `scope` | "mx" \| "a" \| "both" \| "domain" |  |
| `verdict` | "clean" \| "listed" \| "policy-only" \| "inconclusive" | listed = on at least one list that mail servers act on; policy-only = only on policy or collateral lists (PBL, UCEPROTECT 2 and 3, backscatter, new-domain age); clean = on none; inconclusive = too few lists answered to say. |
| `subjects` | object[] |  |
| `summary` | object |  |
| `notChecked` | object[] |  |
| `registryVerified` | string |  |
| `created` | string |  |
| `notes` | string[] |  |
| `dnsQueries` | integer | min -9007199254740991, max 9007199254740991 |
| `incomplete` | boolean |  |

## Examples

### A well-known mail server IP

```json
{"target":"8.8.8.8","scope":"mx"}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/blacklist-checker?scope=mx&target=8.8.8.8'
```

Web page: https://lookupowl.com/blacklist-checker?q=8.8.8.8

### The mail servers of a domain

```json
{"target":"github.com","scope":"mx"}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/blacklist-checker?scope=mx&target=github.com'
```

Web page: https://lookupowl.com/blacklist-checker?q=github.com

### A domain against domain blocklists

```json
{"target":"example.com","scope":"domain"}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/blacklist-checker?scope=domain&target=example.com'
```

Web page: https://lookupowl.com/domain-blacklist-check?q=example.com

## Web pages

- https://lookupowl.com/blacklist-checker
- https://lookupowl.com/domain-blacklist-check

## Limits and caching

- Cost: from 1 unit up, depending on the input (a registry lookup counts every upstream request); 1 unit for a cached result. Budgets are per network and published in the `RateLimit` response headers.
- Cache: the lifetime follows the data (for DNS, the record TTL, within a few minutes). Add `fresh=true` (MCP argument or query parameter) to look again; it costs 3 units per unit and is limited to 10 per hour.
- Timeout: 22 s.

## Related tools

- [DMARC Record Checker](https://lookupowl.com/tools/dmarc-checker.md): Look up and validate a domain's DMARC policy, report addresses and alignment settings.
- [SPF Record Checker](https://lookupowl.com/tools/spf-checker.md): Check a domain's SPF record, count its DNS lookups against the limit of 10 and find errors.
- [DKIM Record Checker](https://lookupowl.com/tools/dkim-checker.md): Find and check a domain's DKIM public keys, even when you do not know the selector.
- [Reverse DNS Lookup](https://lookupowl.com/tools/reverse-dns.md): Find the host name (PTR record) of an IPv4 or IPv6 address and check that it resolves back to the same address.
- [DNS Lookup](https://lookupowl.com/tools/dns-lookup.md): Look up A, AAAA, MX, NS, TXT, CNAME, SOA, CAA, DS and DNSKEY records from a public resolver or the authoritative nameserver.
- [IP WHOIS Lookup](https://lookupowl.com/tools/ip-whois.md): Who owns an IPv4 or IPv6 address: network range, name, country, registry, abuse contact and origin AS, from RDAP.

## Guide: IP and mail server blacklist checker

Find out whether a mail server's IP address is on the spam blocklists that receivers use, with what each listing means and how to get off.

### What a blocklist check tells you

A DNS blocklist (DNSBL, sometimes called an RBL) is a public list of IP addresses that sent spam, were hacked, or should not send mail directly. A receiving mail server looks up the sender's address on the list in DNS, and may reject or junk the message when it finds a match.

Enter an IP address, or a domain to check its mail servers. For a domain we read its MX records and check up to three of the addresses behind them. For each address we ask a dozen live lists and show listed, not listed, or no answer for each.

> **No answer is not the same as clean** Some lists refuse questions that come through shared resolvers, and some time out. A list that refuses us shows as "Refused us" and is never counted as clean. If Spamhaus is one of them, its own checker gives a definite answer.

### Which lists we ask, and which we leave out

Many blocklist sites still query lists that closed years ago. SORBS shut down in June 2024, and the CBL was folded into Spamhaus. Asking a dead list gives nothing, or worse, an answer for everything. Each list was tried against known listed and clean addresses before we added it, and we keep only the ones that behaved. The date of that check is shown with every result.

| List | What it lists | How much it matters |
|---|---|---|
| Spamhaus ZEN | Spam sources, hijacked ranges, infected machines and dynamic ranges | High for SBL and XBL, low for the policy list PBL |
| SpamCop | Addresses reported by users or caught in traps in the last day or so | Medium, and clears itself |
| Barracuda | Addresses Barracuda filters rate as poor reputation | Medium, important if you mail Barracuda customers |
| UCEPROTECT 1, 2, 3 | One address, its network block, or its whole provider | Level 1 matters, levels 2 and 3 are collateral |
| PSBL, SEM, blocklist.de | Trap hits and reported attacks | Medium |
| Mailspike, DroneBL, Backscatterer | Reputation scores, infected machines, bounce abuse | Medium to low |

Each list has a weight, and the summary adds up the weights of the lists you are on. A listing on the Policy Block List only says that the range is meant for end users, such as a home connection, and is not a reputation problem.

### If you are listed

1. **Find the cause first**: A hacked website form, a compromised mailbox, a computer with malware, an open relay or a bulk campaign to an old list are the usual reasons. Removal requests made before the cause is fixed lead to a new listing within days.
2. **Check your mail setup**: Make sure the server has reverse DNS that matches its name, and that [SPF](https://lookupowl.com/spf-record-checker), DKIM and [DMARC](https://lookupowl.com/dmarc-checker) pass. Several lists weigh this when they decide whether to remove you.
3. **Ask each list to delist you**: The Listings tab gives a delisting link for every list. Many remove an address on their own after a few days of clean behaviour, and some charge for faster service, which you do not need.
4. **Check again later**: Come back after the list says it has removed you. Lists refresh at different speeds, and a cached answer at a receiver can last a few hours.

Domain names have blocklists as well, for the links in your mail. Use the [domain blocklist check](https://lookupowl.com/domain-blacklist-check) for those.

### What a clean result does not cover

Gmail, Outlook and Yahoo judge senders with private reputation systems built on their own traffic. None of that appears on a public list, so a clean result here does not guarantee delivery. It tells you that the public lists that spam filters commonly use have nothing against you.

Public lists run on donated servers and ask users to keep volume low. We pace our own questions to each list and keep recent answers for a short time, so repeated checks of the same address may show the previous answer. Use the fresh option when you have just been removed.

### Frequently asked questions

**What is a DNSBL?**

A DNS-based blocklist is a list of IP addresses or domains kept in DNS, so a mail server can check a sender with one fast lookup. Listings have return codes that say why, and each list has its own rules about who is added and how they are removed.

**Why does the checker say a list refused us?**

Some lists limit free use. Spamhaus, for one, answers with a special error code when it thinks a query is too heavy or comes from a shared resolver. We show that as a refusal, because it tells you nothing about your address. Use the list's own website for a definite answer.

**Am I blocked everywhere if I am on one list?**

No. Each receiver chooses which lists it uses and how much weight to give them. Being on Spamhaus SBL or XBL is serious because many large receivers use it. A listing on a small list or a policy list affects far fewer messages.

**What is the difference between UCEPROTECT levels 1, 2 and 3?**

Level 1 lists single addresses that sent spam to its traps. Level 2 lists whole network blocks with several bad senders, and level 3 lists all of a provider's network. Levels 2 and 3 describe your neighbours, so only the provider can clear them.

**How long does it take to be removed?**

It depends on the list. SpamCop and several trap-based lists expire a listing in a day or two after the spam stops. Others need a request. After removal, receivers may keep the old answer in their cache for a few hours.

**Why is a shared hosting or cloud IP listed?**

Other customers on the same address or network may have sent spam. Ask your provider to move you to a clean address or to clean up its range, since one customer cannot get a network-wide listing lifted.

**Does this check IPv6 addresses?**

Yes, but fewer lists cover IPv6. For an IPv6 address we ask only the lists that support it and mark the rest as not asked, so a short list does not look like a full clean bill.