Blacklist Monitoring

What blacklist monitoring does

A blacklist (also called a DNSBL or RBL) is a DNS zone that lists IP addresses or domains its operator considers a source of spam or abuse. Receiving mail servers query these zones for every incoming message. When your IP or domain shows up, your mail gets rejected at the door or quietly filed in spam, and nothing in your sending tool tells you why open rates dropped.

A one-off IP blacklist checker tells you where you stand right now. Monitoring does the same lookups on a fixed schedule, keeps the history, and sends an alert when the answer changes. That difference matters because most listings happen without warning: a compromised form, a bad list import, a reactivated spam trap, or another sender on a shared IP.

A blacklist monitoring service is useful the moment you send mail that earns money, whether that is invoices, password resets, cold outreach or a weekly newsletter. The cost of a listing is counted in lost replies and lost orders, and the cost grows with every hour nobody notices.

Which lists we check

Our catalog covers 109 DNSBL and URIBL lists. Some block IPs, some block domains that appear in links, and some do both. Each one has its own criteria and its own removal process, which you can read in our blacklist directory.

• Spamhaus ZEN (SBL, XBL, PBL combined) and DBL for domains, the lists with the widest use among large receivers.
• Barracuda BRBL, used by Barracuda appliances in many companies and schools.
• SpamCop, driven by recipient reports and listings that expire on their own.
• UCEPROTECT levels 1 to 3, which can list a single IP, an allocation or a whole network.
• PSBL, Mailspike, SpamRATS, Backscatterer and dozens of regional and specialist lists.
• SURBL and URIBL, which look at the domains inside your message body and links.

How to check a blacklist by hand

You can test a single list yourself with a DNS query. Reverse the four parts of your IP and add the list zone. For the IP 203.0.113.77 and Spamhaus ZEN the query is 77.113.0.203.zen.spamhaus.org. No answer (NXDOMAIN) means not listed. An answer in the 127.0.0.x range means listed, and the last number tells you which sub-list and why.

1. 1 Find every IP that sends your mail, including your ESP, your CRM and any server that sends notifications.
2. 2 Reverse each IP and query the lists you care about, one zone at a time.
3. 3 For domain lists such as Spamhaus DBL or SURBL, query the domain itself, for example example.com.dbl.spamhaus.org.
4. 4 Write down every answer and the date, because removal forms ask when the problem started.
5. 5 Repeat this every day, for every IP and domain, on every list.

Why manual checks stop working

The last step is where manual checking breaks. Ten domains and three IPs on 109 lists is more than 1,400 lookups per round. Some lists also refuse queries from large public resolvers, which means a quick check from a laptop can show "clean" when the real answer is "listed". Monitoring runs these lookups correctly every time and only bothers you when something changes.

Spreadsheets also lose the history. When a list operator asks how long the problem lasted, or a client asks whether the listing came before or after their campaign, you need dated records. Our monitors store every check, so the listing history is a timeline you can show.

What happens when you get listed

When a check finds a new listing, we send an alert to email and Slack on every plan, plus Microsoft Teams and signed webhooks from Business up. The alert names the list, the asset, the return code and what it means, and links to the removal steps for that list. For example, a Spamhaus SBL listing needs a ticket after you fix the cause, while a SpamCop listing usually expires within 24 hours once the reports stop.

When the listing clears, you get a second alert, so you know delisting worked without checking by hand. If you need to understand removal in depth, our guide on how to get off an email blacklist walks through the main lists.

More than a list of lists

A blacklist is often the symptom, not the cause. Mail that fails SPF or DMARC, a missing PTR record, or a spam rate above 0.3 percent at Gmail all push you toward listings. That is why each monitored domain also gets SPF, DKIM, DMARC, MX, PTR, BIMI, MTA-STS and TLS-RPT checks, rolled into a Domain Health score from 0 to 100.

Each finding is a plain sentence with the fix, such as "SPF uses 12 DNS lookups (limit 10), receivers return permerror". If you want the wider picture with reputation signals and placement, see our email deliverability monitoring page.

Every check is a DNS lookup. We never send mail from your domain or to it, so monitoring cannot affect your reputation.

Getting started

Run a free check on the home page first to see where you stand today. Then pick a plan on the pricing page, add your domains and IPs (bulk import on Agency and Scale), connect Slack, and the first full check runs within minutes. Yearly billing saves 50 percent on every plan.

Frequently asked questions