What Is an IP Blacklist and How a Shared Sending IP Affects You

An IP blacklist is a DNS based list of IP addresses that its operator considers a source of spam, malware or abuse. Mail servers query these lists for every incoming connection, and a listed IP gets its mail rejected or sent to spam. On a shared sending IP, another sender's behaviour can list you too.

Most people only learn what an IP blacklist is on the day one blocks their mail. By then the questions are urgent: who put us there, why do they have this power, and why is our IP listed when we did nothing wrong? This article answers those questions, explains how the lookups work under the hood, and covers the shared IP problem that catches a surprising number of careful senders.

What an IP blacklist actually is

The technical name is DNSBL, short for DNS based blackhole list, sometimes called an RBL (real time blackhole list). It is a DNS zone. The operator publishes an entry for each listed IP, and anyone can query it the same way they would look up a website. There is no central authority. Spamhaus, Barracuda, SpamCop, Abusix, Mailspike, UCEPROTECT and many others run their own lists with their own criteria, and each mail server administrator decides which lists to trust and what to do with a match.

Lists get their data from a few sources:

• Spam traps. Addresses that never signed up for anything, or old addresses that were abandoned and later reactivated. Mail to a trap is evidence that the sender is not using a clean, opt in list.
• User reports. Recipients reporting messages as spam, which lists like SpamCop process automatically.
• Behavioural detection. Connection patterns typical of malware, sudden volume from an IP with no history, or invalid greetings from the sending server.
• Researchers. People who investigate spam operations and list ranges manually, with a documented reason.
• Policy. Ranges that should not send mail directly at all, such as home broadband, published so servers can refuse them up front.

How a blacklist lookup works

When your server connects to a recipient's server, the receiver takes your IP, reverses the four octets and appends the list's zone. For the IP 203.0.113.77 and the list bl.example-rbl.org, the query is:

77.113.0.203.bl.example-rbl.org

If the IP is not listed, DNS answers that the name does not exist (NXDOMAIN). If it is listed, the answer is an address in the 127.0.0.0/8 range, such as 127.0.0.2. Many lists use different return codes for different reasons, so the exact address matters. A TXT query on the same name often returns a human readable reason or a link to the listing details.

IPv6 works the same way, except the address is expanded to its full 32 nibbles and reversed one nibble at a time, which is why IPv6 queries look very long. Fewer lists support IPv6, and some receivers handle IPv6 senders more strictly as a result.

The whole lookup takes milliseconds and happens before the message body is even transferred. That is what makes blacklists so effective for receivers and so painful for senders: the rejection happens at the door, often with a 550 error naming the list.

IP lists versus domain lists

IP blacklists judge the server that connects. Domain lists, also called RHSBL or URIBL lists, judge the domains that appear in a message: the From domain, the envelope domain and every link in the body. The Spamhaus DBL and SURBL are the best known domain lists.

This distinction matters when you change infrastructure. Moving to a new ESP or a new IP does nothing for a listed domain, and a clean domain cannot rescue mail from a listed IP. A proper check covers both: an IP blacklist checker for the sending addresses and a domain blacklist check for the domains you send from and link to.

Shared IPs and why your neighbours matter

Most businesses do not send from their own IP addresses. Their ESP, CRM or marketing platform sends from a pool of IPs shared between many customers. The provider's reputation and the behaviour of the other customers on that pool become part of your deliverability.

Shared pools are not bad. For senders below roughly a few hundred thousand messages a month, a well managed shared pool is usually better than a dedicated IP, because it has steady volume and a long history that a new dedicated IP cannot match. The risk is that one customer on the pool mails a purchased list on a Tuesday morning, hits enough spam traps to get the IP listed, and every customer sending from that IP sees bounces until the provider reacts.

Good providers handle this well. They vet new customers, segment pools by reputation, move abusive senders off quickly and request delisting themselves. You can still protect yourself:

• Know which IPs your mail actually leaves from. The Received headers of a test message show them.
• Monitor those IPs, not just your domain. A listing on a shared IP is the first sign that your provider has a problem customer.
• Ask your provider how they handle listings and how fast. Their answer tells you a lot.
• Authenticate with your own domain (custom DKIM and an aligned return path), so your domain builds its own reputation that travels with you if you move.

When a dedicated IP makes sense

A dedicated IP means your reputation is entirely your own. That is valuable if you send large, consistent volumes, for example a newsletter publisher or a high volume transactional sender, and it is a liability if your volume is low or irregular. Receivers judge an IP by its recent history, and an IP that sends 2,000 messages one week and nothing for three weeks never builds a stable reputation.

If you move to a dedicated IP, warm it up. Start with a few hundred messages a day to your most engaged recipients and roughly double the volume every few days while watching bounces, complaints and placement. Set a PTR record that resolves to a hostname under your domain, with a matching forward record. And put monitoring on it from the first day, because a new IP with no history is exactly what automated lists are most suspicious of.

Reputation is more than blacklists

The large mailbox providers rely mostly on their own reputation systems, not public lists. Gmail scores your domain and IP based on authentication, engagement and spam reports from its users, and shows a summary in Postmaster Tools. Microsoft provides IP level data through its Smart Network Data Services portal. Yahoo shares complaint data through its feedback loop.

So an IP can be clean on every public blacklist and still land in spam at Gmail because its spam complaint rate is too high, or because DMARC fails for part of the traffic. The opposite also happens: a listing on a minor list with no effect at the big providers. That is why we look at blacklists together with SPF, DKIM, DMARC, mailbox provider reputation and inbox placement. An IP reputation checker gives you a fast snapshot, and email deliverability monitoring keeps watching all of these signals for every domain and IP on your account.

How long a listing lasts

There is no single answer, because each list sets its own rules. Roughly, lists fall into three groups.

• Self expiring lists. Listings disappear automatically once the abuse stops. SpamCop typically drops an IP about 24 hours after the last report, and UCEPROTECT level 1 typically after seven days without new evidence.
• Self service removal. You fix the cause and request removal on the list's website, and the entry is gone within minutes to hours. Spamhaus XBL and CSS and the Barracuda list work this way, although Barracuda reviews requests by hand.
• Manual investigation. Listings created by researchers, such as a Spamhaus SBL record, stay until the network owner shows the problem was dealt with. These can take days and usually involve your hosting provider or ESP.

Whatever the list, repeat listings last longer and are harder to remove than first ones. Removal also takes a little time to reach every receiver, because DNS answers are cached for the record's time to live, usually minutes to an hour.

Why legitimate senders get listed

Listings are rarely random, but the cause is often not what the sender expects. A web contact form that sends confirmation mail from the main mail server can be abused to send thousands of messages to arbitrary addresses. A single employee whose mailbox password was phished can send a spam run overnight. A marketing team can import a three year old trade show list full of abandoned addresses that have since become traps. None of these looks like "we are spammers" from the inside, and all of them look exactly like spam from the outside. The listing is a symptom; finding the actual source is the work.

What to do if your IP is listed

1. Get the exact list name and return code from the bounce message or a lookup.
2. Check whether the IP is dedicated to you or shared. If shared, contact your provider first.
3. Find the cause: compromised accounts or servers, mail to old addresses, a complaint spike, missing reverse DNS.
4. Fix it, then use the list's own removal process. The step by step guide on how to get off an email blacklist covers the major lists, and the Spamhaus removal guide covers each Spamhaus list in detail.
5. Watch for relisting over the following days.

The case for monitoring

The cost of a listing grows by the hour. Invoices bounce, password resets never arrive, a sales sequence stops landing, and nobody connects the dots until a customer complains. Checking your IPs by hand once a month means a listing can sit unnoticed for weeks.

With IP blacklist monitoring, every IP and domain you send from is checked against 100+ lists on a fixed schedule, down to every five minutes on larger plans. When something changes you get an alert with the list, the return code, what it means and the removal steps, by email, in Slack or through a webhook. Agencies running many client domains and companies with several sending platforms tend to get the most from it, and you can see the plans on our pricing page or run a one-off blacklist check on any domain or IP right now.