Who needs IP level monitoring
If you send through a shared pool at a large ESP, the provider watches those IPs for you and your domain is the part you control. Once you run your own IPs, that job moves to you. A listing on a dedicated IP affects only you, and nobody else will notice it first.
- Senders with dedicated IPs at an ESP or on their own mail servers, where reputation belongs to one company.
- Hosting providers and MSPs that run mail for many clients and need to see a listing before the support tickets arrive.
- SaaS platforms that send transactional mail from their own infrastructure.
- Companies with an on-premise mail server or a relay that a compromised account could abuse.
How an IP blacklist lookup works
Receiving servers take the connecting IP, reverse its four octets and query the list zone. The IP 198.51.100.25 checked against Spamhaus ZEN becomes 25.100.51.198.zen.spamhaus.org. No record means clean. A 127.0.0.x answer means listed, and the last octet tells you which part of the list matched. On ZEN, 127.0.0.2 is the SBL, 127.0.0.4 is the XBL (often an infected device) and 127.0.0.10 or 127.0.0.11 is the PBL, a policy listing for ranges that should not send mail directly.
You can run that lookup yourself with dig, or use our free IP blacklist checker for a single address. The trouble starts when you have dozens of IPs and need the answer every few minutes, not once. If you want the background on how lists work, read what an IP blacklist is.
Monitoring many IPs at once
Paste a list of IPs into the bulk add box and each address is checked on its own, with alerts that name the exact IP, so a hosting provider sees which customer is affected. This matters for lists like UCEPROTECT level 2 and 3, which list an allocation or a whole network when enough single IPs in it misbehave. Watching every sending IP in the block shows the pattern building before the wider listing lands.
Each IP counts as one monitored asset: 10 on Starter, 100 on Business, 500 on Agency and 5,000 on Scale.
| Plan | IPs and domains | Check interval | Alert channels |
|---|---|---|---|
| Starter | 10 | 60 minutes | Email, Slack |
| Business | 100 | 15 minutes | Email, Slack, Teams, signed webhook |
| Agency | 500 | 5 minutes | Email, Slack, Teams, signed webhook |
| Scale | 5,000 | 5 minutes | Email, Slack, Teams, signed webhook |
Run a free check on your own domain or IP, then keep it monitored.
Check NowMore than blacklist status per IP
A clean blacklist result is not the whole story for an IP. Gmail and Outlook keep their own reputation that no public list shows. That is why each monitored IP also gets a reverse DNS check: the PTR record must exist and point to a hostname that resolves back to the same IP (forward-confirmed reverse DNS). Google and Yahoo have required valid reverse DNS for bulk senders since February 2024, and a missing PTR is one of the fastest ways to get rejected.
Microsoft SNDS and Google Postmaster Tools show the private side of that reputation for Outlook.com and Gmail, in their own consoles. Our monitoring covers the public side: every DNS blacklist and the PTR record, with an alert when either changes. Our IP reputation checker shows that public picture for a single IP.
What to do when an IP gets listed
- 1 Read the return code in the alert. It tells you whether the cause is spam reports, an infected machine, a policy range or a spam trap.
- 2 Stop the cause first. Pause the campaign, lock the compromised account, or clean the device. Removal requests made while the problem continues are usually refused or relisted.
- 3 Follow the removal steps for that list, linked from the alert. Spamhaus, Barracuda and SpamCop each work differently.
- 4 Watch for the delisting alert. If the IP is listed again within days, the cause is still active.
- 5 Check the rest of the range. One listed IP on a shared server often means a neighbor is the source.
Built for operators who run many IPs
Alerts go to email and Slack on every plan, and to Microsoft Teams and HMAC signed webhooks from Business up, so a hosting panel or ticket system can open an incident automatically when an IP is listed. Bulk import puts a label on each batch, so an MSP can add IPs client by client.
Every check is a DNS query. We never connect to your mail server and never send mail through your IPs. To see how IP checks fit with domain and authentication monitoring, see blacklist monitoring.
Frequently asked questions
How do I monitor my IP for blacklisting?
Add the IP to a monitoring service that queries the major DNS blacklists on a schedule and alerts you on change. Checking by hand works for one IP once, but it misses listings that happen overnight.
Why is my dedicated IP blacklisted when I send very little?
Low volume does not protect an IP. A single message to a spam trap, a compromised account, or a previous owner of the IP can cause a listing. New dedicated IPs also need warming before they carry full volume.
What is the Spamhaus PBL and do I need to remove my IP from it?
The PBL lists IP ranges that should not send mail directly, such as home broadband. If your mail server sits on such a range, send through a proper relay. If the range really is a mail server, the owner of the range can request removal.
Can I monitor an entire IP range?
Yes. On Scale you add the range in CIDR form, from a /22 to a /32, and every public address in it is checked on its own every 5 minutes, see IP range blacklist check. On other plans paste the addresses into the bulk add box. Each IP counts as one monitored asset, and alerts name the exact IP that was listed.
How often are IPs checked?
Every 60 minutes on Starter, every 15 minutes on Business, and every 5 minutes on Agency and Scale.