Who needs IP level monitoring
If you send through a shared pool at a large ESP, the provider watches those IPs for you and your domain is the part you control. Once you run your own IPs, that job moves to you. A listing on a dedicated IP affects only you, and nobody else will notice it first.
- Senders with dedicated IPs at an ESP or on their own mail servers, where reputation belongs to one company.
- Hosting providers and MSPs that run mail for many clients and need to see a listing before the support tickets arrive.
- SaaS platforms that send transactional mail from their own infrastructure.
- Companies with an on-premise mail server or a relay that a compromised account could abuse.
How an IP blacklist lookup works
Receiving servers take the connecting IP, reverse its four octets and query the list zone. The IP 198.51.100.25 checked against Spamhaus ZEN becomes 25.100.51.198.zen.spamhaus.org. No record means clean. A 127.0.0.x answer means listed, and the last octet tells you which part of the list matched. On ZEN, 127.0.0.2 is the SBL, 127.0.0.4 is the XBL (often an infected device) and 127.0.0.10 or 127.0.0.11 is the PBL, a policy listing for ranges that should not send mail directly.
You can run that lookup yourself with dig, or use our free IP blacklist checker for a single address. The trouble starts when you have dozens of IPs and need the answer every few minutes, not once. If you want the background on how lists work, read what an IP blacklist is.
Monitoring whole CIDR ranges
On the Scale plan you can add a range such as 198.51.100.0/24 instead of 256 single entries. Each address in the range is checked on its own, and alerts name the exact IP, so a hosting provider sees which customer is affected. This matters for lists like UCEPROTECT level 2 and 3, which list an allocation or a whole network when enough single IPs in it misbehave. Watching the full range shows the pattern building before the wider listing lands.
Ranges are counted against the 5,000 domains and IPs on Scale. Smaller plans monitor single IPs: 10 on Starter, 100 on Business and 500 on Agency.
| Plan | IPs and domains | Check interval | CIDR ranges |
|---|---|---|---|
| Starter | 10 | 60 minutes | No |
| Business | 100 | 15 minutes | No |
| Agency | 500 | 5 minutes | No, bulk import instead |
| Scale | 5,000 | 5 minutes | Yes |
Run a free check on your own domain or IP, then keep it monitored.
Check NowMore than blacklist status per IP
A clean blacklist result is not the whole story for an IP. Gmail and Outlook keep their own reputation that no public list shows. That is why each monitored IP also gets a reverse DNS check: the PTR record must exist and point to a hostname that resolves back to the same IP (forward-confirmed reverse DNS). Google and Yahoo have required valid reverse DNS for bulk senders since February 2024, and a missing PTR is one of the fastest ways to get rejected.
On Business and above you can connect Microsoft SNDS, which reports complaint rates and trap hits per IP for Outlook.com, and Google Postmaster Tools for domain and IP reputation at Gmail. Those signals sit next to the blacklist results, so you can tell whether a drop in opens is a listing, a reputation problem or both. Our IP reputation checker shows the public part of that picture for free.
What to do when an IP gets listed
- 1 Read the return code in the alert. It tells you whether the cause is spam reports, an infected machine, a policy range or a spam trap.
- 2 Stop the cause first. Pause the campaign, lock the compromised account, or clean the device. Removal requests made while the problem continues are usually refused or relisted.
- 3 Follow the removal steps for that list, linked from the alert. Spamhaus, Barracuda and SpamCop each work differently.
- 4 Watch for the delisting alert. If the IP is listed again within days, the cause is still active.
- 5 Check the rest of the range. One listed IP on a shared server often means a neighbor is the source.
Built for operators who run many IPs
Alerts go to email and Slack on every plan, and to Microsoft Teams and webhooks from Business up. Scale adds a REST API and signed webhooks, so a hosting panel or ticket system can open an incident automatically when an IP is listed. Agency and Scale include bulk import, tags and client workspaces, so an MSP can group IPs by client and hand each client a clean report.
Every check is a DNS query. We never connect to your mail server and never send mail through your IPs. To see how IP checks fit with domain and authentication monitoring, see blacklist monitoring.
Frequently asked questions
How do I monitor my IP for blacklisting?
Add the IP to a monitoring service that queries the major DNS blacklists on a schedule and alerts you on change. Checking by hand works for one IP once, but it misses listings that happen overnight.
Why is my dedicated IP blacklisted when I send very little?
Low volume does not protect an IP. A single message to a spam trap, a compromised account, or a previous owner of the IP can cause a listing. New dedicated IPs also need warming before they carry full volume.
What is the Spamhaus PBL and do I need to remove my IP from it?
The PBL lists IP ranges that should not send mail directly, such as home broadband. If your mail server sits on such a range, send through a proper relay. If the range really is a mail server, the owner of the range can request removal.
Can I monitor an entire IP range?
Yes, on the Scale plan. Add a CIDR range and each address is checked on its own, with alerts naming the exact IP that was listed.
How often are IPs checked?
Every 60 minutes on Starter, every 15 minutes on Business, and every 5 minutes on Agency and Scale.