Email blacklists—also called DNSBLs or RBLs—are DNS-based lists that mark IP addresses or domains associated with spam. If your mail server IP appears on a major list, inbox providers may reject or filter your mail before authentication even matters.
How DNSBL lookups work
Most IP blocklists use a reversed-IP query pattern:
{reversed-ip}.{blacklist-zone}Example: if your mail server is 93.184.216.34, a lookup might query:
34.216.184.93.zen.spamhaus.orgIf the DNS response is 127.0.0.x, the IP is listed. No response usually means not listed.
Blocklists worth checking
FeedPipeline scans these zones during every domain audit:
| Zone | Operator |
|---|---|
zen.spamhaus.org | Spamhaus (combined ZEN) |
sbl.spamhaus.org | Spamhaus SBL |
xbl.spamhaus.org | Spamhaus XBL |
bl.spamcop.net | SpamCop |
dnsbl.sorbs.net | SORBS |
b.barracudacentral.org | Barracuda |
dnsbl-1.uceprotect.net | UCEPROTECT Level 1 |
dnsbl-2.uceprotect.net | UCEPROTECT Level 2 |
dnsbl-3.uceprotect.net | UCEPROTECT Level 3 |
cbl.abuseat.org | CBL (Spamhaus) |
psbl.surriel.com | PSBL |
We also check URIBL domain lists (multi.surbl.org, multi.uribl.com) for domain reputation—not just the sending IP.
Where the IP comes from
Blacklist checks use the primary MX host of your domain:
- Look up MX records for
yourdomain.com - Resolve the first MX hostname to an IPv4 address
- Query blocklists against that IP
If you send through a third-party SMTP relay, the listed IP may be the ESP’s—not your website server. That is normal; monitor the IP your mail actually exits from.
What to do if you are listed
- Identify the list — each zone has its own delisting process
- Stop the cause — compromised form, open relay, bad list purchase, volume spike
- Request removal — follow the operator’s delisting portal
- Wait for propagation — DNS TTLs mean changes are not instant
- Re-scan before resuming campaigns
Listing on Spamhaus ZEN alone can severely limit Gmail and Microsoft delivery.
Blacklists vs authentication
| Issue | Symptom |
|---|---|
| Blacklisted IP | Blocks at connect or high spam folder rate across many receivers |
| Bad SPF/DKIM | Authentication fails in headers; more variable by receiver |
| Low engagement | Gradual reputation decline—not always a DNSBL listing |
Run authentication and blacklist checks together. Our free checker does both in under a minute.
Prevention habits
- Warm up new domains and IPs gradually
- Never send from IPs shared with questionable senders unless you trust the pool
- Monitor blocklists weekly on production sending domains
- Fix forward DNS (PTR) and authentication before scaling volume
A clean blacklist scan is not a guarantee of inbox placement—but a listed IP is one of the fastest ways to kill deliverability overnight.