Check an IPv4 address or a domain against the major DNS-based spam and abuse blocklists (DNSBLs), one or a whole list at once.
Enter an IPv4 address to check its blacklist status
A DNSBL (DNS-Based Blackhole List) is a database of IP addresses known to send spam or engage in abuse, published as a DNS zone. Mail servers query these lists in real time before accepting incoming messages - if the sending IP resolves, the message is rejected or tagged. This tool checks an IP address against 26 DNSBLs in parallel (a domain against 8 domain lists). The queries go through VLANlab's own DNS resolver, because Spamhaus refuses queries that arrive through public resolvers; Cloudflare DNS over HTTPS is used only when that resolver does not answer.
DNSBL lookups use a reversed-octet format. To check 1.2.3.4 against zen.spamhaus.org, the tool queries the A record for 4.3.2.1.zen.spamhaus.org. An NXDOMAIN response means the IP is clean. Any A record response (typically in the 127.0.0.x range) means the IP is listed - the specific value encodes the reason.
For Spamhaus ZEN: 127.0.0.2 = SBL (confirmed spam source), 127.0.0.3 = SBL CSS (compromised/hijacked), 127.0.0.4-7 = XBL (infected machine/bot), 127.0.0.10-11 = PBL (ISP range not authorized to send mail). For most other lists, any A record simply means the IP is listed.
Each blacklist has its own delisting process. Spamhaus offers a lookup and self-delist portal for PBL listings; SBL and XBL require the underlying problem to be fixed first. SpamCop listings expire automatically as reports age out. UCEProtect offers a paid fast-track removal but a free process also exists. For most lists, stopping the offending behavior and waiting is the correct approach.