By Ahmet Karaca · Updated · Checked against RFC 5782 (DNS blacklists), SpamCop's blocking list FAQ, PSBL, Mailspike's usage terms, UCEPROTECT and Spamhaus's DNSBL usage terms on
What a DNS blocklist is
A DNS blocklist (DNSBL) is a list of IP addresses that sent spam or behaved like a spam source. Mail servers look up the address of every connecting server in the lists they trust and reject or score the message when it is listed. A listing on a list your recipients use can send your mail to spam or bounce it outright, even when SPF, DKIM and DMARC all pass.
Domain or IP: what to enter
Receivers look up the address of the server that connects to them, so the IP your mail goes out from is the one that matters for your sending reputation. Enter it if you know it; the Email header analyzer shows the delivery path of a message you sent, and the sending server's IP is in the first hop outside your own network.
For a domain we check its mail servers (MX), the servers that receive its mail. They are often not the servers that send it, especially when you use a hosted mailbox or a separate sending service, and with a hosted mailbox they belong to your provider: a listing there is about the provider's shared infrastructure rather than your domain. When a domain has no MX record we check the address of the domain itself, and when it publishes a null MX we say so and check nothing. At most 8 IPv4 addresses are checked per domain, in MX priority order.
How the check works
Each address is looked up in each list through DNS, as RFC 5782 describes. Only an answer the list documents as "listed" counts as listed, and only a "no such name" answer counts as not listed. Anything else, including a timeout, a refusal or an unknown code, is shown as not checked, never as clean. Answers are reused for 15 minutes so the lists aren't asked the same question twice, we stay well under each list's daily query allowance, and every hour we test each list with its own test entries and skip one that answers wrongly.
The summary counts lists, not answers. A list counts as listed when any checked address is on it, and as checked when every address got a clear answer from it. A list that couldn't answer for one of the addresses is counted apart as "couldn't be checked".
Asking a list about an address shows that address to the list operator and to the DNS resolvers in between. That is how DNS blocklists work; Patchkit doesn't store the address or log it.
The lists we check
- SpamCop (
bl.spamcop.net): addresses reported by SpamCop users; listings expire on their own. - PSBL (
psbl.surriel.com): addresses that sent mail to spam traps; anyone can remove an address. - Mailspike (
bl.mailspike.net): Mailspike's block list, which combines addresses caught in active spam waves with the ones its reputation data ranks as bad. - UCEPROTECT Level 1 (
dnsbl-1.uceprotect.net): single addresses only. Levels 2 and 3 list whole networks and would flag innocent neighbors, so we leave them out.
The lists we don't check
Spamhaus doesn't allow tools like this one to query its lists for free; check your IP directly at check.spamhaus.org. Barracuda requires the querying DNS server to be registered in advance, which a shared cloud resolver can't be. SORBS was shut down in 2024. SURBL and similar lists cover domains and links rather than sending IPs.
What this tool checks
- An IPv4 address you enter, or a domain's MX servers (its own address when there is no MX).
- Each address against the 4 lists above, with the list's own explanation and removal page when an address is listed.
- A summary that counts the lists an address is on and reports the ones that couldn't be checked separately.
What it doesn't check
- Spamhaus, Barracuda and domain or URL blocklists.
- IPv6 addresses: you can enter one, but none of these lists publishes IPv6 data, so we report it as not covered.
- Private and reserved addresses, which can't be on a public list.
- The servers a domain sends from, unless you enter their IP: a domain check covers its MX servers only.
- Your sending reputation at Gmail, Outlook or Yahoo, which those providers keep to themselves.
- Reverse DNS: the PTR checker checks that the same address has a PTR name that resolves back to it.
Listed and wondering what the big providers expect? Gmail, Yahoo and Outlook sender requirements lists what each one checks.