How to Check If Your Domain Is Blacklisted

If your emails are suddenly being rejected with "550 blocked" or "5.7.1 rejected" errors, your domain or server IP may be on a blacklist (also called a blocklist, RBL, or DNSBL). Blacklists are databases of IPs and domains known to send spam.

This guide shows you how to check if you're blacklisted, understand why it happened, and get delisted.

Quick Fix Checklist

• ✅ Check your IP on MXToolbox Blacklist Check: mxtoolbox.com/blacklists
• ✅ Check on Spamhaus: check.spamhaus.org
• ✅ Check your domain reputation on Google Postmaster Tools
• ✅ Identify the root cause (compromised account, open relay, malware)
• ✅ Fix the issue before requesting delisting
• ✅ Submit delisting requests to each blacklist

Major Blacklists to Check

IP-Based Blacklists (RBLs)

Blacklist	Check URL	Impact
Spamhaus SBL/XBL	check.spamhaus.org	Critical — used by most servers
Barracuda BRBL	barracudacentral.org/lookups	High — used by corporate mail
SpamCop	spamcop.net/bl.shtml	High — auto-expires after 24h
SORBS	sorbs.net	Medium
CBL (Composite)	abuseat.org/lookup.html	High — detects bots/malware

Domain-Based Blacklists (DBLs)

• Spamhaus DBL: Checks domain reputation (separate from IP)
• SURBL: Checks URLs found inside spam messages
• URIBL: Similar to SURBL, checks links in email bodies

How to Check — Command Line

Check IP Against Spamhaus

# Reverse your IP and query the Spamhaus ZEN zone
# For IP 203.0.113.10:
dig +short 10.113.0.203.zen.spamhaus.org

# If listed: returns 127.0.0.x (x indicates which list)
# 127.0.0.2 = SBL (direct spam source)
# 127.0.0.3 = SBL CSS (spam from hijacked space)
# 127.0.0.4-7 = XBL (exploited systems)
# 127.0.0.10-11 = PBL (policy block, dynamic IPs)

# If NOT listed: returns NXDOMAIN (empty result)

Check IP Against Multiple Lists

# Script to check common blacklists
IP="203.0.113.10"
REVERSED=$(echo $IP | awk -F. '{print $4"."$3"."$2"."$1}')

LISTS=(
  "zen.spamhaus.org"
  "bl.spamcop.net"
  "b.barracudacentral.org"
  "dnsbl.sorbs.net"
  "cbl.abuseat.org"
  "dnsbl-1.uceprotect.net"
)

for LIST in "${LISTS[@]}"; do
  RESULT=$(dig +short "$REVERSED.$LIST" 2>/dev/null)
  if [ -n "$RESULT" ]; then
    echo "⛔ LISTED on $LIST → $RESULT"
  else
    echo "✅ Clean on $LIST"
  fi
done

Check Domain Reputation

# Check domain against Spamhaus DBL
dig +short yourdomain.com.dbl.spamhaus.org

# Check against SURBL
dig +short yourdomain.com.multi.surbl.org

# Check against URIBL
dig +short yourdomain.com.multi.uribl.com

# Empty result (NXDOMAIN) = not listed

Common Causes of Blacklisting

1. Compromised Email Account

A user's email password was guessed/stolen and used to send spam:

# Check for suspicious outbound email volume
# Exim (cPanel):
exim -bpc  # Total queue size
exigrep "From:" /var/log/exim_mainlog | awk '{print $5}' | sort | uniq -c | sort -rn | head -10

# Postfix:
cat /var/log/mail.log | grep "from=" | awk -F'from=' '{print $2}' | awk -F',' '{print $1}' | sort | uniq -c | sort -rn | head -10

2. Open Relay

Your server accepts and forwards email from anyone (misconfigured SMTP):

# Test if your server is an open relay
# From an external machine:
telnet your-server-ip 25
HELO test
MAIL FROM:
RCPT TO:
# If you get "250 OK" for RCPT TO with an external address, 
# your server is an open relay!

# Should respond with: "550 relay not permitted"

3. No Authentication (SPF/DKIM/DMARC Missing)

Without email authentication, your domain looks like it could be spoofed:

# Quick authentication check
dig TXT yourdomain.com +short | grep "spf"
dig TXT default._domainkey.yourdomain.com +short
dig TXT _dmarc.yourdomain.com +short

# All three should return valid records

4. Shared IP Reputation

On shared hosting, another user on the same IP may have caused the blacklisting. This is why VPS with dedicated IPs is preferred for business email.

How to Request Delisting

General Process

1. Fix the root cause first — don't delist before fixing the problem
2. Find the delisting page for each blacklist
3. Submit a removal request with your IP/domain
4. Wait for processing (minutes to 48 hours)
5. Monitor to ensure you don't get re-listed

Delisting Links for Major Blacklists

• Spamhaus: https://check.spamhaus.org/listed/ → Click "Remove" after review
• Barracuda: https://barracudacentral.org/lookups/lookup-reputation → Request removal
• SpamCop: Auto-delists after 24 hours if no new spam is received
• SORBS: http://www.sorbs.net/overview.shtml → Submit removal
• CBL: https://www.abuseat.org/lookup.html → Self-service removal

Prevention

• Use strong passwords for all email accounts
• Enable rate limiting (max emails per hour per account)
• Set up SPF, DKIM, and DMARC (guide here)
• Configure proper PTR records (guide here)
• Monitor your mail queue daily: exim -bpc
• Use a dedicated IP for sending email (not shared hosting)
• Set up Google Postmaster Tools for domain reputation monitoring

Common Mistakes

• Requesting delisting before fixing the issue: You'll get re-listed within hours
• Ignoring PBL listings: Spamhaus PBL is for dynamic/residential IPs — it's by design, not a punishment. Use your ISP's SMTP relay instead
• Not checking all blacklists: Being clean on one doesn't mean clean on all. Always check multiple lists
• Using shared hosting for bulk email: Get a VPS with a dedicated IP for business email
• Not monitoring after delisting: Set up weekly checks to catch new listings early

Frequently Asked Questions

How long does delisting take?

It varies by blacklist. SpamCop auto-delists in 24 hours. Spamhaus typically processes removal requests within a few hours. Barracuda can take 12-48 hours. Some smaller lists may take up to a week.

My IP is clean but domain is blacklisted — what do I do?

Domain blacklists (DBLs) are separate from IP blacklists. Check Spamhaus DBL, SURBL, and URIBL specifically. Domain blacklisting usually happens when your domain appears in spam messages sent from any IP. You need to investigate if your domain is being spoofed (check your DMARC policy).

Can I check blacklists automatically on a schedule?

Yes! Use a monitoring service like HetrixTools (free for up to 15 monitors), UptimeRobot, or set up a cron job using the dig-based script in this article. Run it daily and send alerts via email or webhook when listings are detected.

Is being on the Spamhaus PBL bad?

Not necessarily. The PBL (Policy Block List) lists IP ranges that shouldn't send email directly — typically dynamic/residential IPs. If you're on PBL, configure your email client to send through your ISP's or provider's SMTP server instead of directly from your IP. For VPS servers, PBL listing is unusual and should be investigated.