LearnDeliverability and reputation

What is an email blacklist?

An email blacklist, properly a DNSBL, is a DNS-published list of IP addresses or domains suspected of sending spam. Receivers query it during the SMTP conversation and decide what to do. There are hundreds; perhaps six meaningfully affect whether your mail is delivered.

Written by the SieveGuard team from the checks our own free tools run. Last reviewed .

How a lookup actually works

A DNSBL is not a database you query over an API. It is an ordinary DNS zone, and a listing is an ordinary A record. To ask whether 203.0.113.7 is listed, a receiver reverses the octets and looks up a name:

7.113.0.203.zen.spamhaus.org      A?
→ 127.0.0.4     listed — and the last octet says WHICH sub-list
→ NXDOMAIN      not listed

Two consequences follow. Lookups are effectively free and instantaneous, which is why receivers do them on every connection. And the return value carries meaning: the final octet distinguishes sub-lists with very different implications, which is why "you are on Spamhaus" is not a diagnosis on its own.

The lists are not equal

This is the part that gets flattened everywhere else. Checking against ninety lists is easy; knowing which results matter is the whole skill.

ListWho uses itIf you are on it
Spamhaus ZEN (SBL/CSS/XBL/PBL)Almost everyoneAct today. Highest-impact listing there is
Spamhaus DBL (domains)WidelyAct today — this one follows you across IPs
BarracudaBarracuda appliances, common in enterpriseWorth resolving; free removal form
SpamCopModerate; some hosts use it advisory-onlyAuto-expires in about 24 hours; fix the cause
SORBSDecliningLow priority
UCEPROTECT L1NicheLow priority
UCEPROTECT L2 / L3Almost nobodyIgnore. See below
Most of the remaining long tailEffectively nobodyInformational only

A hit on Spamhaus ZEN and a hit on an obscure regional list are not comparable events, and a tool that reports them identically is giving you a number rather than an answer.

UCEPROTECT levels 2 and 3, specifically

Worth its own section because it generates more unnecessary alarm than any other listing.

  • Level 1 lists individual IPs that actually sent spam. Legitimate, if aggressive.
  • Level 2 lists the entire allocation your IP sits in, because someone else in it sent spam.
  • Level 3 lists the whole autonomous system — every IP your hosting provider operates.

On L2 or L3 you are listed for being a customer of a large hosting provider. You did nothing, you can do nothing, and hardly any receiver consults those levels. Express delisting is available for a fee, which is a fact worth weighing when deciding how much authority to grant the listing.

Check whether it is L1 before spending any time on it. L1 is a real signal about your own sending; L2 and L3 are a signal about your neighbours.

IP listings and domain listings are different problems

IP-based (SBL, XBL, Barracuda…)Domain-based (DBL, SURBL, URIBL)
ListsThe sending server’s addressA domain appearing in the message
On a shared ESP IPOften not your doingAlways yours
Escaping itChange IP, or get the IP delistedNo escape — the domain is the identity
Typical causeCompromised host, bad neighbour, sudden volumeYour domain appeared in spam sent by someone else, or your own list is bad

Domain listings are the more serious of the two and the more often overlooked. An IP listing can be outrun by moving; a domain listing follows the domain everywhere, including to a new ESP. Domains also get listed for appearing as a link in spam — so an affiliate or a compromised page on your site can list you without you sending anything.

What to do about a listing that matters

Find the cause before requesting removal

Delisting without fixing the cause gets you relisted, usually within days, and repeated removal requests are themselves a negative signal. Most listings trace to one of four things: a compromised account or server sending without your knowledge, a sudden volume increase that looked like a burst, a list containing spam traps, or a genuinely bad neighbour on a shared IP.

Then use the list’s own process

Every reputable list publishes one, and it is always free. Spamhaus has a removal form per sub-list. Barracuda has a form. SpamCop expires automatically once the reports stop. Nothing legitimate charges you.

Treat paid express delisting as what it is

Some lists offer it. That is a commercial arrangement, not a technical remedy, and it says something about how much weight receivers should give the list. Never pay to be removed from a list you have not confirmed anyone consults.

Then monitor, because listings arrive silently

Nothing notifies you. Delivery simply degrades, and you find out from a customer. Check on demand, or have something check daily for you.

A listing is one input, not a verdict

Receivers combine it with authentication, engagement and their own history with you. A domain with strong sender reputation can carry a minor listing with little visible effect; a new domain with none cannot.

Which cuts both ways. Being listed nowhere does not mean your mail is delivering — plenty of spam placement happens with no listing involved at all.

Sources

FAQ

How many blacklists should I actually care about?+

Roughly six. Spamhaus ZEN and DBL carry the most weight by a wide margin, then Barracuda and SpamCop. Most of the long tail is consulted by almost nobody and a hit there is informational rather than actionable.

I am listed on UCEPROTECT level 2. What do I do?+

Almost certainly nothing. Level 2 lists an entire IP allocation because someone else in it sent spam, so you are listed for being a customer of a large host. Very few receivers consult it. Confirm you are not also on level 1, which is about your own sending, and move on.

How do I get delisted?+

Find and fix the cause first, then use the list’s own removal form — every reputable list publishes one and it is free. Requesting removal without fixing the cause gets you relisted within days, and repeated requests are themselves a negative signal.

What is the difference between an IP listing and a domain listing?+

An IP listing targets the sending server and can be escaped by moving to a different IP. A domain listing targets your domain and follows it everywhere, including to a new provider. Domain listings are the more serious of the two and the more often missed.

I am listed but my mail still gets delivered. How?+

Because a listing is one input among many. Receivers weigh it against your authentication, your engagement history and their own record of you. A minor listing on a list few consult may have no visible effect at all.

Should I pay for express delisting?+

No. Every list that receivers genuinely rely on removes you for free once the cause is fixed. A list charging for removal is telling you something about its own business model, and paying it does not improve your delivery anywhere that matters.

Check it on a real domain

Free, no signup, DNS-only. Nothing you type leaves the lookup.

Keep reading