What is an email blacklist?
An email blacklist, properly a DNSBL, is a DNS-published list of IP addresses or domains suspected of sending spam. Receivers query it during the SMTP conversation and decide what to do. There are hundreds; perhaps six meaningfully affect whether your mail is delivered.
Written by the SieveGuard team from the checks our own free tools run. Last reviewed .
How a lookup actually works
A DNSBL is not a database you query over an API. It is an ordinary DNS zone, and a listing is an ordinary A record. To ask whether 203.0.113.7 is listed, a receiver reverses the octets and looks up a name:
7.113.0.203.zen.spamhaus.org A? → 127.0.0.4 listed — and the last octet says WHICH sub-list → NXDOMAIN not listed
Two consequences follow. Lookups are effectively free and instantaneous, which is why receivers do them on every connection. And the return value carries meaning: the final octet distinguishes sub-lists with very different implications, which is why "you are on Spamhaus" is not a diagnosis on its own.
The lists are not equal
This is the part that gets flattened everywhere else. Checking against ninety lists is easy; knowing which results matter is the whole skill.
| List | Who uses it | If you are on it |
|---|---|---|
| Spamhaus ZEN (SBL/CSS/XBL/PBL) | Almost everyone | Act today. Highest-impact listing there is |
| Spamhaus DBL (domains) | Widely | Act today — this one follows you across IPs |
| Barracuda | Barracuda appliances, common in enterprise | Worth resolving; free removal form |
| SpamCop | Moderate; some hosts use it advisory-only | Auto-expires in about 24 hours; fix the cause |
| SORBS | Declining | Low priority |
| UCEPROTECT L1 | Niche | Low priority |
| UCEPROTECT L2 / L3 | Almost nobody | Ignore. See below |
| Most of the remaining long tail | Effectively nobody | Informational only |
A hit on Spamhaus ZEN and a hit on an obscure regional list are not comparable events, and a tool that reports them identically is giving you a number rather than an answer.
UCEPROTECT levels 2 and 3, specifically
Worth its own section because it generates more unnecessary alarm than any other listing.
- Level 1 lists individual IPs that actually sent spam. Legitimate, if aggressive.
- Level 2 lists the entire allocation your IP sits in, because someone else in it sent spam.
- Level 3 lists the whole autonomous system — every IP your hosting provider operates.
On L2 or L3 you are listed for being a customer of a large hosting provider. You did nothing, you can do nothing, and hardly any receiver consults those levels. Express delisting is available for a fee, which is a fact worth weighing when deciding how much authority to grant the listing.
Check whether it is L1 before spending any time on it. L1 is a real signal about your own sending; L2 and L3 are a signal about your neighbours.
IP listings and domain listings are different problems
| IP-based (SBL, XBL, Barracuda…) | Domain-based (DBL, SURBL, URIBL) | |
|---|---|---|
| Lists | The sending server’s address | A domain appearing in the message |
| On a shared ESP IP | Often not your doing | Always yours |
| Escaping it | Change IP, or get the IP delisted | No escape — the domain is the identity |
| Typical cause | Compromised host, bad neighbour, sudden volume | Your domain appeared in spam sent by someone else, or your own list is bad |
Domain listings are the more serious of the two and the more often overlooked. An IP listing can be outrun by moving; a domain listing follows the domain everywhere, including to a new ESP. Domains also get listed for appearing as a link in spam — so an affiliate or a compromised page on your site can list you without you sending anything.
What to do about a listing that matters
Find the cause before requesting removal
Delisting without fixing the cause gets you relisted, usually within days, and repeated removal requests are themselves a negative signal. Most listings trace to one of four things: a compromised account or server sending without your knowledge, a sudden volume increase that looked like a burst, a list containing spam traps, or a genuinely bad neighbour on a shared IP.
Then use the list’s own process
Every reputable list publishes one, and it is always free. Spamhaus has a removal form per sub-list. Barracuda has a form. SpamCop expires automatically once the reports stop. Nothing legitimate charges you.
Treat paid express delisting as what it is
Some lists offer it. That is a commercial arrangement, not a technical remedy, and it says something about how much weight receivers should give the list. Never pay to be removed from a list you have not confirmed anyone consults.
Then monitor, because listings arrive silently
Nothing notifies you. Delivery simply degrades, and you find out from a customer. Check on demand, or have something check daily for you.
A listing is one input, not a verdict
Receivers combine it with authentication, engagement and their own history with you. A domain with strong sender reputation can carry a minor listing with little visible effect; a new domain with none cannot.
Which cuts both ways. Being listed nowhere does not mean your mail is delivering — plenty of spam placement happens with no listing involved at all.
Sources
FAQ
How many blacklists should I actually care about?+
Roughly six. Spamhaus ZEN and DBL carry the most weight by a wide margin, then Barracuda and SpamCop. Most of the long tail is consulted by almost nobody and a hit there is informational rather than actionable.
I am listed on UCEPROTECT level 2. What do I do?+
Almost certainly nothing. Level 2 lists an entire IP allocation because someone else in it sent spam, so you are listed for being a customer of a large host. Very few receivers consult it. Confirm you are not also on level 1, which is about your own sending, and move on.
How do I get delisted?+
Find and fix the cause first, then use the list’s own removal form — every reputable list publishes one and it is free. Requesting removal without fixing the cause gets you relisted within days, and repeated requests are themselves a negative signal.
What is the difference between an IP listing and a domain listing?+
An IP listing targets the sending server and can be escaped by moving to a different IP. A domain listing targets your domain and follows it everywhere, including to a new provider. Domain listings are the more serious of the two and the more often missed.
I am listed but my mail still gets delivered. How?+
Because a listing is one input among many. Receivers weigh it against your authentication, your engagement history and their own record of you. A minor listing on a list few consult may have no visible effect at all.
Should I pay for express delisting?+
No. Every list that receivers genuinely rely on removes you for free once the cause is fixed. A list charging for removal is telling you something about its own business model, and paying it does not improve your delivery anywhere that matters.
Check it on a real domain
Free, no signup, DNS-only. Nothing you type leaves the lookup.