Which lists we query
Blocklists, often called blacklists or DNSBLs, are databases of domains and IP addresses seen sending spam, hosting malware or phishing. Mail servers and security filters query them in real time. We query the domain lists dbl.spamhaus.org, multi.uribl.com and multi.surbl.org for your domain, and the IP lists zen.spamhaus.org, bl.spamcop.net, b.barracudacentral.org, dnsbl.sorbs.net and psbl.surriel.com for your web server and mail server addresses.
Some lists refuse queries from large public resolvers and answer with special codes instead. We recognise those answers and report the list as could not check rather than claiming a listing.
What a listing means
If your mail server's IP is listed, receiving servers may reject or junk your messages. If your domain is on a domain blocklist, links to your website inside any email — including emails from clients forwarding your message — may cause it to be filtered. A listing of your web server's IP usually matters less for email, but on shared hosting it can reveal a neighbour sending spam from the same machine.
Most small firms use Microsoft 365 or Google Workspace, whose sending IPs are shared and well managed, so listings of the mail servers are rare. Domain listings are more often caused by a compromised website being used to host phishing pages.
If you are listed
- Find the cause first: a compromised website, an infected computer, a hacked mailbox or a newsletter sent to purchased addresses.
- Clean it up — update the CMS, change passwords, enable two-factor login and scan the site for injected pages.
- Use the list's own lookup and removal page; most have a self-service delisting process once the cause is fixed.
- On shared hosting, ask your provider to investigate or move you to a clean IP.
- Run this check again after delisting, and set up DMARC reports to spot abuse early.
Preventing listings
Most listings are preventable. Keep your website software updated so it cannot be abused to host phishing pages, protect mailboxes with strong passwords and two-factor login, send newsletters only to people who opted in, and publish DMARC with a reporting address so abuse of your domain becomes visible quickly. Check your listings after any security incident. Delisting can take from minutes to a few days depending on the list.