There is no single internet blacklist. Dozens of independent DNS-based blocklists exist, each with its own listing criteria and delisting process, and most consumer-facing blocks come from web reputation systems rather than the email blocklists people usually search for.
There is no such thing as the blacklist
The phrase implies a central authority. There is none. What exists is a set of independently operated lists, each maintained by a different organisation with its own criteria, its own evidence standards and its own removal process. Being on one says nothing about the others.
They also do not block anything. A blocklist publishes data; a mail server operator chooses to query it and chooses what to do with the answer. Some reject outright, some add a spam score, some only log. When your mail bounces, the decision was made by the receiving server, using a list as input.
The lists split into two broad families that are frequently confused. Email blocklists, usually DNSBLs, govern whether your mail is accepted. Web reputation systems govern whether websites challenge or block your browsing. They are operated by different companies, use different evidence, and have entirely separate remediation paths.
Working out which family is affecting you is the first step, because the wrong remediation accomplishes nothing. Bouncing email points to a DNSBL. CAPTCHAs and access denied pages point to web reputation.
Email blocklists: how they work
A DNSBL is queried through ordinary DNS. The client reverses the octets of the address in question, appends the blocklist's zone, and looks up an A record. An answer in 127.0.0.0/8 means listed, and the specific value encodes the reason. NXDOMAIN means not listed.
Spamhaus operates the most consequential lists, aggregated in a combined zone called Zen. Its sublists cover different situations. The SBL lists addresses observed sending spam. The CSS is a subset targeting snowshoe spam operations. The XBL lists addresses exhibiting compromise indicators such as open proxies and infected machines. The PBL is different in kind: it lists address ranges that should never send mail directly, which includes essentially all residential dynamic space, and inclusion there is a policy statement by the range's operator rather than an accusation of anything.
Other significant lists include Barracuda Reputation Block List, Proofpoint's Dynamic Reputation, UCEPROTECT, and Composite Blocking List data incorporated into the Spamhaus XBL. SORBS, long a fixture in these lists, was shut down in 2024 and any tool still checking it is out of date.
- 127.0.0.2: SBL, listed for spam sources.
- 127.0.0.3: CSS, snowshoe spam infrastructure.
- 127.0.0.4 through 127.0.0.7: XBL, compromised hosts, open proxies and malware.
- 127.0.0.9: SBL DROP, ranges advised for complete rejection at the network level.
- 127.0.0.10 and 127.0.0.11: PBL, address space that should not be sending mail directly.
- NXDOMAIN: not listed.
A PBL listing on a residential address is normal and expected. It does not mean you did anything wrong; it means your ISP declared that range as end-user space. Send mail through your provider's authenticated submission server on port 587 rather than delivering directly, and it is irrelevant.
Check your address in one command
The check is a DNS query and requires no third-party website. Reverse the octets, append the zone, and look up the A record. The loop below checks the major lists at once.
Note that Spamhaus rate-limits queries from public resolvers such as 1.1.1.1 and 8.8.8.8, and will return misleading results, often a listing that is not real, when queried through them. Use your ISP's resolver or a local recursive resolver for accurate answers.
- Query from a resolver that is not shared public infrastructure, or Spamhaus results will be unreliable.
- The TXT record usually contains a URL explaining the specific listing and its removal path.
- Forward-confirmed reverse DNS, where the PTR resolves to a hostname whose A record returns the same address, is required by many receiving servers independently of any blocklist.
- Check the address your mail actually leaves from, which for a relayed setup is not the same as your web-facing address.
IP=203.0.113.45
REV=$(echo $IP | awk -F. '{print $4"."$3"."$2"."$1}')
for BL in zen.spamhaus.org b.barracudacentral.org dnsbl.sorbs.net bl.spamcop.net psbl.surriel.com; do
RESULT=$(dig +short "$REV.$BL" A)
printf "%-28s %s\n" "$BL" "${RESULT:-not listed}"
done
# read the reason text where the list publishes one
dig +short "$REV.zen.spamhaus.org" TXT
# forward-confirmed reverse DNS, which matters as much as any listing
dig -x $IP +short
dig +short $(dig -x $IP +short | sed 's/\.$//') AWhy you got listed
Listings almost always have a concrete cause, and identifying it correctly determines whether delisting will stick.
A compromised device on your network is the most common cause for residential and small business addresses. Malware sending spam, a machine participating in a botnet, or an infected IoT device generating scanning traffic will all get an address listed within hours. Delisting without removing the infection results in immediate relisting.
An open relay or open resolver is the classic server misconfiguration. A mail server accepting relay from anywhere, or a DNS resolver answering recursive queries from the internet, will be found by scanners quickly and listed.
Inherited reputation affects dynamic and CGNAT addresses. The previous holder of your address sent spam, or another subscriber sharing your CGNAT address did, and you received the consequence with the address. You did nothing and can do nothing about the underlying behaviour.
Legitimate bulk mail sent badly is the cause for anyone running a mailing list. Poor list hygiene, purchased lists, missing unsubscribe handling, or a sudden volume increase from a cold address all produce complaints, and complaint rates above roughly 0.1 percent trigger listings at most operators.
Authentication failures compound everything. Mail without SPF, DKIM and DMARC alignment is treated as suspicious regardless of blocklist status, and fixing authentication frequently resolves delivery problems that were misattributed to a listing.
# check your sending domain's authentication records
dig +short TXT example.com | grep spf
dig +short TXT _dmarc.example.com
dig +short TXT selector1._domainkey.example.com
# confirm your server is not an open relay
swaks --to test@example.org --from test@example.net --server your.mail.server
# confirm your resolver is not open to the internet
dig @your.server.address example.com +shortGetting delisted
Fix the cause before requesting removal. Every operator relists automatically on continued evidence, and repeated removal requests without remediation lead some to refuse further self-service removal.
For Spamhaus, use the Blocklist Removal Center, which the TXT record links to directly. PBL removals for individual addresses are self-service and near-instant where the range operator permits them. SBL and XBL removals require the underlying issue to be resolved and are reviewed, typically within hours to a couple of days. Spamhaus does not charge for removal and any service demanding payment for a Spamhaus delisting is not affiliated with them.
For Barracuda, Proofpoint, SpamCop and PSBL, each publishes its own removal form. SpamCop listings expire automatically, typically within 24 hours of the last reported message, so no action is needed if the source is fixed. PSBL similarly expires.
UCEPROTECT is a special case worth knowing about. Its level 2 and level 3 lists cover entire ranges and ASNs based on the behaviour of others in them, and it offers paid express removal. Most receiving operators do not use its higher levels precisely because of this, so a listing there frequently has no practical effect on your delivery. Verify that it is actually causing bounces before spending anything.
After delisting, warm up. If mail volume from your address was interrupted, resume gradually rather than returning to full volume immediately, since a sudden spike from a recently delisted address is itself a listing trigger.
If your address is dynamic or behind CGNAT, none of this applies well. You cannot remediate a shared address's behaviour. Send mail through an authenticated relay, your ISP's submission server or a transactional email provider, which is the correct architecture for those connections regardless.
Do not pay a service that offers to remove you from all blacklists. The major operators run free removal processes, and no third party can remove a listing on your behalf. Money spent on this buys a form submission you could have made yourself.
Web reputation, which is a different system entirely
If your problem is CAPTCHAs, access denied pages, or being unable to reach sites rather than send mail, DNSBLs are not involved. Web reputation is scored by the bot-mitigation and CDN vendors sitting in front of the sites you are trying to reach, and their data is proprietary and largely unqueryable.
The inputs are different: request rates from the address, the ASN category, whether the address appears in proxy and VPN classification feeds, historical abuse observed by the vendor's own network, and the behaviour of the current session. A residential address enrolled in a residential proxy network scores badly for reasons its owner never sees.
There is no delisting form. The realistic remediations are to identify and remove whatever on your network is generating the traffic, to obtain a different address by renewing your DHCP lease or asking your ISP, or to wait, since most vendors decay reputation scores over weeks in the absence of further signals.
Cloudflare is the exception that offers some visibility. Its trace endpoint returns diagnostic information about how your connection is being seen, and its support process accepts reports of false positives from users who can identify the specific site and time.
The most productive question to ask is what changed. A new device, a new application, a router firmware update that enabled UPnP, or a household member installing a free VPN are all common causes of an address that was fine last month being challenged today.
# how Cloudflare sees your connection
curl -s https://www.cloudflare.com/cdn-cgi/trace
# your ASN category, which drives much of the scoring
whois -h whois.cymru.com " -v $(curl -4 -s https://ifconfig.co)"
# force a new lease and see whether the problem follows the address
# (power the modem off for several hours, or:)
sudo dhclient -r && sudo dhclient # Linux
ipconfig /release && ipconfig /renew # Windows, on a directly connected hostFrequently asked
How do I check if my IP is blacklisted?
Reverse your address's octets, append a blocklist zone, and query it: dig +short 45.113.0.203.zen.spamhaus.org A. Any answer in 127.0.0.0/8 means listed and the value encodes the reason. Query from a local or ISP resolver rather than 1.1.1.1 or 8.8.8.8, which Spamhaus rate-limits and which return unreliable results.
Why is my residential IP on the Spamhaus PBL?
Because your ISP declared that range as end-user space that should not deliver mail directly. It is a policy listing, not an accusation, and nearly all residential dynamic addresses are on it. Send through your provider's authenticated submission server on port 587 and it has no effect on you.
How long does delisting take?
Spamhaus PBL self-service removals are near-instant. SBL and XBL removals are reviewed and usually complete within hours to two days once the underlying issue is fixed. SpamCop and PSBL listings expire automatically, typically within 24 hours of the last report. Receiving servers may cache results for up to a few hours afterwards.
Can I get blacklisted for something someone else did?
Yes, routinely. Dynamic addresses inherit the previous holder's reputation, CGNAT addresses carry the behaviour of everyone sharing them, and range-level lists such as UCEPROTECT levels 2 and 3 list entire networks based on a subset of their users. In those cases individual remediation is not possible.
Why do I get CAPTCHAs everywhere but my IP is not on any blacklist?
Because web reputation and email blocklists are separate systems. CAPTCHAs come from bot-mitigation vendors scoring your address on request patterns, ASN category and proxy classification feeds, none of which are published or queryable. There is no delisting form; identify what on your network is generating traffic, or change address.