How to check if your mail server is blacklisted

A DNS blocklist (DNSBL) is a list of IP addresses that have sent spam or other abuse. Receiving servers query it over DNS and may refuse or filter mail from listed addresses.

1. Find your mail IPs

• Your MX hosts: dig +short MX example.com, then dig +short A on each host.
• The addresses you send from: the ip4: entries and hosts in your SPF record, or the Received: headers of a message you sent.

If you send through Microsoft 365, Google Workspace or another large provider, the sending IPs are shared and managed by that provider; a listing there is for them to deal with.

2. Query the list

Reverse the four parts of the IP and append the list's zone. For 192.0.2.25 on UCEPROTECT Level 1:

dig +short 25.2.0.192.dnsbl-1.uceprotect.net A

• No answer (NXDOMAIN): not listed.
• An address in 127.0.0.0/8, such as 127.0.0.2: listed. Many lists also publish a TXT record with the reason.

Some lists refuse queries that come through large public resolvers and answer with an error code in 127.255.255.0/24 instead. That is not a listing; query them as their own documentation says.

3. If you are listed

1. Find and stop the cause first: a compromised mailbox or password, an infected machine, an open relay, or a web form sending mail to anyone.
2. Read the list's own page for the IP: it says why and how removal works. UCEPROTECT Level 1 entries expire on their own 7 days after the last incident.
3. Check again after the fix, and keep SPF, DKIM and DMARC in order (see the SPF, DKIM and DMARC guides).