IP blacklist check: is this address on a list?

Somebody put the address on a list, and that is all it means by itself.

Lists differ in what they collect. Some record addresses seen sending unsolicited mail, some record networks that allow it, some record ranges assigned to hosting rather than to households, and some record what was observed years ago and never revisited. Being named by one says something narrow; being named by several says the same thing several times if they share a source.

That is why the useful answer is which lists name an address, one by one, rather than a verdict. The lists disagree by design, and flattening them into a single answer would discard the only part that carries information.

Most listings come from mail. A machine on the address sent spam, often because it was compromised; a mail server accepted and relayed mail for anyone; or mail arrived at spam traps, addresses that exist only to catch senders who never had permission. Some lists also name addresses seen in attacks or scanning.

Sometimes the address did nothing wrong under its current user. Addresses are reassigned, so a new server can inherit a listing from a previous tenant, and on shared hosting one customer's mail can list the address for everyone on it. That is why the reason given by the list matters more than the fact of the listing.

Every public blocklist answers the same kind of question, and you can ask it directly.

1. Ask the list through the naming system. Most lists are published as DNS zones, a convention written down in RFC 5782. Reverse the four parts of the address, append the list's zone, and look the name up: an answer means the address is listed, and no answer means it is not. Each list publishes its own zone name and terms of use, and some refuse queries that arrive through large public resolvers.
2. Or use the operator's own lookup page. The large operators run one, and it usually shows the reason for a listing and the removal route next to the answer: Spamhaus, Barracuda, SpamCop.
3. Write the answers down list by list. Which list, what it says the listing is for, and when it was made. The next two sections work from that record.

A domain blacklist check asks a list that names domains, not addresses, whether a given domain is on it, and an email blacklist lookup asks the same about the names a mail message carries. According to RFC 5782, a few lists work this way; they are sometimes called right-hand-side blacklists. Address lists are the far more common kind, so most results still come from the lookups above.

Domain blacklist lookup in DNS

A domain blacklist lookup works like an address check, with a different name. For a domain blacklist check, put the domain in front of the list's zone name and look it up. An answer means the domain is listed, and the TXT record may carry the reason.

Domain blacklist test

A domain blacklist test starts with the list itself: test it before trusting its silence. RFC 5782 requires a domain list to hold an entry for the reserved name TEST and to hold none for the reserved name INVALID. Look up TEST.<list zone>, which should answer, and INVALID.<list zone>, which should not. A list that answers for both has a wildcard in place or is broken, and its answers mean nothing.

Email blacklist lookup: which names to try

A mail problem can attach to more than one name. The sending server's address is one; the domain in the sender's address is another, and so are the host names in the message headers and the domains in links inside the message body. RFC 5782 records name lists being used for exactly those checks. A thorough mail blacklist search therefore looks up the address first and then each of the names. To check a mail domain blacklist, repeat the domain lookup for the sender's domain and for every link domain in the message.

Blacklisted domains list

A blacklisted domains list is what one operator's list holds at one moment. A copied list of blacklisted domains is a snapshot, so ask the operator's own domain blacklist lookup for the current answer, and check mail domain blacklist status there before acting on a copy. A domain on such a list carries the same caveat as an address: the list says what its operator decided, on its own criteria, not what the domain does now.

Two situations, and the useful first step differs.

• Mail is being rejected. Listings that affect mail delivery usually publish a removal procedure, and the procedure is the route. What matters more is finding out why the listing happened, because a removal without a cause fixed is a removal that repeats.
• A service is refusing your traffic. Here the listing may be incidental. Plenty of refusals come from reputation systems that never consulted a public list at all, and treating a listing you happen to have found as the cause can send you down a path that changes nothing.

Verify an IP blacklist status in four steps

To verify an IP blacklist status, find the address the outside world sees, ask each list about it, and read the reason each list gives rather than only the verdict.

1. Pick the right address. For mail, it is the address the sending server connects from, which can differ from the address of the website. For a website, it is the public address of the server or of the proxy in front of it.
2. Run an IP blacklist lookup on each list, through the DNS method or the operator's lookup page described above.
3. Read the answer list by list: what the listing is for, when it was made and how to ask for removal.
4. After a fix, run the same lookups again and compare them with your notes.

To check to see if an IP is blacklisted, one clean answer is not a clean bill for the address. It covers one list, and every other list keeps its own record. There is no single IP address blacklist to consult, only many lists with different criteria, so a blacklist IP test is the same lookup repeated once per list.

Fix the cause first. Find the compromised machine, close the open relay, or stop the mail that triggered the listing; a removal request for an address still sending spam is usually refused or reversed. Follow each list's own procedure. Some remove on request, some expire listings automatically after a period without new evidence, and the lookup page usually says which.

Check again a few days later, on every list that named the address. Avoid paid delisting offers from third parties: list operators publish their own routes, and the established ones do not sell removal.

This is the more common use, and the boundary is worth respecting.

A listing tells you what a list says about an address, not what the address is doing to you now. A visitor from a listed address may be perfectly ordinary, and an unlisted address may be the one causing your problem: lists lag reality in both directions. What the result is useful for is adding context to a pattern you already observed, not for deciding on its own who gets in. That decision belongs with the material on IP reputation, which is a different question with different inputs.