Support Library

Blocklisted Domains and IP Addresses

Mail servers and spam filters check every sender and link against blocklists published through DNS. When your domain or a server address is listed, mail bounces or lands in spam and links to your site are flagged, until you fix the cause and the listing ends.

Author
CategoryDNS Security
Length5 minute read
UpdatedNovember 1, 2026

The short answer

Find out why you were listed before asking to be removed: a compromised mailbox sending spam, a hacked website hosting phishing or malware, an infected server, or a shared address another customer abused. Fix that, then use the list’s own lookup page to request delisting. Most lists remove an entry quickly once the problem stops; some expire listings on their own.

How a blocklist check works

How a receiving mail server uses a DNS blocklist to reject mail from a listed server Top, listed: a mail server at 192.0.2.25 sends a message. The receiving server reverses the address and looks up 25.2.0.192 in the blocklist zone. The list answers 127.0.0.2, meaning listed, so the message is rejected or sent to spam. Bottom, not listed: the same lookup gets no answer (NXDOMAIN), so the message is delivered and judged on its other checks. Address is listed Mail arrives from 192.0.2.25 Receiver looks up 25.2.0.192.<list> List answers 127.0.0.2 = listed Mail rejected Or sent to spam Legitimate mail bounces Links to the domain are flagged Not listed Mail arrives from 192.0.2.25 Receiver looks up 25.2.0.192.<list> List answers NXDOMAIN = clean Mail delivered Other checks decide No blocklist penalty SPF, DKIM and DMARC still apply How a receiving mail server uses a DNS blocklist to reject mail from a listed server Top, listed: a mail server at 192.0.2.25 sends a message. The receiving server reverses the address and looks up 25.2.0.192 in the blocklist zone. The list answers 127.0.0.2, meaning listed, so the message is rejected or sent to spam. Bottom, not listed: the same lookup gets no answer (NXDOMAIN), so the message is delivered and judged on its other checks. Address is listed Mail arrives from 192.0.2.25 Receiver looks up 25.2.0.192.<list> List answers 127.0.0.2 = listed Mail rejected Or sent to spam Legitimate mail bounces Links to the domain are flagged Not listed Mail arrives from 192.0.2.25 Receiver looks up 25.2.0.192.<list> List answers NXDOMAIN = clean Mail delivered Other checks decide No blocklist penalty SPF, DKIM and DMARC still apply
Domain lists work the same way with the domain name in place of the reversed address, for example example.com.dbl.spamhaus.org.

How DNS Panopticon detects it

Security Posture looks the domain up in the domain blocklists Website Recon uses (SURBL and URIBL, plus Spamhaus DBL when configured), and the IPv4 addresses of your website and mail servers in IP blocklists (SpamCop and PSBL, plus Spamhaus ZEN when configured). It also asks each list about its own test entry, so a list that does not answer is reported as unavailable, never as clean. The results appear on the IP and Asset Reputation card.

FindingSeverityWhen it appears
Domain is on a domain blocklistCriticalA list that tracks spam, phishing or malware domains lists the domain. Caps the overall grade.
Domain is flagged on a domain listLowOnly an informational list (for example a “grey” or new-domain list) mentions it. Some filters treat this as a warning.
Mail server IP address is on a blocklistHighAn address in the domain’s MX records is listed. Mail from it is often rejected.
Website IP address is on a blocklistMediumThe website’s address is listed. It may be shared with other sites on the same host.
… not on blocklistsPassEvery list that answered says the domain or addresses are clean.
… could not be checkedNot gradedThe lists did not answer, so nothing is counted.

Spamhaus PBL entries, which only say an address belongs to an end-user range, are not counted as abuse.

How to check it yourself

Command or pageWhat it tells you
dig +short 25.2.0.192.bl.spamcop.netAny 127.0.0.x answer means 192.0.2.25 is on SpamCop. No answer means it is not.
dig +short example.com.multi.surbl.orgA 127.0.0.x answer means the domain is on a SURBL list.
nslookup 25.2.0.192.psbl.surriel.comThe same check against PSBL on Windows.

Spamhaus and URIBL refuse queries sent through public resolvers such as 8.8.8.8 or 1.1.1.1 and answer with a 127.255.255.x code instead, so use their web pages: Spamhaus Reputation Checker, URIBL lookup, SURBL lookup and PSBL. Most of these pages also explain why an entry was added.

Why it matters

  • Mail stops arriving. Gmail, Microsoft and most corporate filters use these lists. A listed mail server can lose most of its outbound mail overnight.
  • Links are distrusted. Domain lists are applied to links inside messages, so even mail sent through a clean provider is filtered if it links to a listed domain.
  • It is a symptom. Listings usually follow a real problem: a phished mailbox, a hacked CMS, an open relay or malware on a server. The listing is often the first sign anyone sees.

How to fix it and get delisted

  1. Read the listing reason on the list’s lookup page. It usually names the kind of abuse and sometimes a time or sample.
  2. Find and stop the source. For a mail server: look for compromised accounts (sudden volume, unusual sign-ins), reset their passwords, require MFA, and close any open relay. For a website or domain: look for phishing pages or malware (see Malware on Your Website) and remove them.
  3. Check your mail authentication. Make sure SPF, DKIM and DMARC are in place so others cannot easily send as your domain.
  4. Request removal on the list’s site once the cause is fixed. SpamCop listings expire automatically soon after reports stop; PSBL lets you remove an address yourself; Spamhaus, SURBL and URIBL review requests.
  5. Shared hosting or cloud address? If another customer caused the listing, ask your host to deal with it or move your mail to a dedicated sending service.
  6. Scan again with DNS Panopticon after the listing clears.

FAQ

We were delisted but got listed again. Why?

The cause was not fully fixed. A compromised account, a forgotten script or an infected machine is still sending. Check outbound mail logs and server processes before requesting removal again; repeated requests without a fix can make removal slower.

Can I pay to be removed from a blocklist?

Reputable lists such as Spamhaus, SURBL, URIBL, SpamCop and PSBL do not charge for removal. Be wary of any service that asks for payment to delist you.

Our website shares an IP address with other sites. Does a listing affect us?

For a website address it matters less, which is why DNS Panopticon rates it medium, but some filters and browsers may still treat the address with suspicion. If it keeps happening, ask your host for a cleaner address.

Sources and further reading

Related support articles

Malware on Your WebsiteInfostealer Malware and Stolen LoginsReverse DNS (PTR) RecordsWebsite Recon technical details