Online Tool Store
Email Blacklist Check
Construct the exact DNSBL lookups for a mail server IP, with runnable dig and nslookup commands, return-code meanings and delisting links.
🔒 This tool runs entirely in your browser. Your files are never uploaded to a server.
The IP that actually sends your mail, not your website's. Check a bounce message, or your SPF record.
Run these
An answer means listed. NXDOMAIN — "no such name" — means not listed, which is the result you want.
The lists worth checking
| List | What it lists | Codes | Delisting |
|---|
Being on a list is a symptom. Delisting without fixing the cause gets you relisted within days, so the order of work is: find what sent the mail, stop it, then request removal. Common causes are a compromised mailbox, a web form with no rate limit, a misconfigured relay, or a shared IP where somebody else on the same host is the problem.
How to use it
- Find the IP that sends your mail — check a Received header or your SPF record.
- Enter it. The tool builds the reversed query name and the commands.
- Copy the commands and run them in a terminal, or use the operators' own lookup pages.
- Any answer means listed. NXDOMAIN means clean.
What a real check actually is
A DNS blocklist is not a web service with an API — it is a DNS zone. You ask whether a name exists, and the answer itself is the verdict:
to check 192.0.2.5 on zen.spamhaus.org
reverse the octets 192.0.2.5 → 5.2.0.192
prepend to the zone 5.2.0.192.zen.spamhaus.org
dig +short 5.2.0.192.zen.spamhaus.org
an A record → listed, and the value says why
NXDOMAIN → not listed
The octets are reversed because DNS reads right to left: the zone has to be the parent, so the address becomes a chain of subdomains beneath it. It is the same construction reverse DNS uses with in-addr.arpa.
Why this page will not do it for you
Browsers cannot make arbitrary DNS queries. There is no API, and that is a deliberate security decision — a page able to resolve names of its choosing could map your internal network from the inside. Any site that appears to check blacklists is doing the lookup on its own server, which means handing over your mail server's address, and a page that runs entirely in your browser and claims to have checked is showing you a result it did not obtain.
For a tool people reach for when mail is bouncing, a fabricated "not listed" is worse than no answer at all — it sends you looking in the wrong place. So this does the part that can be done honestly: constructs the exact query names, generates runnable commands for both Unix and Windows, and explains how to read the codes. The answer comes from your own resolver, which is also the most reliable place to get it.
The return codes are the useful part
Spamhaus ZEN
127.0.0.2 SBL — a known spam source
127.0.0.3 SBL CSS — snowshoe or hijacked space
127.0.0.4–7 XBL — an exploited machine or open proxy
127.0.0.10/11 PBL — a range that should not send mail directly
These distinctions decide what to do. A PBL listing usually means you are sending from a residential or dynamic range and should relay through your provider instead — nothing is compromised. An XBL listing means a machine on that address is infected or running an open proxy, which is an incident. Treating those two the same wastes a lot of time.
Delisting is the last step, not the first
Most lists will remove you on request, and most will put you straight back if the behaviour continues — with less patience each time. So work in this order: identify what sent the mail, stop it, confirm it has stopped, then request removal. The usual culprits are a mailbox whose password leaked, a web form without rate limiting, a relay that accepts mail it should not, or a shared IP where the problem is somebody else's and your only real fix is to move.
FAQ
Why does this not just check for me?
Because a browser cannot make DNS queries. There is no JavaScript API for it — deliberately, since it would let any page probe your internal network. A page claiming to check blacklists is either using its own server or showing you nothing real. Rather than route your mail server IP through a third party, this builds the queries so you can run them yourself.
Why are the octets reversed?
Because DNS names are hierarchical from right to left, so the list operator has to be the parent of the address. To ask whether 192.0.2.5 is listed on Spamhaus ZEN you look up 5.2.0.192.zen.spamhaus.org — the same trick reverse DNS uses with in-addr.arpa. It looks odd and it is just how the hierarchy works.
How do I read the answer?
An answer means listed; NXDOMAIN, "no such name", means not listed. The address returned is a code rather than a real location: Spamhaus returns 127.0.0.2 for SBL, 127.0.0.4 to 127.0.0.7 for XBL, and 127.0.0.10 or .11 for PBL, which tells you why you are listed and therefore what to do about it.
Which IP should I check?
The one that actually sends your mail, which is often not your website's address. Find it in the Received headers of a message you sent, or in the SPF record for your domain. Checking your web server tells you nothing about your mail.
I am listed. What now?
Find the cause before requesting removal, because delisting without fixing it gets you relisted within days and repeat offences are treated less generously. The usual causes are a compromised mailbox sending on your behalf, a contact form with no rate limit, an open relay, or a shared IP where a neighbour is the problem.
Does one listing mean my mail will bounce?
Not necessarily. The lists differ enormously in how widely they are used — Spamhaus ZEN affects a very large share of inbound mail, while some smaller lists are barely consulted and a few are aggressive enough that operators ignore them. Weigh a listing by who actually uses that list.
How we compare
| Feature | Online Tool Store | Multi-RBL check sites | dig on your own machine |
|---|---|---|---|
| Your server IP is not sent to a third party | ✓ | ✗ | ✓ |
| Explains the codes and what to do about each | ✓ | Usually just red or green | ✗ |
| Never shows a result it did not obtain | ✓ | Varies, and unverifiable | ✓ |
| Flags private, loopback and documentation ranges | ✓ | ✗ | ✗ |
| Delisting links per list | ✓ | ✓ | ✗ |
| Gives you the actual answer in one click | ✗ | ✓ | One command |
| Checks a hundred lists at once | ✗ | ✓ | With a script |
A query builder and a reference, not a checker — and it says so plainly rather than showing you a verdict it has no way to reach. If you want dozens of lists checked at once, a server-side service will do that; just be aware you are handing it your mail server's address, and that you cannot verify what it actually looked up.