How to check if an IP is on a blocklist, and how to get delisted

Written by Aldo · blue-team threat hunter
Last updated November 9, 2026 · 5 min read

Your emails bounce with “blocked using …”, or a customer says your site is flagged. Somewhere, your address is on a list. Here's how to find out which one, what it means, and how to get off it without wasting a week.

What a blocklist is

A blocklist is a list of IP addresses (or address blocks) that someone recommends not to trust for a particular purpose. Mail servers use them to refuse spam; firewalls use them to drop traffic from criminal networks. Each list has its own reasons, its own rules for adding addresses and its own removal process. Being on one says nothing about the others.

Most email blocklists are published as DNS blocklists (DNSBLs), so any mail server can check an address with one DNS query, and so can you.

A worked example: the test address every list must have

To query a DNSBL, write the address's four numbers in reverse order, then add the list's zone name. The standard for DNS blocklists requires every IPv4 list to keep a permanent test entry for 127.0.0.2, so it's the safe address to practise on. Spamhaus combines its lists into one zone, zen.spamhaus.org:

nslookup 2.0.0.127.zen.spamhaus.org
nslookup -type=TXT 2.0.0.127.zen.spamhaus.org

The answer we got on 9 November 2026:

Addresses:  127.0.0.2
            127.0.0.4
            127.0.0.10

"Listed by XBL, see https://check.spamhaus.org/query/ip/127.0.0.2"
"Listed by PBL, see https://check.spamhaus.org/query/ip/127.0.0.2"

How to read it:

Any answer at all means “listed”. An address that isn't listed gets no answer (the name doesn't exist).
The returned addresses are codes, not real addresses. For Spamhaus, 127.0.0.2 means the SBL (spam sources and spam operations), 127.0.0.4 the XBL (machines infected with malware or abused as proxies), and 127.0.0.10 or 127.0.0.11 the PBL. Other lists use their own codes, documented on their sites.
The TXT record tells you where to go next: the list's page for that exact address, with the reason and the removal process.

One trap: if the answer is 127.255.255.254, the list didn't answer your question at all. Spamhaus returns that to queries made through big public resolvers, which it doesn't serve. Run the check from a server that uses its own or its provider's DNS, or use the list's website.

To check your own address, reverse it the same way: 198.51.100.25 becomes 25.100.51.198.zen.spamhaus.org.

What each kind of listing means

Listing	What it says	What to do
A spam list such as the Spamhaus SBL	Spam was sent from this address or network	Find what sent it: a hacked account, a contact form abused to relay mail, a compromised site. Fix it, then request removal.
A malware list such as the Spamhaus XBL	A device behind this address is infected or used as a proxy	Find and clean the device (on a home network, check every computer and gadget). Then request removal.
A “policy” list such as the Spamhaus PBL	This address is a home or dynamic one that shouldn't deliver mail directly	Not a punishment. Send mail through your provider's or email service's servers. If you run a real mail server on a static address, the PBL page explains how to remove it.
A network list such as Spamhaus DROP	The whole block is hijacked or run by criminals	Nothing you can fix yourself. If you rent this address, talk to your provider, or move.
A shared hosting or VPN address	Someone else on the same address caused it	Ask your host or VPN for a different address; they can also request removal.

Getting delisted, in the right order

Read the reason on the list's own page. It often names the problem: a specific malware family, a time window, a type of traffic.
Fix the cause. Change passwords on mail accounts, update or remove the compromised site or plugin, clean infected machines, close open relays or abused forms. Check your outgoing mail logs to confirm the spam has stopped.
Request removal on the list's site. Some listings expire on their own once the problem stops; others need the request. If you're relisted shortly after, the cause wasn't fixed.
Ignore anyone selling “express delisting”. Spamhaus states that there is never any charge for removing a listing.

Then look at authentication. Mail from a clean address can still be rejected if the domain has no SPF, DKIM or DMARC records; our guide on SPF, DKIM and DMARC covers that side.

What iplover checks, and what it doesn't

Be clear about what any free checker covers. iplover's IP lookup compares an address with the lists on our server: two blocklists (Spamhaus DROP and abuse.ch Feodo Tracker), plus crawler, cloud, scanner and Tor lists. The result says which lists it checked, so “no sign of abuse in the sources we check” means exactly that. It doesn't query the big email blocklists such as the Spamhaus SBL, XBL or PBL, which have usage terms for automated queries. For those, use the list's own website or the DNS check above.

One more honest note: Feodo Tracker publishes only addresses currently used to control specific botnets, and its list is sometimes empty. An empty list can't match anything; that's a limit of the data, not a clean bill of health.

Sources

Official documents we used to check the facts in this guide.