Email blacklists (DNSBL): how to check and get delisted

You sent a campaign and half the emails never arrived. Open rates dropped, your ESP started showing errors, subscribers say they received nothing. One likely cause: your sending IP or domain landed on a blacklist.

Blacklists — also called DNSBLs — have been around since the late 1990s and are now one of the main anti-spam mechanisms used by every major inbox provider. If you do email marketing, you will run into them at some point. Better to know the mechanics before that happens.

What an email blacklist is

A blacklist is a database of IP addresses and domains caught sending spam. Organizations like Spamhaus, Barracuda, SORBS, and SpamCop maintain these lists. When you send a message, the receiving server — Gmail, Outlook, any corporate mail server — queries those databases against your sending IP. A match means the message gets blocked or routed to spam.

The lookup runs over DNS, which is where the name DNSBL (DNS-based Blackhole List) comes from. The receiving server fires a DNS query with your IP reversed into the blacklist zone. A response means you are listed. No response means you are clean. The whole thing takes milliseconds, checked live on every delivery attempt.

There are two categories: IP blacklists that block the sending server, and domain blacklists (URIBL, SURBL) that check links inside the message body. A domain listed in SURBL will get your mail rejected even if your IP is perfectly clean.

Why IPs and domains get listed

There is always a specific reason. The most common ones:

Spam complaints. When recipients click "Report spam," that signal goes back to their provider. The threshold varies by blacklist, but a complaint rate above 0.1% of send volume is already in dangerous territory.

High hard bounce rate. Sending to nonexistent addresses tells providers you are not managing your list. Once bounce rate crosses 5%, a blacklisting is a matter of time.

Spam trap hits. Spam traps are addresses that either never belonged to a real subscriber or were recycled from abandoned mailboxes. If you hit one, it means your list was collected improperly or has not been cleaned in a long time.

Shared IP with bad neighbors. Many ESPs put multiple clients on the same IP. If one neighbor spams, everyone on that IP suffers — including you, even if your own sending is completely clean.

Sudden volume spike. A domain that sent 100 emails yesterday and 50,000 today looks like a compromised account or a freshly purchased list. Providers treat it the same way.

The blacklists that actually affect deliverability

There are over a hundred blacklists, but around ten drive most real-world blocking. These are the ones worth knowing.

Spamhaus (SBL, XBL, PBL, DBL). The most authoritative blacklist in existence, used by Gmail, Microsoft, Yahoo, and most large providers. Getting listed here is close to guaranteed delivery failure. Spamhaus runs separate lists: SBL for confirmed spam sources, XBL for compromised machines, PBL for dynamic IP ranges, and DBL for domains.

Barracuda (BRBL). Widely used by corporate mail servers. If your B2B campaigns are not reaching enterprise inboxes, check Barracuda first.

SpamCop. Complaint-driven. Listings come and go faster here than on Spamhaus. Stop the problematic sending and you are usually off within 24 to 48 hours.

SORBS, UCEPROTECT, Invaluement. Smaller, but used by individual providers and corporate gateways. Invaluement is worth noting: it targets "snowshoe spam," bulk mail that technically follows the rules but goes out without genuine recipient consent.

How to check whether your IP or domain is listed

The check takes a couple of minutes. Several tools cover this.

MXToolbox. mxtoolbox.com/blacklists.aspx checks your IP against dozens of blacklists at once. Enter your mail server IP, click the button, and you have results in seconds. Free.

MultiRBL. multirbl.valli.org covers an even larger set of lists, including obscure ones. Useful when you want a complete picture.

Spamhaus directly. check.spamhaus.org lets you query Spamhaus databases specifically. Given how widely they are used, this check should be non-negotiable.

Postmaster tools. Google Postmaster Tools and Microsoft SNDS show domain and IP reputation within Gmail and Outlook respectively. Not a blacklist checker per se, but reputation degradation almost always precedes or accompanies a listing.

If you do not know your mail server IP, look in the Received headers of a sent message or ask your ESP's support team.

What to do when you are listed

A blacklist listing is not permanent — it is a signal that something went wrong. Act quickly, but in the right order.

Step 1: Find the cause. Do not request delisting before you know why you were listed. If the underlying issue is still active, you will be re-listed within hours. Check your recent bounce rate, complaint rate, and whether you imported a new list without validating it first.

Step 2: Fix the problem. Clean invalid addresses out of your list. Remove subscribers who never gave consent. If you sent to a purchased list, stop immediately. Verify that SPF, DKIM, and DMARC are correctly configured for your domain.

Step 3: Request delisting. Each blacklist has its own process. Spamhaus takes a form submission explaining what happened and what you fixed. SpamCop removes listings automatically after 24 to 48 hours once spam activity stops. Barracuda requires registering on their portal and submitting a request.

Step 4: Wait for propagation. After delisting, mail servers need time to flush their DNS caches — anywhere from a few hours to a couple of days. Do not jump straight into a full campaign. Start with a small segment of your most engaged subscribers.

How to stay off blacklists

Getting delisted takes effort. Staying clean takes discipline.

Validate your list before every send. Dead addresses, spam traps, and disposable mailboxes can all be caught before the mail goes out. Upload your list to uChecker, and within minutes you will see which addresses are safe and which ones to remove. It is the fastest way to cut bounce rate and protect your sender reputation.

Use double opt-in. Subscriber enters an email, receives a confirmation message, clicks the link, enters your list. Conversion drops 20 to 30%, but every address in your database belongs to a real person who actively confirmed they wanted mail from you.

Warm up new IPs and domains. 200 emails on day one, 400 on day two, 800 on day three. Send to your most engaged segment first. Two to four weeks of ramp-up builds the reputation you need before going to full volume.

Watch your numbers. A bounce rate above 2% warrants attention. A complaint rate above 0.1% requires immediate action. Set up monitoring through your ESP or Google Postmaster Tools.

Cut inactive subscribers. Someone who has not opened an email in nine months is not your subscriber anymore. Run a re-engagement sequence: two or three emails asking directly whether they want to stay on the list. Those who do not respond get removed. Smaller, more engaged lists consistently outperform larger stale ones.

Never buy a list. Purchased lists are essentially guaranteed spam trap deliveries — they contain nonexistent addresses, people who have no idea who you are, and almost certainly a handful of Spamhaus-maintained traps. One blast to a bought list can cost you months of reputation recovery.

Blacklists and domain reputation: the relationship

Blacklists are not the only deliverability factor. Gmail in particular has shifted heavily toward domain reputation rather than IP reputation. A clean IP means little if the sending domain has a poor history — messages still go to spam.

Domain reputation draws on complaint rates, bounce rates, subscriber engagement (opens, clicks), and authentication (SPF, DKIM, DMARC). A blacklisting is the end of the degradation chain, not the beginning. The sequence typically goes: messages start landing in Promotions, then in spam, and only later does the IP get listed.

So monitoring blacklists is necessary but not sufficient. Track the whole picture: list hygiene, authentication, engagement, and postmaster tool signals. Keep all of those in order and a blacklist listing becomes unlikely.

Common questions

How fast can you get delisted? It depends on the list. SpamCop clears automatically in 24 to 48 hours. Spamhaus reviews requests in anywhere from a few hours to a week. Barracuda typically removes a listing 12 to 24 hours after approving your request. Some lists — UCEPROTECT Level 3 in particular — do not accept manual removal requests at all. You wait out the expiry.

My ESP uses shared IPs. What now? Ask your ESP whether they monitor blacklists for their IP pool. Reputable services (Mailchimp, SendGrid, Postmark) do, and they react quickly when a shared IP gets listed. If you are sending more than 50,000 emails a month, dedicated IPs are worth the extra cost — you control your own reputation.

Do I need to check all 100+ blacklists? No. The five to ten major lists — Spamhaus, Barracuda, SpamCop, SORBS — are responsible for nearly all real-world blocking. If you are clean on those, the rest are almost certainly fine. MXToolbox checks the important ones in a single query.

Does a blacklist listing mean I should stop sending entirely? No. It means you need to fix your processes: clean the list, set up authentication, improve monitoring. Most senders are fully delisted within a few days and resume normal sending without further issues.