A blacklist check for domain names usually happens at one of two moments. Either you are about to pay for an expired or aged domain and want to know what it was used for, or your email has started bouncing and you want to know why. The check is the same in both cases. What you do with the answer is not.
This post uses one list as its worked example: the Spamhaus Domain Blocklist, or DBL, because its own documentation explains what it lists, how it returns results and how removal works. Other blocklists exist and are run by other organisations on their own rules. Nothing here should be read as describing them.
What the Spamhaus DBL actually lists
Spamhaus describes the Domain Blocklist as “a list of domain names with poor reputation which is published in a domain DNSBL format.” It covers domains “used in unsolicited bulk email including phishing, fraud, malware distribution, and those with poor reputation based on a broad range of heuristics”, and it “includes domains owned by bad actors, or hijacked domains otherwise used for legitimate purposes.”
It is strictly a domain list: “It ONLY lists domains. No IP addresses are listed in the DBL.” That matters if you have been told your mail server is fine because it passed an IP check. Spamhaus’s IP lists (SBL, XBL, CSS and PBL) are separate, and ZEN “lists numeric IP address zones only, it does not list domains and does not include the DBL.”
Two more details shape how you read a result. “Most DBL listings occur automatically, although where necessary, Spamhaus researchers will add or remove listings manually.” And Spamhaus does not publish its rules: “We do not discuss the specific criteria we use.” So nobody can tell you exactly why a domain was listed. Anyone who claims to know the formula is guessing.
Running a blacklist check for domain names
The supported route is Spamhaus’s own IP and Domain Reputation Checker at check.spamhaus.org. The DBL page calls it the place to go “for more information, and the only place where DBL removals are handled.” Type the domain, read the result, and stop there. Spamhaus is blunt about scripting it: “Do not query our website with automated tools!” That rules out the bulk domain blacklist check some people want; if you have a long list of candidate domains, check the shortlist by hand.
You can also query the zone directly with host or dig. A listed domain returns an address in 127.0.1.x; Spamhaus’s test entry shows as “dbltest.com.dbl.spamhaus.org IN A 127.0.1.2”. A domain that is not listed returns “NXDOMAIN”. If you want a safe name to practise on, example.com is one Spamhaus says “will never appear in the DBL zone”. Note that subdomains inherit a listing: “all hostnames and subdomains of that domain also return a ‘listed’ result.”
Reading the return codes
The answer is an IP-shaped code, and some of those codes are errors rather than verdicts. Misreading them is the most common way people convince themselves a domain is listed when it is not.
| Return | Meaning (Spamhaus) | What to do |
|---|---|---|
| NXDOMAIN | Not listed | Nothing on the DBL today; still check history |
| 127.0.1.2 | Spam domain | Find the cause, fix it, then use the checker |
| 127.0.1.4 | Phish domain | Treat as a red flag on any domain you are buying |
| 127.0.1.5 | Malware domain | Clean the site before asking for removal |
| 127.0.1.6 | Botnet C&C domain | Walk away from a purchase; investigate if it is yours |
| 127.0.1.102–106 | Abused legit categories | Look for a compromise on your own site |
| 127.255.255.252 | Typing error in DNSBL name | Not a listing; fix the query |
| 127.255.255.254 | Anonymous query through public resolver | Not a listing; query through your own resolver |
| 127.255.255.255 | Excessive number of queries | Not a listing; slow down |
The public resolver line catches many people out. If your machine uses a big public DNS service, a direct query can come back as 127.255.255.254. That code says nothing about the domain. It means the query was refused, so use the web checker instead.
Before you buy an expired domain
For a buyer, a listing is a warning about what the last owner did with the name. Run the check before you pay, not after the transfer. Our guide to buying an expired domain places it in the wider sequence, and expired domains for SEO covers what the name is worth once it passes.
A clean result today does not erase the past. Listings “will expire without intervention after the domain stops matching the criteria that caused the listing”, so a domain used for spam years ago may simply have aged off. Pair the blocklist check with the Domain History Checker, which shows a year-by-year Wayback Machine timeline, past page titles, topic changes, gaps and redirects, and with the Domain Age Checker for how old the name really is. Our posts on domain ownership history and what domain age tells you explain how to read both.
Also keep the scope straight. The DBL page is about filtering email and URLs. It says nothing about search rankings, so do not treat a listing as a Google penalty or a clean result as proof of a clean link profile. For the link side, a spam score check and a full website due diligence pass do different jobs.
If your own domain is listed
Fix the cause first. For “abused legit” listings, Spamhaus describes hostnames “on domains that are legitimate, but are being abused for malicious purposes”, which is “often the result of a compromise”. Its fix list includes “Remove all infected files”, updating the CMS and plugins, and “Change all passwords”. Asking for removal before the cause is gone wastes time, because domains “may re-list automatically after removal if they are re-detected.”
Then use the form at check.spamhaus.org. “Using the form does not guarantee removal.” Once approved, removal “should only take a few minutes, but some users may lag up to 24 hours”, and if the listing is still active 24 hours after approval, Spamhaus asks you to contact it. Email authentication will not protect you on its own: “DBL listings occur for domains with and without those records”, meaning SPF, DKIM and DMARC.
Never pay anyone. “There is never any charge or fee associated with removing any Spamhaus listing. Any offer from anyone to remove any Spamhaus listing for a fee is a scam.”
A brand-new domain can also struggle without being listed. Spamhaus notes that “unknown reputations begin as ‘poor’ by default” and that “building a good reputation takes longer than building a bad reputation.” Warm a new sending domain slowly.
One limitation to keep in mind: this post describes one blocklist from one organisation, and Spamhaus publishes neither its criteria nor how long a listing lasts before it expires. A clean DBL result tells you the domain is not on that list now. It cannot tell you what other lists say, why a past listing happened, or how mailbox providers will treat your mail. Use is “free of charge for low-volume, non-commercial users”; commercial use needs “an annual subscription-based service”.
Frequently asked questions
How do I check if a domain is blacklisted?
For the Spamhaus DBL, enter the domain at check.spamhaus.org, its IP and Domain Reputation Checker. You can also query the DBL zone with host or dig: a 127.0.1.x answer means listed, NXDOMAIN means not listed.
Does it cost money to get removed from Spamhaus?
No. Spamhaus says there is never any charge for removing any of its listings, and that any offer to remove one for a fee is a scam.
Why did my lookup return 127.255.255.254?
That code means an anonymous query through a public resolver. It is an error, not a listing. Use the web checker or query through your own resolver.
Can I run a bulk domain blacklist check on Spamhaus?
Spamhaus asks people not to query its website with automated tools, so check candidate domains individually through its checker.
The takeaway Check before you buy and check when mail bounces, but read the code properly: errors are not listings, a clean result is not a clean history, and removal never costs money.
