This post contains affiliate links. If you buy something through one of them, Veravix may earn a commission at no extra cost to you.
You search “check if email is on a blacklist”, paste an address into a free checker, and get a green “not listed” result. Then the bounce messages keep coming. The checker was not lying, but it was answering a narrower question than you asked, and in one important case it could not have answered at all. I tested that case on 16 October 2026, and the result is further down.
This guide is for people who run a website and send email from it: order confirmations, contact-form replies, password resets. It explains what a blacklist actually lists, how to check one yourself in a minute, why a clean result can be wrong, and what to do when you really are listed. Sources: the Spamhaus public-mirror help page, third-party deliverability documentation for the other lists, and my own DNS lookups.
A blacklist does not list your mailbox
The name is misleading. The lists people mean here are DNS blocklists, usually called DNSBLs or RBLs. They list IP addresses (the server that sent the message) and sometimes domains (the domain a message links to or sends from). They do not hold a list of bad email addresses such as you@yourdomain.com.
That changes the question. “Is my email address blacklisted?” really means “is the IP address my website’s mail goes out from, or my domain, on a list that receiving servers consult?” If you send from a free Gmail address, the answer is almost always no, and a checker tells you little, because Gmail’s sending addresses are shared by millions of users. If you send from your own domain through your host’s mail server or a WordPress SMTP plugin, the IP and domain are the things to check.
How a check works, so you can do it by hand
A DNSBL check is a DNS lookup. Take the sending IP, reverse the four numbers, and add the list’s zone name. For the IP 203.0.113.25 against SpamCop, you look up 25.113.0.203.bl.spamcop.net. If the lookup returns an address starting with 127.0.0, the IP is listed, and the last number is a code for the reason. If it returns “not found” (NXDOMAIN), the IP is not on that list.
In a terminal that is one line, for example dig +short 25.113.0.203.bl.spamcop.net. Web checkers just run this lookup against many lists at once and show you a table. Nothing about it is secret, and that is useful, because it tells you what can go wrong.
Which IP do you check? Not the one in your MX record. The MX record shows where mail to you arrives. Blocklists matter for mail you send, so open a message your site sent, view the full headers, and take the IP from the bottom-most Received: line that belongs to your sender. A host that sends many sites’ mail from shared servers will show the shared IP there.
Why a clean result can be wrong: the Spamhaus test
Spamhaus is the list most receivers care about, and its combined zone is called ZEN. Spamhaus says its free public mirrors answer with a special code, 127.255.255.254, when a query arrives through a public or open resolver, and that users in that situation have no protection from the list. The code means “you are not getting a real answer”, but a tool that only looks for “listed or not listed” can read it as neither.
I wanted to see what that looks like in practice. On 16 October 2026 I looked up the first mail server (MX host) of 30 well-known sending organisations, among them Google, Microsoft, Amazon, Apple, PayPal, Shopify and GitHub, through two public resolvers, and ran each IPv4 address against seven lists. First, a control. By convention a DNSBL should answer for the test address 127.0.0.2 as if it were listed, so I asked each list about 127.0.0.2 before trusting any “clean” result.
| List | Through Google Public DNS | Through Cloudflare DNS |
|---|---|---|
| SpamCop | listed (127.0.0.2) | listed (127.0.0.2) |
| UCEPROTECT level 1 | listed | listed |
| Barracuda | listed | listed |
| DroneBL | listed (its own code) | listed (its own code) |
| PSBL | listed | listed |
| s5h | listed | listed |
| Spamhaus ZEN | not found (NXDOMAIN) | 127.255.255.254 |
Six lists behave as expected through both resolvers. Spamhaus ZEN does not. Through Google Public DNS it answered “not found” for the test address that should be listed, so any IP checked that way looks clean no matter what. Through Cloudflare it returned the 127.255.255.254 code for the test address.
The real lookups matched. Across the 30 mail-server IPs, the six working lists returned no listing for any of them. Spamhaus ZEN returned “not found” for all 30 through Google and 127.255.255.254 for all 30 through Cloudflare. Those 30 “clean” Spamhaus results tell you nothing about Spamhaus’s opinion of those servers, because the query never reached a real answer. A clean row for Spamhaus from a tool you do not control may be this same failure, and you cannot tell from the table.
The same lookup for my own sites’ mail host, mx1.hostinger.com (172.65.182.103 on the day), was clean on the six working lists. Caveat: that is an inbound server, so it is a demonstration of the method rather than a verdict on the outbound address my mail leaves from. The mail for veravix.com runs on Hostinger, so the Received header of a sent message is what I would check for a real answer.
The practical lesson is to run a control before you believe a clean result. Look up 127.0.0.2 against the same list through the same resolver. If it does not come back listed, the check cannot catch a real listing. Spamhaus’s own fix is its free Data Query Service, or a resolver with a proper identity of its own. Its free mirrors are intended for small organisations, with no numeric query limit given on the help page.
What each list means when you are on it
| List | What a listing usually means | What to do |
|---|---|---|
| Spamhaus SBL | Spam source reviewed by humans | Fix the abuse, then your host’s abuse desk requests removal |
| Spamhaus XBL | Compromised machine or hijacked server | Clean the infection first (scan the site and server), then delist |
| Spamhaus PBL | An IP range that should not send mail directly, such as home or office connections | Send through an authenticated SMTP relay instead of directly |
| SpamCop | Recent spam reports | Fix the cause. Third-party guides describe these listings as temporary |
| UCEPROTECT | Level 1 is a single IP. Levels 2 and 3 cover whole ranges or networks | Level 1 reportedly expires on its own. A level 2 or 3 listing may be caused by other customers of your host |
| Barracuda | Spam-trap or complaint history | Look up your IP on their site and use the removal request form |
Some points hold for all of them. Spamhaus removal is free, and the sources I read agree that anyone selling you removal from it is not worth paying. Third-party guides say UCEPROTECT sells paid express delisting, which is a timing shortcut and does not fix the cause. Detail on the non-Spamhaus lists comes from deliverability guides rather than the operators, so confirm on the list’s own site before acting.
What this means for a WordPress site
On shared hosting, the default WordPress mail function usually sends from the server’s own IP, which is shared with other customers. If a neighbour’s site is hacked and sends spam, that shared IP can get listed and your order emails go with it. You did nothing wrong and cannot delist an IP you do not control.
The durable fix is to stop sending from the shared IP. Route site email through an authenticated SMTP account or a transactional provider, and make sure SPF, DKIM and DMARC line up for your domain. The related guides cover those steps: keeping SPF under the lookup limit, reading a DMARC rejection, and testing deliverability properly. A blocklist listing is one possible cause of failed delivery, and authentication problems are another, so check both before assuming either.
A routine that gives a real answer
- Read the bounce message. A line such as “blocked using zen.spamhaus.org” names the list and saves the guessing.
- Find the real sending IP in the Received headers of a message your site sent.
- Check that IP against several lists, and run the 127.0.0.2 control on the same resolver first.
- If listed, read the list’s own page for its removal route. Do not pay for removal from Spamhaus.
- Fix the cause, whether that is a hacked site, a leaking contact form or a shared IP, or the listing returns.
If every check is clean and mail still goes missing, the cause is probably authentication, content or the recipient’s own filters, not a blocklist.
Etienne Basson works with website systems, SEO-driven site architecture, and technical implementation. He writes practical guides on building, structuring, and optimizing websites for long-term growth.