{{ summaryTitle }} {{ summaryValue }} {{ summaryLine }}

Use one sender from a mail log, such as 203.0.113.45 or mail.example.com. Only the first usable line is checked.
Loads a local example with policy, resolver, clear, and IPv6-skip evidence; it sends no DNS requests.
{{ presetDescription }}
Resolver restrictions can produce access warnings that are not sender listings.
Only the first usable target was checked; {{ ignoredExtraLines }} additional lines were was ignored.
{{ selectedListKeys.length }} of {{ catalog.length }} zones selected; use Command or Control to adjust the set.
Off keeps the default run minimal; turn it on when provider notes are needed for investigation or delisting.
{{ fetchTxtEnabled ? 'On' : 'Off' }}
Off limits hostname expansion to IPv4; literal IPv6 input is still accepted.
{{ resolveIpv6Enabled ? 'On' : 'Off' }}
Use 0 for the default, or 1000–15000 milliseconds.
ms
TargetSignalEvidenceNext stepCopy
{{ row.target }}{{ row.signal }}{{ row.evidence }}{{ row.nextStep }}
TargetDNSBLStatusReturnEvidenceResolverTimeCopy
{{ row.target }}{{ row.list }}{{ row.status }}{{ row.response }}{{ row.evidence }}{{ row.resolver }}{{ row.duration }}
QueryResolverStatusAnswersNoteCopy
{{ row.query }}{{ row.resolver }}{{ row.status }}{{ row.answers }}{{ row.note }}
URL Blacklist Status Lookup Check a suspicious URL with Safe Browsing and SURBL plus weighted string clues, then review every source's scope and gaps before choosing a safer next step.
Reverse DNS (PTR) Checker Check PTR records for an IP or hostname, verify forward-confirmed reverse DNS, and compare expected names or public resolver views.
Email Header Analyzer Inspect raw email headers locally to trace relay delays and compare recorded SPF, DKIM and DMARC evidence while spotting sender mismatches.
DNS Record Lookup Look up DNS records for a domain, URL or IP through Google or Cloudflare with response codes, returned TTL evidence and DNSSEC flags.

A mail delivery problem can look like a blocklist problem even when the real cause is DNS, authentication, sender policy, or the receiving site's own filtering. A DNS-based blocklist (DNSBL), sometimes called a real-time blocklist (RBL), contributes one signal about an IP address. It does not issue a universal verdict on the host or guarantee that every recipient will make the same decision.

DNSBLs publish entries through ordinary Domain Name System queries. For an IPv4 check, the address octets are reversed and placed before the list's zone name. A returned address means the queried IP is listed according to that provider's rules; an NXDOMAIN response normally means no entry was found. Some providers attach a TXT record explaining the reason, while others require their own lookup page for the full context.

The reason matters more than the word “listed.” An abuse list may point to malware, an open proxy, compromised credentials, or unwanted mail. A policy list can identify address space that should send through an authenticated relay instead of connecting directly to outside mail exchangers. Removing a policy listing may be the wrong goal when the correct fix is to use the provider's outbound mail service.

Outcome What it establishes What still needs checking
Positive A response The provider returned a listing code for that IP. The provider's reason, the sending path, and whether remediation or relay use is appropriate.
No positive response No listing was visible from that list and resolver at that moment. Other lists, reputation systems, authentication, and recipient policy.
Resolver or provider error The query path did not produce usable reputation evidence. A permitted resolver or the provider's own lookup service.
IPv6 check skipped The selected list is not declared IPv6-capable in this catalog. An IPv6-capable provider or a separate reputation source.

A clean result is therefore a point-in-time observation, not a delivery guarantee. Reputation data changes, recursive resolvers cache answers, providers apply different policies, and a hostname may resolve to several sending addresses. Investigation should begin with the IP that actually connected to the recipient, usually taken from a trusted mail log or the relevant Received header.

How to Use This Tool:

Start with one sender address from the delivery path. A hostname is useful only when its resolved addresses are the ones that actually sent the message.

  1. Enter one public IPv4 address, IPv6 address, or mail hostname in Mail host or sender IP. If several lines are pasted, only the first usable line is checked.
  2. Choose a Catalog preset and Resolver. The automatic path tries Cloudflare first and Google Public DNS if the first request cannot be used. Enable Fetch TXT evidence when provider notes would help, and turn on Resolve hostname AAAA records only when the hostname's IPv6 addresses belong in scope.
  3. Select Check DNSBL status, then read Action plan before the raw rows. Use DNSBL results to confirm the provider, return code, resolver, and any TXT evidence behind the recommendation.

Interpreting Results:

Listed means an applicable DNSBL returned one or more A records. A Spamhaus PBL code is shown as a policy signal, while other positive or unknown provider codes remain listing signals that need provider confirmation. Fix the sending behavior or route before requesting delisting.

Resolver review is not a listing. It covers failed requests, unusable DNS status codes, and recognized Spamhaus resolver restrictions. Retry through a permitted resolver or use the provider's lookup page before taking operational action.

Clear means no positive A answer was returned for that row. It does not prove that the sender is trustworthy, that the address is absent from every list, or that a message will be accepted. Check authentication, mail logs, and the recipient's rejection text when delivery still fails.

Technical Details:

IP-based DNSBLs adapt reverse-DNS naming to a provider-owned zone. IPv4 reverses four decimal octets. IPv6 expands the address to 32 hexadecimal nibbles, reverses those nibbles, and appends the list zone. The resulting name is queried for an A record; TXT is requested only for a positive row when that option is enabled.

Lookup Core:

Stage Rule Example or effect
Resolve a hostname Query A records and optionally AAAA records; keep at most eight unique addresses. Each kept address is checked independently against every selected list.
Build an IPv4 owner name Reverse the octets and append the DNSBL zone. 203.0.113.45 becomes 45.113.0.203.<zone>.
Build an IPv6 owner name Expand to 32 hexadecimal nibbles, reverse them, separate with dots, and append the zone. Lists not declared IPv6-capable are marked Skipped.
Classify the DNS response Any returned A value is positive unless a recognized provider code is explicitly an error. NOERROR or NXDOMAIN without A data is clear; other DNS statuses need resolver review.

Rule Core:

The overall state is based on the most consequential row, not a majority vote. A non-policy listing has severity 3 and produces Listing remediation needed. A policy listing, query error, or resolver restriction has severity 2 and produces Provider or resolver review needed. Only a run with no severity 2 or 3 rows is reported as No listing found.

Return Interpretation Triage direction
127.0.0.2SBLStop the abusive sending source before removal.
127.0.0.3CSSReview sending patterns and reputation.
127.0.0.4XBL/CBLCheck for malware, an open proxy, or compromise.
127.0.0.9DROP/EDROPEscalate the network-abuse context.
127.0.0.10PBLUse an authenticated relay or provider smarthost.
127.0.0.11PBL + CSSFix sender behavior and avoid direct delivery.
127.255.255.252Query identity or zone errorReview the DNSBL query path.
127.255.255.254Public or open resolver blockedRetry through an allowed resolver.
127.255.255.255Query allowance exceededReduce volume or use an authorized service.

Rows are bounded to eight resolved addresses multiplied by the selected catalog. Requests use a 6,500 ms default timeout unless a value from 1,000 to 15,000 ms is supplied, and no more than four row checks run at once. The response time chart averages completed lookup durations; it measures the observed resolver path, not the speed of the DNSBL's authoritative service alone.

Privacy and Accuracy Notes:

Live checks send the target hostname or derived DNSBL query names to the selected public recursive resolver and the DNSBL infrastructure it reaches. TXT evidence adds another public DNS request for positive rows. No DNS request is sent until the check is started; loading the built-in review sample stays local.

  • Provider data and resolver caches can change after the report is created.
  • A public resolver may be blocked by a DNSBL or may expose a different cached view from the sender's production resolver.
  • The checker does not submit removal requests, test SMTP delivery, inspect message authentication, or prove why a recipient rejected a message.

Worked Examples:

Policy-listed broadband address

A sender IP returns 127.0.0.10 from Spamhaus ZEN while the other selected lists are clear. The run needs review because PBL describes address-space policy, not necessarily abuse. The useful action is to route mail through an authenticated provider relay and confirm that the direct-sending IP is not supposed to deliver to outside mail exchangers.

Open-resolver restriction

Spamhaus returns 127.255.255.254 through a public resolver. That row is classified as Resolver review, not Listed. Repeat the check through an allowed resolver or the provider's own lookup service before judging the sender's reputation.

References: