Blacklist Check
The blacklist check tests an IP or a domain's mail servers against 35 DNS blacklists. What the results mean and why Spamhaus needs a DQS key.
If your mail server’s IP is on a blacklist, many receivers reject your mail or file it as spam. The Blacklist-Check in the Mail category queries well-known DNS blacklists (DNSBL) and shows where an address is listed. It requires a license.
What is checked
In the IP oder Domain (IP or domain) field, enter either:
- An IP address, for example
192.0.2.1. Exactly this address is checked. - A domain, for example
example.com. The app finds the A and AAAA addresses of the domain and of all its mail servers (MX) and checks each of them. It also checks the domain itself against three domain lists.
Private and reserved addresses (such as 192.168.x.x) are skipped with a note, since public lists don’t include them.
The lists
The check covers 32 IP lists and 3 domain lists. Discontinued or unreliable lists such as SORBS are deliberately left out, as are lists that only work with a subscription.
| Weight | Lists | A listing counts as |
|---|---|---|
| high | Spamhaus ZEN, Barracuda, SpamCop, Spamhaus DBL, SURBL, URIBL | error |
| normal | e.g. Mailspike, PSBL, UCEPROTECT Level 1, DroneBL, NiX Spam, blocklist.de, SpamRATS, Sender Score | warning |
| low | UCEPROTECT Level 2 and 3, Backscatterer, EFnet RBL, Mailspike Z | note |
IPv6 addresses are only checked against lists that support IPv6: Spamhaus ZEN, DroneBL and SPFBL. The domain lists (Spamhaus DBL, SURBL, URIBL) check the organizational domain, so example.com even if you enter mail.example.com.
Reading the result
The Blacklists table has one row per combination of address and list, with Ziel (target), Liste (list), Zone, Ergebnis (result) and Grund (reason). Listings are at the top.
| Result | Meaning |
|---|---|
| nicht gelistet | not listed: the list doesn’t know the address. |
| GELISTET | listed. Grund shows the code and, if the list provides one, its explanation text. |
| nicht prüfbar | not checkable: the list refused the query. This says nothing about the address. |
| ungültige Antwort | invalid answer: the response doesn’t match a blacklist’s format. Usually the resolver rewrites NXDOMAIN answers, for example to an ISP search or ad page. |
| keine Antwort | no answer: the list didn’t respond within the timeout. It’s overloaded, discontinued or blocks the resolver. |
At the end, the app sums up: „Auf keiner Liste gelistet (… Abfragen ohne Treffer)“ (not listed anywhere) if everything is clean, and „… Abfragen ohne Antwort“ (queries without answer) if lists didn’t respond. Queries that were not checkable or got no answer don’t count as clean.
For Spamhaus ZEN, the app translates the codes, for example SBL – Spamquelle (spam source), XBL – kompromittiert (Bot/Malware) (compromised) or PBL – Endkunden-IP (end-user IP). A PBL entry means the IP belongs to a consumer connection and shouldn’t send mail directly to other servers. For a real mail server, you need an IP from a server network or a relay.
Spamhaus and the DQS key
Spamhaus doesn’t answer queries coming through large public resolvers like Cloudflare, Google or Quad9, and that includes DNS over HTTPS. You get a refusal instead, and the app shows Spamhaus ZEN: nicht prüfbar or Spamhaus DBL: nicht prüfbar.
The fix is a free DQS key (Data Query Service) from Spamhaus:
- Sign up with Spamhaus for a free DQS account.
- Open Einstellungen (settings) and enter the key under Blacklists in the Spamhaus-DQS-Schlüssel (optional) field.
- Check again.
With a key, the app queries Spamhaus through its DQS zones, and the check works with any resolver. The key only applies to Spamhaus. Other lists that report “nicht prüfbar” are refusing the chosen resolver. In that case, use the resolver button next to the input field to pick another resolver, for example the System-Resolver.
Listed: what now?
- Find the cause. Common ones are a hacked mailbox, a compromised contact form, an infected computer on the network or a misconfigured mail server.
- Fix the cause. Change passwords, secure the form, clean the computer. Otherwise you’ll be back on the list right after removal.
- Request removal. Through the website of the list in question. Many lists also remove entries on their own after a while.
- Check again. On the next run, the app shows which findings are gone.
Listings on low-weight lists like UCEPROTECT Level 2 and 3 often affect your provider’s whole network rather than your IP. They usually have little impact on delivery.