Free email blacklist check — IP and domain, 50+ lists

There are roughly 200 public DNSBLs (DNS-based blocklists). Maybe fifteen matter. Another fifteen matter occasionally. The rest are irrelevant, defunct, or actively harmful to pay attention to. A good blacklist check runs all of them, scores the ones that move real mail, and ignores the ones that do not.

The DNSBLs that actually affect deliverability

Treat this as the short list you need to be clean on. A hit on any of these is a genuine problem.

• Spamhaus ZEN — aggregate of SBL, XBL, PBL. The single most influential DNSBL in the world. If you are on ZEN you are blocked by roughly 80% of the Internet's mail servers.
• Spamhaus DBL — domain-level blocklist. Lists domains seen in spam URLs or with abusive registration patterns. Hits the From-domain, not the IP.
• Spamhaus SBL — manually curated spam sources. Usually long-term listings tied to bulletproof hosters or known spam operations.
• Spamhaus XBL — exploited or compromised hosts (botnets, proxies, open relays). Fast-moving, low false-positive.
• Spamhaus PBL — residential and dynamic IP ranges that should not be sending SMTP directly. A PBL hit on your dedicated server usually means the ISP has not declassified the range.
• SURBL — URL-based blacklist. Lists domains found inside spam messages. Checked against every link in your body, not the sending IP.
• URIBL — similar to SURBL. Separate data sources, similar mechanic.
• Barracuda — Barracuda Reputation Block List. Used by Barracuda's own appliance and by many corporate gateways. Particularly painful for B2B senders.
• SORBS — multiple sub-zones (spam, web, smtp, dul). Aggressive but still widely consulted. Delisting is slower than Spamhaus.

The ones to ignore

Being honest about the noise is as important as flagging the real signals. These lists show up in free scanners and scare people into action, but no major provider consults them.

• UCEPROTECT Level 3 — blocks entire /24 or larger CIDR ranges based on any abuse anywhere in that range. You can be listed because a different customer on your ISP sent spam. Almost no mailbox provider uses it. Ignore.
• Defunct BL (JAMM, NJABL, AHBL, etc.) — hostnames that still exist in DNS but return positive for every query (or every 127.0.0.0/8 address). Any scanner still checking them will report false positives forever.
• Hobbyist regional BLs — run by one person, with unpredictable listing criteria and no delisting process. Usually no impact on real mail flow.

A responsible free scanner either excludes these by default, or flags them as low-importance so you do not spend an afternoon chasing a UCEPROTECT L3 listing that no one checks.

How IP blacklists vs domain blacklists differ

IP blacklists (Spamhaus ZEN, SORBS, Barracuda, PSBL) list sending IP addresses. They matter for every outbound message from that IP, regardless of content. If your SMTP server is on a listed IP, every send is affected.

Domain blacklists (Spamhaus DBL, SURBL, URIBL) list domains. They matter in two places:

1. Your From-domain — checked by DMARC-aware receivers and by any filter that evaluates sender reputation.
2. Every URL in your body — if you link to a listed domain, the message is flagged regardless of who is sending.

This matters because a clean sending IP does not save you from a dirty body link. A full check must run both dimensions.

Running the free scan

A good blacklist scanner takes two inputs — your sending IP and your sending domain — and returns:

• The hit list for your IP across all IP-based BLs.
• The hit list for your domain across all domain-based BLs.
• For each hit: the list name, the category (critical / useful / noise), and the delisting URL for that specific list.
• The sub-zone details (e.g. which Spamhaus ZEN component — SBL, XBL, PBL — triggered the ZEN hit).

Inbox Check runs this scan as part of every placement test and as a standalone check. 50+ lists, IP + domain, free, no signup.

How to get delisted (per-list)

Spamhaus (ZEN, SBL, XBL, DBL, PBL)

Spamhaus is the most responsive. For XBL (botnet/malware hits): clean the compromised host, then submit a removal request through the Spamhaus Lookup tool. Most XBL removals are automatic within 24h once the abuse signal clears. For SBL (manually listed spam sources): you need to explain the abuse, what you did to stop it, and provide proof. Responses within 3–5 business days.

PBL is different — it is a policy list, not an abuse list. Most PBL entries are removed by your ISP, not by you. Contact your hosting provider.

SURBL and URIBL

Both use a public lookup and removal form. SURBL listings are usually for domains that appeared in recent spam runs. Fix the abuse source (compromised site, affiliate, bad partner) and request removal. 48–72 hours typical.

Barracuda

Removal form at barracudacentral.org/rbl. Requires a brief explanation and contact details. Response within 24 hours. Repeat listings trigger a cooldown so do not request removal twice.

SORBS

Slowest of the major lists to delist. Requires an account, ticket-based support, and sometimes a $50 "donation" for non-ISP removals. A consistent pain point. Budget a week.

GlockApps comparison

GlockApps bundles a DNSBL check inside its paid Inbox Insight report. List coverage is comparable — Spamhaus, SURBL, URIBL, the usual suspects. What GlockApps adds is historical tracking: a timeline of when your IP was listed and by whom, useful if reputation damage happened weeks ago and you need a paper trail.

For a one-off check — "is my IP on anything right now?" — a free scan is equivalent. For continuous monitoring across a fleet of IPs, a paid service with alerting pays for itself.

GlockApps vs Inbox Check

• Inbox placement test — GlockApps: $59/mo (3 free/mo) — Inbox Check: Free, 3/day
• Providers — GlockApps: ~15 (no CIS, no EU) — Inbox Check: 20+ (Gmail, Outlook, Yahoo, Mail.ru, Yandex, Rambler, GMX, Orange, ProtonMail…)
• Inbox screenshots — GlockApps: No — Inbox Check: Yes
• SPF/DKIM/DMARC — GlockApps: In paid report — Inbox Check: Every test, free
• SpamAssassin + Rspamd — GlockApps: SpamAssassin (paid) — Inbox Check: Both (free)
• DNSBL check — GlockApps: Paid — Inbox Check: Free
• MCP for AI agents — GlockApps: No — Inbox Check: Yes
• Signup — GlockApps: Required — Inbox Check: Not required

Frequently asked questions