How it works
Mail servers query one or more lists for every incoming connection, such as Spamhaus ZEN or SpamCop. The IP is reversed and placed in front of the list’s zone: for 203.0.113.25 the query is 25.113.0.203.zen.spamhaus.org. An answer in 127.0.0.0/8 means listed, NXDOMAIN means not listed (RFC 5782).
Besides IP lists there are domain lists such as Spamhaus DBL and SURBL. They contain domains advertised in spam or phishing or used to deliver malware, and spam filters also use them to check links in the message body.
Addresses get listed through spam traps, complaints and suspicious sending patterns. Every list has its own delisting rules: some expire entries automatically after a while, others only remove them on request.
Large lists like Spamhaus do not answer queries that arrive through public resolvers, or answer with a refusal code (such as 127.255.255.254) that must not be mistaken for a listing.
Why it matters
If the mail server’s IP is on a widely used list, many receivers reject mail outright or file it as spam, so quotes, invoices and password emails stop arriving. On shared hosting, one other customer on the same IP is enough to cause this.
A listed domain affects every message that uses it as the sender or in links, no matter which server sent it. A listed website IP often points to a hacked site or to spam sent through a contact form.
How to prevent it
- When listed, find and fix the cause first: a compromised mailbox, an unprotected contact form, malware on the website or an open relay.
- Only then request delisting through each list’s own form.
- Send website and form mail through a mail provider instead of straight from the web server.
- Protect forms with spam filtering and rate limiting.
- Keep reverse DNS, SPF, DKIM and DMARC in order so your sending does not look suspicious.
How DomainWarn detects it
The blacklist check looks up the IPv4 addresses of the website and the first five MX hosts on Spamhaus ZEN, SpamCop, Barracuda and PSBL, and the domain name on Spamhaus DBL and SURBL. A listed mail server IP or domain is critical, a listed website IP is a warning; either opens the “Listed on a blacklist” incident after one run, and DomainWarn reports the delisting as an all-clear.
Only unambiguous listing answers count, and refused queries are treated as unknown rather than listed. The check does not cover IPv6 addresses or servers that are neither the website nor an MX host, such as a separate outbound server; for the actual sending IP, use the mail test.
DomainWarn checks this for all your domains on a schedule and alerts you when something is missing or changes.