We often get the question: “How do I know if my company is on a SPAM Blacklist?” Followed by “If my company is on a SPAM blacklist, how the heck do we get unlisted?
There are several hundred SPAM blacklists but luckily, there are a few tools that can help you check most of them quickly. We’ve included here a handy reference with the sites that you can use to check your blacklist status. We’ve also highlighted one or two of the more prominent SPAM blacklists.
What you need to know to check Blacklist status
Most SPAM blacklists track the reputation of the email servers that are being used to send outgoing email for your domain, so to get started – you’ll need to know the IP address of the email servers sending emails for your company. If your company uses its own servers to send email campaigns, you’ll need top know the IP addresses of those servers. If your company is sending email campaigns via an Email Service provider (“ESP”) then you’ll need to know the IP addresses of their servers or specifically – what IP addresses are being used for your domain (if you have a dedicated IP address as part of your service).
Some SPAM blacklists track more than IP’s – they also track domains, URL’s and a few even create a unique ‘hash code’ based on the content of the email. If their systems see more than a few dozen emails with an identical code – meaning dozens (or more) of identical emails, they’ll list the specific email content as SPAM.
Here are 3 sites where you can check multiple public blacklists if you know your servers IP address(es):
- http://www.mxtoolbox.com/blacklists.aspx. MXToolbox is free. Enter the email service IP addresses and mxtoolbox checks about 100 blacklists.
- www.dnsstuff.com. DNSStuff is an inexpensive (almost free) service where you can check 97 blacklists. Includes other DNS and network tools too.
- http://www.dnsbl.info. (Domain Name System Blacklist). Free service. Checks about 80 blacklists.
A Few blacklists deserve “special mention”
Spamhaus.org. (www.spamhaus.org)
SPAMHaus.org’s mission is to rid the world of unsolicited commercial email (“UCE”) by creating and monitoring a network of thousands (millions?) of ’spam honeypot’ email addresses. These are email addresses that are expired, or that never were ‘real’ recipients that Spamhaus acquires from ISP’s. They ‘plant’ the addresses on various websites around Etherspace. Since these are not ‘real people’ – the addresses should never end up on an opt-in list, so if you send an email campaign and it ends up in one of Spamhaus’ inboxes – clearly your list development practices are not cool. [Note: Some list vendors develop emails lists - albeit illegally - by scraping websites for email addresses. This is why you should never us these lists].
Spamhaus then adds the sending email servers to their blacklists. Overall it’s a pretty good system but not flawless in our experience. For example, if you are capturing registrant information from your website or from online events, an ill-willed smart-alec can enter a bogus / honeypot address into your list. Your well intentioned campaign gets caught and viola – you are on Spamahaus’ [s]hit list. Solution: Always use double opt-in processing (most email services providers like Pinpointe provide mechanisms to enforce double opt-in when using their forms to collect subscribers).
UCEProtect (http://www.uceprotect.net/en/rblcheck.php)
UCE Protect deserves mention because its one of the few major SPAM blacklists where you can blacklisted because of something someone else did. UCEProtect monitors and tracks the SPAM reputation of individual email server IP addresses, and factors in the reputation of other servers in the same network as well as servers hosted by the same ISP. UCEProtect’s ‘guilt by association’ approach means your servers can be blacklisted if your ISP hosts other systems that are caught for SPAMMing.
Here’s an example. Your company’s site and servers are hosted with ‘hosting-company.com’ (we made that up just on case you weren’t sure). Now, assume ‘hosting-company.com’ hosts hundreds of thousands of companies and has 30,000 IP’s under management, including your one, lonely email server. One day, a SPAMMER who is a customer of ‘hosting-company.com’ sends a few email campaigns that are UCEPRotect flags as SPAM. UCEProtect flags the offending IP, but it also flags the adjacent IPs within the same network. If there are enough SPAM complaints from adjacent IPs, the complaints ‘escalate’ and can cause an entire network block or even an entire ISP’s address block to be blacklisted.
UCEProtect’s logic (along with some very valid and convincing data) is that – ISPs who host one or two SPAMMERS probably host dozens or hundreds of spammers.
Uribl.com (www.uribl.com)
URIBL uses ‘SPAM honeypots’ – just like Spamhaus.org does. The difference (we believe) is that URIBL will keep the URL (or domain or sending email address) of the offending domain on their list for an undefined time — until any (offending) traffic stops and you clear your domain with URIBL by confirming that the offending problem has been fixed.
Microsoft Frontbridge (88.blacklist.zap – not a website)
If you find your emails are getting blocked by recipients who are using Outlook, then you may want to review your MTA logs (email server logs) for references to 88.blacklist.zap. That’s Microsoft’s internal Frontbridge SPAM filter service that is used to protect aanyone using Outlook, and who has their email configured to use Microsoft’s spam filtering service (which is free). If you have stumbled onto Microsoft’s blacklist Your email server log will include an entry such as “550 Service Unavailable; host [xx.xx.xx.xx] blocked using 88.blacklist.zap. Please forward this message to delist@frontbridge.com. Response time is within 24 hours.
Enterprise Firewall SPAM Blacklists
Companies that make SPAM firewalls each maintain their own network of systems that share SPAM information. All of them track results based on IP address; several also track history based on URLS within emails, the sending domain and sending email addresses. The most common Enterprise SPAM firewall companies and their respective SPAM databases are summarized here:
| Vendor | SPAM Database / Repository | IP Address | Links/URLs | Domain | Other |
| Proofpoint: | YES | NO | NO | NO | |
| Cisco / Ironport: | YES | NO | NO | NO | |
| Fortinet: | YES | YES | YES | YES | |
| Barracuda: | YES | NO | YES | NO | |
| McAfee: | YES | YES | YES | NO | |
| Sophos: | YES | NO | NO | NO | |
| Symantec: | http://www.symantec.com/business/security_response/ landing/spam/index.jsp |
YES | NO | NO | NO |













April 20th, 2009 at 12:33 pm
Please feel free to use our Blacklist Lookup Tool to see if you are listed on a Blacklist. We also provide a Blacklist Protection service, for more information, email us at info@mxtoolbox.com.
Thanks!
Wendy