How our blacklist check works, and why we use 77 lists not 200

Plenty of blacklist checkers advertise their list count. 200 lists. 300 lists. "The most comprehensive check available." The number sounds like thoroughness. In practice, many of those lists are dead, abandoned, or ignored by every mail filter that matters. Some of them will flag any IP address you feed them, including yours.

This post explains how an email blacklist check actually works at the DNS level, how our scanner runs it, and why the list count went down, not up, as the check got more accurate.

What a blacklist is at the DNS level

Nearly every email blacklist is a DNSBL: a DNS-based blocklist. There is no API, no database export, no login. The entire lookup happens through ordinary DNS queries, which is why mail servers can consult these lists millions of times a day at almost no cost.

The mechanics are simple. To check whether the IP address 203.0.113.7 is on Spamhaus ZEN, a checker reverses the octets, appends the list's zone, and asks DNS for an A record:

7.113.0.203.zen.spamhaus.org

If DNS answers NXDOMAIN, the IP is not listed. If DNS returns an A record in the 127.0.0.0/8 range, the IP is listed, and the specific address encodes why. On ZEN, a response of 127.0.0.4 means the IP is on XBL, the list of compromised hosts and botnet infections. A response of 127.0.0.10 or 127.0.0.11 means PBL, a policy list of dynamic and residential IP space that was never supposed to send mail directly.

Domain-based lists such as Spamhaus DBL and SURBL work the same way, except the query uses a domain name instead of a reversed IP. They catch domains that appear in spam links, not just servers that send spam.

The whole convention is standardized in RFC 5782, which also defines the test entries every well-run list is supposed to honor. That detail matters later.

How the check runs, step by step

When you point the blacklist check at a domain, four things happen.

1. It finds the IPs that matter. The check resolves the domain's A record and its MX hosts. Your web server's IP and your mail server's IP are often different machines, and a listing means something different depending on which one is flagged.

2. It queries every list in parallel. Each IP is checked against 77 verified active email blacklists, and the domain itself is checked against 5 domain reputation lists. The queries run concurrently with a timeout, because a handful of slow zones should not stall the whole scan.

3. It validates every response. This is the part most checkers skip, and it is where false positives come from. A raw A-record response is not proof of a listing. The check accepts only responses inside 127.0.0.0/8, discards the 127.0.0.1 test value, and discards codes in the 127.255.255.x range, which some operators return to signal a refused or blocked query rather than a listing. Spamhaus, for example, answers with these codes when queried through large public DNS resolvers instead of reporting a real result. A checker that treats that as "listed" invents a problem you do not have. One list, HostKarma, uses return codes for whitelisting as well as blacklisting, so a response there can mean your IP is explicitly trusted. The check reads the code instead of counting every answer as a hit. Finally, listings are deduplicated across IPs so one flagged address does not show up as five findings.

4. It weights the result by tier. The 77 lists are not equal, and the report does not pretend they are. Tier 1 lists, including Spamhaus ZEN, SpamCop, Barracuda, and the CBL, correlate with the filtering decisions the major mailbox providers actually make. A listing there is a critical finding. Tier 2 lists such as Abusix, Mailspike, and SenderScore carry real weight with commercial filters. Tier 3 lists are active and legitimate but consulted by fewer systems, so a listing there is informational, not an emergency.

Why a dead list is worse than no list

Here is the problem with the 200-list pitch. Blacklists die constantly, and they die in ways that corrupt results.

Dead zones produce fake answers. When a list shuts down and its DNS zone stops responding, queries time out. A checker either hangs or quietly reports "clean" for a list that no longer exists. Either way, the big number on the marketing page is counting entries that return nothing.

Parked zones list the entire internet. When a dead list's domain expires and gets picked up by a domain parking service, the parking wildcard returns an A record for every query. Every IP address on earth becomes "listed" overnight. Any checker still querying that zone starts flagging every scan it runs.

Some lists go positive on purpose. Retired operators sometimes flip their zone to answer "listed" for all queries, deliberately, to force mail administrators to remove the dead list from server configs. ORDB, one of the early open-relay lists, did exactly this in 2008, more than a year after shutting down. Reasonable tactic for waking up negligent mail admins. Catastrophic for a checker that never re-validates its list inventory.

Some lists punish you for your neighbors. UCEPROTECT Level 1 lists individual IPs caught sending spam. Levels 2 and 3 escalate to entire network allocations and entire providers. Your IP can land on Level 3 without ever sending a message, because someone else at your hosting company did. A listing you cannot act on, from a list most filters do not consult, is not a deliverability signal. It is noise that scares people toward paid delisting services. The check queries Level 1 only.

What earns a list one of the 77 slots

A list stays in the check only while it behaves like a real, operating blacklist: the zone answers queries reliably, the operator publishes listing criteria, there is a working delisting process that does not require payment, and there is evidence that mail filters in the wild actually consult it. When a list dies, gets parked, or goes rogue, it gets removed.

That is why the number is 77 and not a round 200. Nobody chose 77. It is simply how many email blacklists currently pass verification, and the count changes when the landscape does. A padded list total is easy. An accurate one takes maintenance.

What to do if you are listed

First, check which IP is flagged. A listing on your web server's IP matters far less if a hosted provider sends your actual mail from different infrastructure.

Second, check the tier. A Spamhaus SBL or SpamCop listing needs action now. A PBL listing is often not an accusation at all: it marks dynamic IP space that should relay through a mail provider rather than sending directly, which is exactly what most businesses already do.

Third, fix the cause before requesting removal. Compromised sites, open relays, and purchased contact lists get you relisted within days. Legitimate lists delist for free once the source of the problem is gone. A list that demands payment for removal is telling you how much its data is worth.

And a clean blacklist record is the floor, not the ceiling. Mailbox providers weigh authentication, complaint rates, and sending history alongside list status, as Google's Email Sender Guidelines spell out in detail.

Check your own domain

The blacklist check runs the full 77-list scan described above, free, with tier labels on every result so you know which findings deserve attention. The email check adds SPF, DMARC, and DKIM context, since blacklist status and authentication failures usually travel together.

For the complete picture, run a full scan at acuityscan.com. It covers 350+ checks across 8 modules, including the email module that probes 16 common DKIM selectors alongside the blacklist sweep.

TL;DR

• Email blacklists are DNS zones. A checker reverses your IP, queries the zone, and reads the 127.0.0.x return code, per RFC 5782.
• Raw responses need validation. Test values, refused-query codes, and whitelist codes all look like listings to a naive checker.
• Dead and parked blacklist zones can report every IP on the internet as listed. Big list counts usually include them.
• 77 is the number of email blacklists that currently pass verification: alive, documented, free to delist from, and actually consulted by mail filters.
• If you are listed, check which IP, check the tier, fix the cause, then request removal. Never pay for delisting.