DNSBL Monitoring (Blacklists)

Checks if your server's IP address is listed on DNS-based blacklists (DNSBLs). Being listed on a blacklist can severely impact email deliverability, cause outgoing mail to be rejected, and damage your domain's reputation.

How It Works

Hoppla resolves your monitor's hostname to its IP address, then queries multiple well-known DNSBL providers to check if that IP is listed. Each DNSBL is queried using a standard reverse-DNS lookup against the provider's zone. A positive response means your IP is on that blacklist.

What Hoppla Checks

Multiple DNSBL providers -- Queries a curated list of the most widely used blacklists
Listing status -- Whether your IP appears on each provider's list
Return code -- The DNS response IP (e.g., 127.0.0.2) the provider returns for a listing
Delisting detection -- Alerts you when a previously listed IP is removed from a blacklist

Configuration

Setting	Description	Default
DNSBLs to check	Which blacklist providers to query (a subset of the supported zones)	All supported providers
Check interval	How often to query the blacklists	Daily (24 hours)

Supported DNSBL Providers

Hoppla queries the following 20 DNSBL zones:

Zone	Focus
`zen.spamhaus.org`	Comprehensive spam and exploit detection
`bl.spamcop.net`	Spam reports
`b.barracudacentral.org`	Spam sources
`cbl.abuseat.org`	Compromised hosts, bots
`dnsbl-1.uceprotect.net`	Individual IPs (level 1)
`dnsbl-2.uceprotect.net`	Network ranges (level 2)
`psbl.surriel.com`	Passive spam block list
`dnsbl.dronebl.org`	Drones, botnets, compromised hosts
`db.wpbl.info`	Weighted private block list
`all.s5h.net`	General spam sources
`bl.0spam.org`	Spam sources
`blacklist.woody.ch`	Spam and abuse
`combined.abuse.ch`	Combined abuse.ch feeds
`spam.abuse.ch`	abuse.ch spam feed
`spamrbl.imp.ch`	Spam sources
`z.mailspike.net`	Reputation / spam
`ubl.lashback.com`	Unsubscribe abuse
`virus.rbl.jp`	Virus / malware sources
`bogons.cymru.com`	Bogon (unallocated) address space
`spamsources.fabel.dk`	Spam sources

Results

Each check reports the status across all configured providers:

Field	Description
Provider	The DNSBL zone that was queried
Listed	Whether your IP was found on this blacklist
Return code	The DNS response IP the provider returns for a listing (e.g., `127.0.0.2`)

Hoppla does not fetch TXT records, so no per-listing "reason" text is provided. Diagnostic responses (127.255.255.252, 127.255.255.254, 127.255.255.255) — which indicate rate limiting or queries via a public/open resolver rather than a genuine listing — are filtered out and not treated as listings.

Example Result

DNSBL check for 203.0.113.42 (example.com):

  zen.spamhaus.org:        Not listed
  b.barracudacentral.org:  Not listed
  bl.spamcop.net:          LISTED (127.0.0.2)
  cbl.abuseat.org:         Not listed
  dnsbl-1.uceprotect.net:  Not listed

  Summary: Listed on 1 of 20 providers

Alerts

DNSBL is advisory: a listing sets the check status to warning (one or more listings) but never opens an incident.

Event	Trigger	Severity
`warning.dnsbl_listing`	IP address newly listed on, or newly removed from, one or more blacklists	Warning

The warning.dnsbl_listing event fires on both new listings and delistings. Its payload includes newly_listed, newly_delisted, and total_listings.

What to Do When Listed

Identify the cause -- Look up your IP on the listing provider's website for details (compromised account, open relay, spam reports)
Fix the underlying issue -- Secure compromised accounts, close open relays, review outgoing mail
Request delisting -- Most providers offer a self-service delisting process on their website
Monitor after delisting -- Use Hoppla to confirm the listing is removed and does not recur

DNSBL Monitoring (Blacklists) ​

How It Works ​

What Hoppla Checks ​

Configuration ​

Supported DNSBL Providers ​

Results ​

Example Result ​

Alerts ​

What to Do When Listed ​