MultiRBL Check – Complete Guide to Checking IPs and Mail Servers Against DNS Blocklists

A mail server that suddenly gets "554 rejected, listed at …" bounces, or whose mail quietly moves to spam folders, is often listed on a DNS blocklist. The listing may come from a compromised mailbox, a hacked web form sending spam, or simply a new IP address that inherited a bad reputation. Before you can fix it, you need to know which lists are involved and what they say.

The MultiRBL Check queries a selectable set of DNS blocklists for a public IPv4 or IPv6 address or a mail server host name, and shows each list's verdict, return codes, response time and links to its information and delisting pages. Lists that cannot be queried or do not answer are reported as unknown, never as clean.

What is a MultiRBL check?

In simple terms

A blocklist is a public list of addresses that have been seen sending spam or that should not send mail directly. Mail servers check it for every incoming connection. A MultiRBL check asks several of these lists at once whether your address is on them, so you see the same picture a receiving mail server sees.

Technical background

DNSBLs are described in RFC 5782. The query is an ordinary DNS lookup of a specially built name:

• IPv4: reverse the octets and append the list zone. For 198.51.100.7 and bl.spamcop.net the name is 7.100.51.198.bl.spamcop.net.
• IPv6: write all 32 hex nibbles, reverse them, separate them with dots and append the zone.
• Domain lists (RHSBL/URI lists such as Spamhaus DBL, SURBL, URIBL): append the zone to the domain, e.g. example.com.multi.uribl.com.

The answer means:

• NXDOMAIN: not listed.
• An A record in 127.0.0.0/8: listed; the specific address is the return code. A TXT record at the same name often explains the reason.
• Some providers use special 127.x answers as error codes, for example Spamhaus 127.255.255.254 for "query via a public resolver" and URIBL 127.0.0.1 for "query refused".

Blocklists often refuse queries that arrive through large public resolvers such as 8.8.8.8, because those resolvers aggregate traffic from millions of users. That is why a serious checker must use its own recursive resolver.

Command-line equivalent: dig +short 7.100.51.198.bl.spamcop.net A (an empty answer with NXDOMAIN status means not listed).

Why use a MultiRBL check?

• Explain bounces that mention a blocklist.
• Monitor a new IP before putting a mail server or relay into production.
• Investigate a compromise: an XBL or CBL-style listing points to malware or an exploited host.
• Check policy listings: a PBL listing means the address is in a range that should not send mail directly.
• Check domain reputation of a sending domain or the domains in your links on URI lists.
• Get the right delisting link for each provider.

Who should use it?

• Mail administrators running outbound mail servers or relays.
• Hosting providers and MSPs handling abuse and reputation tickets.
• Security teams investigating compromised hosts.
• Web administrators whose contact forms or CMS send mail.

How MultiRBL check works

1. Validation in the browser and on the server. The target must be a public IPv4 or IPv6 address or a valid public host name. Private, loopback, CGNAT and documentation addresses and internal names are rejected. IPv6 is normalized to its compressed form.
2. Per-list support. Each list declares what it accepts (IPv4, IPv6, domain). Unsupported combinations are reported as Unsupported query without sending anything.
3. Host names. A host name is queried by name on domain lists. For IP lists, the server first resolves the name's IPv4 addresses through the public resolvers 1.1.1.1 and 8.8.8.8 and checks up to two of them; if any address is listed, the row is listed.
4. The NetTools.tech blocklist resolver. All DNSBL queries go to the server's own recursive resolver (Unbound running on the NetTools.tech server), not to a public resolver, so lists that block public resolvers can still answer. Each query has a 4-second timeout and one try.
5. Access rules. Spamhaus ZEN and DBL are only queried when the server has a Spamhaus Data Query Service (DQS) key configured; then the query goes to the DQS zone. Barracuda BRBL is only queried once the NetTools resolver is registered with Barracuda. Until then those rows show Provider unavailable with the reason.
6. Interpretation. NXDOMAIN is "Not listed". An answer in 127.0.0.0/8 is "Listed", with known return-code meanings and the TXT reason. Documented error codes, SERVFAIL and REFUSED are "Provider unavailable", timeouts are "Timeout", and NODATA, empty answers or answers outside 127.0.0.0/8 (a resolver rewriting responses) are "Lookup error".
7. Limits. At most 30 lists per request, at most 10 checks of the same target per 10 minutes across all users, a 25-second server limit, plus per-client rate and concurrency limits. The page stops waiting after 45 seconds.

The lists

UCEPROTECT levels 2 and 3, which list whole ranges and providers, are deliberately not queried.

How to use the NetTools.tech MultiRBL Check

1. Open MultiRBL Check.
2. Enter a public IPv4 or IPv6 address, or a mail server host name, in IP address or mail server hostname.
3. Under Blocklists, keep the defaults or tick the lists you need. Defaults, All and None change the selection; the counter shows how many are selected.
4. Press Check.
5. Read the summary tiles and the table. Use the Info and Lookup / delist links to go to the provider.

Other tools can link here with the target prefilled (/multirbl?target=…); you still press Check yourself.

Understanding the results

The header shows the normalized target and when it was checked. Summary tiles count Checked, Listed, Not listed and Unavailable (lookup errors, timeouts and unavailable providers together), plus Unsupported and Not checked when present.

Example: a host name with two addresses

Suppose you check a hypothetical mail host mail.example.com that resolves to 198.51.100.7 and 198.51.100.8 (documentation addresses; the real tool rejects documentation ranges, so you would enter your own server). Illustrative rows:

Reading it: the second address is listed on SpamCop, so mail leaving through 198.51.100.8 is at risk. Spamhaus rows are unknown on this server, not clean; check them directly with Spamhaus's own lookup via the link. SpamCop listings expire automatically once reports stop, so the priority is finding what sent spam from that address.

Common use cases

• Answering "are we blacklisted?" after a bounce.
• Checking an IP from a message header of a suspicious message.
• Pre-flight check of a new outbound IP or relay.
• Checking whether a domain used in newsletters is on a URI list (enable SURBL and URIBL).
• Confirming that a delisting has taken effect.

Troubleshooting

Spamhaus or Barracuda always show "Provider unavailable"

That is the honest state when the server has no Spamhaus DQS key or no Barracuda resolver registration. Use the provider's own lookup page linked in the row to check those lists.

Many lists show "Timeout" or "Lookup error"

The lists' name servers may be slow or overloaded, or the NetTools blocklist resolver may be temporarily unavailable ("The NetTools blocklist resolver is not running"). The results are unknown, not clean; try again later.

"The hostname has no IPv4 address to check on IP blocklists"

The host name has no A record (or only AAAA). IP lists are queried with IPv4 addresses of host names only. Enter the IPv6 address directly, or the IPv4 address the server actually sends from.

"This target was checked many times recently"

The same target was checked ten times in ten minutes. Blocklists are shared infrastructure; wait a few minutes.

Listed on PBL

A PBL code (127.0.0.10 or 127.0.0.11) means the IP is in a range that should not deliver mail directly, typically dynamic or end-user space. Send through your provider's relay, or ask the ISP for a static business address with proper reverse DNS.

Common mistakes

• Checking the web server's IP when mail leaves through a different relay.
• Treating "Provider unavailable" or "Timeout" as clean.
• Requesting delisting before fixing the cause, which leads to relisting.
• Checking the domain on IP-only lists and expecting a domain verdict; host names are checked on IP lists through their IPv4 addresses only.
• Using third-party "delisting services" instead of the provider's own procedure.

Limitations

• Only the lists shown are queried. A clean result here does not mean the address is clean on lists not included or on providers' private reputation systems (Gmail, Microsoft and others do not publish theirs).
• Spamhaus and Barracuda results depend on server configuration and may be unavailable.
• Host names are checked via at most two IPv4 addresses; IPv6 addresses of host names are not checked.
• Listings change continuously; a result is a snapshot at the time shown.
• Return codes are translated for Spamhaus ZEN only; other lists show raw codes and their TXT reason.

Security & privacy

The target is sent to the NetTools.tech server. The blocklist operators see a DNS query from the NetTools resolver containing the target, never your IP address. Results are not stored; the tool log keeps the tool name, the target and your shortened IP address for 30 days (see the privacy policy). Only public addresses and names are accepted, and the server can query only the configured blocklist zones, with no general DNS access. No credentials are needed.

Related tools

• Email Blacklist Check – quick overview with the default lists (guide).
• Reverse DNS Lookup – missing PTR records are a common listing reason (guide).
• MX Lookup – find the mail server names and addresses to check (guide).
• Email Header Analyzer – find the sending IP of a message (guide).
• IP Lookup – who owns an address range (guide).

Summary

DNS blocklists are queried by receiving mail servers for every connection, and a listing on a widely used one affects delivery immediately. The NetTools.tech MultiRBL Check queries selectable lists through its own resolver, honors each provider's access rules, and separates listed, not listed and unknown results clearly. Fix the cause of a listing before using the provider's delisting procedure.

Frequently asked questions

What is an RBL or DNSBL?

A DNS-based blocklist is a list of IP addresses or domains published through DNS. Mail servers query it for the connecting IP or for domains in a message and may reject or score mail from listed sources.

Why is a list shown as provider unavailable instead of not listed?

Either the list cannot be queried from this server (Spamhaus needs a Data Query Service key and Barracuda needs a registered resolver), or the list's name servers refused or failed to answer, or it returned a documented error code. In all those cases the listing status is unknown, so the tool says so rather than reporting a clean result.

My IP is listed. What should I do?

Find and fix the cause first: a compromised account or website, an open relay, malware on a client, missing reverse DNS or a sudden spike in volume. Then follow the removal procedure on the list's own site, linked in the Links column; many lists expire entries automatically once abuse stops.

How is MultiRBL different from Email Blacklist Check?

MultiRBL lets you choose which lists to query and shows the query name, return codes, query time and info and delisting links for each list. Email Blacklist Check runs the default selection and gives a short overview with a link to the full MultiRBL report.

Can I check an IPv6 address?

Yes, but only lists that support IPv6 queries are asked; of the lists offered here, only Spamhaus ZEN accepts IPv6, and it requires a DQS key. Lists without IPv6 support are shown as Unsupported query.

Why can't I check a private or documentation IP address?

Blocklists only track public internet addresses, so private, loopback, CGNAT and documentation ranges such as 192.0.2.0/24 are rejected before any query is sent.

What does a return code like 127.0.0.2 mean?

A DNSBL answers a listing with an address in 127.0.0.0/8, and the last octet usually encodes the reason or sub-list. For Spamhaus ZEN the tool translates known codes, for example 127.0.0.4 for the exploited-host list XBL and 127.0.0.10 or 127.0.0.11 for the policy list PBL.