DroneBL · IPv4 and IPv6
Signals compromised hosts, proxies, bots, abusive VPNs, and other network-abuse classes. It is not limited to email spam. Return-code classes are decoded individually.
Official usage documentationCheck one numeric IP address against a small, policy-compatible set of live public DNS blocklists. Every result preserves the DNS outcome and provider return code instead of turning failures into a false “clean” result.
The checker deliberately favors documented, directly queryable public zones over a large but unverifiable provider count. IPv4 gets four sources; IPv6 gets DroneBL only.
Signals compromised hosts, proxies, bots, abusive VPNs, and other network-abuse classes. It is not limited to email spam. Return-code classes are decoded individually.
Official usage documentationA fast-moving list of IPs associated with reported email. SpamCop warns that it is aggressive and recommends scoring or tagging rather than blind rejection.
Official query documentationA passive spamtrap list. Its operator says anybody may use the DNS zone and also warns that legitimate mail servers can occasionally be false positives.
Official usage documentationRecent attacks reported by participating systems, including SSH, mail, web, login, and other services. It is broader network-abuse evidence, not an email-sender verdict.
Official DNS documentationA documented provider return code was received. It describes that provider’s dataset and policy only; review the decoded reason and official lookup before acting.
NXDOMAIN or NODATA was returned authoritatively for that exact zone and address. This is a point-in-time negative result, not proof of safety or deliverability.
SERVFAIL, REFUSED, timeout, conflicting authorities, an unknown A code, or an API/network failure never becomes “not listed.” Recheck later or query the operator directly.
Confirm the IP in the bounce or logs, fix compromised hosts or sending practices first, use the provider’s evidence/removal path, then allow for DNS cache and list update delays.