The DNS query behind every row
A DNS blocklist is a zone whose records encode verdicts. To ask Spamhaus ZEN about 203.0.113.25 the checker reverses the octets and queries 25.113.0.203.zen.spamhaus.org for an A record. IPv6 addresses are expanded to all 32 nibbles and reversed the same way, which is why only ZEN, the one list here that publishes IPv6 data, is queried for them.
If the answer is NXDOMAIN or an empty response the address is not listed. If the answer is an address inside 127.0.0.0/8 it is listed, and the tool then asks for the TXT record at the same name, which most operators use to carry a short explanation or a lookup URL. The first 300 characters of that text appear in the Details column, under the decoded meaning of the return codes.
Why some lists come back as unavailable
Several operators refuse queries that arrive through large public resolvers, and some answer with a special code instead of a verdict. Spamhaus returns 127.255.255.x for refused or over-quota queries. URIBL and SURBL return 127.0.0.1. The checker knows these codes and reports them as unavailable, never as a listing.
For the same reason the lookups go through the system resolver of the server running the check rather than the public resolvers behind the DNS lookup tool. Two more situations produce unavailable: no answer within the timeout, which defaults to three seconds, and an answer outside 127.0.0.0/8, which means a resolver on the path rewrote NXDOMAIN into an advertising page.
Reading Spamhaus, SURBL and URIBL return codes
ZEN is an aggregate, so one query can return several codes. 127.0.0.2 is the SBL (a known spam source), 127.0.0.3 is CSS (snowshoe spam spread over many addresses), 127.0.0.4 is the XBL (a compromised host, formerly the CBL), 127.0.0.9 is DROP (hijacked or criminal networks) and 127.0.0.10 and 127.0.0.11 are the PBL, which marks dynamic and end-user ranges that should not deliver mail directly.
The domain lists use their own schemes. Spamhaus DBL answers 127.0.1.2 for a spam domain, 127.0.1.4 for phishing, 127.0.1.5 for malware, 127.0.1.6 for botnet command and control, and 127.0.1.102 to 127.0.1.106 for legitimate domains that have been abused. URIBL and SURBL return a bitmask in the last octet, which the tool decodes into labels such as black, grey, red, phishing, malware or abuse. DroneBL uses a class number instead, for example 8 for an open SOCKS proxy or 13 for brute-force attacks.
Which listings matter and what to fix
Spamhaus ZEN and DBL, Barracuda and SpamCop are consulted by large providers and commercial filters, so a listing there costs you mail. UCEPROTECT Level 2 and Level 3 list whole allocations and whole autonomous systems because of other customers, and the tool labels them as rarely used for blocking. A listing on a small list with no reason text is worth noting but seldom explains a bounce on its own.
Before you click Request removal, find the cause. An XBL or CSS listing usually means a compromised account, an infected machine or an open relay on that address. A DBL or SURBL listing points at the domain itself appearing in spam. Delisting without fixing the source gets you relisted, often with a longer hold.
- XBL or DroneBL: look for malware, a bot or an open proxy on the host
- SBL or CSS: audit outbound volume, web forms and compromised accounts
- PBL: send through your ISP's or provider's relay instead of direct to port 25
- DBL, SURBL or URIBL: the domain was seen in spam links; find out who is sending with your name
Limits and neighbouring tools
The tool does not query every list a receiver might use, and private or reserved addresses are rejected because they can never appear on a public list. Responses may be cached for a few minutes, so a fresh delisting can take a second run to show. A domain's mail servers are resolved to IPv4 only, and only the two highest-priority MX hosts are tested.
If you want blocklist status combined with reverse DNS, proxy detection and network ownership, use the IP reputation checker, which runs the same IP lists. For the sender-side records that receivers check alongside blocklists, look at SPF and DMARC. The SMTP test shows whether the server itself greets, encrypts and has a PTR record.