Mail server reputation

A mail domain, or the public address of a mail server, checked against the DNS blocklists that still decide whether mail is delivered: Spamhaus, Barracuda, SpamCop and a few smaller ones. For every list that lists an address, the monitor page gives the list’s answer code, its published reason and a direct link to its lookup and removal page.

No API key is needed. Leave the credential on “No key (recommended)”: the lists are queried through the server’s DNS resolver, or through the resolver you set under Resolver. Only Spamhaus can refuse, and only when that resolver is a public one; see Resolvers, refusals and timeouts.

Enter a domain (example.com) and DumbMonit checks the addresses of its MX hosts (A and AAAA records), the addresses of the domain itself, and any Extra addresses you add (an outgoing relay that is not an MX). The domain is also checked against the domain blocklists. Enter an IP address and only that address is checked. To watch a whole range of addresses, use IP range blocklist.

Network ports to open

From the DumbMonit server (or its relay agent) to the device:

Port	Protocol	Purpose
53	UDP	DNS lookups of the blocklists (default port)
53	TCP	DNS lookups too large for UDP (default port)

Gmail, Outlook.com and Yahoo

The large mailbox providers publish no blocklist that can be queried: what they think of a sender is internal to them. DumbMonit does not pretend to ask them. It checks what weighs on their decision, and links to their tools:

• Reverse DNS: every sending address should have a PTR record whose name resolves back to the same address (forward-confirmed reverse DNS, FCrDNS). Gmail, Outlook.com and Yahoo refuse or junk mail from addresses without it.
• SPF and DMARC: exactly one SPF record on the domain, and a DMARC record at _dmarc.<domain>. Gmail and Yahoo require both from bulk senders.
• The blocklists below, which their filters also read.

DKIM is not checked: its selector is chosen by each sender and cannot be guessed. The monitor page links to:

Provider	Tools
Gmail	Postmaster Tools (reputation of a verified domain), sender guidelines, delivery problem form
Outlook.com / Hotmail	SNDS (reputation data per address), sender policies, sender support form (delisting from Outlook.com), Microsoft 365 delisting portal
Yahoo / AOL	Sender Hub, best practices, sender support form

The blocklists

Checked on 16 October 2026. SORBS closed in June 2024 and is not queried. Each list is asked an A record under its zone. The form shows them as a checklist named Blocklists (name, whether it checks addresses or the domain, major or not, and a short description); the major ones are ticked on a new monitor. The id in the first column is what the lists option stores, and what the API and the metrics call the list.

Id	List	Zone	Checks	IPv6	Major	Use and removal
spamhaus_zen	Spamhaus ZEN (SBL, CSS, XBL, PBL, DROP)	zen.spamhaus.org	addresses	yes	yes	Free public mirrors for low-volume, non-commercial use; refuses public and open resolvers. Removal from the Spamhaus checker. PBL lists end-user ranges by policy: remove an address from it only if it really runs a mail server.
barracuda	Barracuda BRBL	b.barracudacentral.org	addresses	no	yes	Free; Barracuda asks that the DNS servers querying it be registered with a free account at barracudacentral.org. Removal request.
spamcop	SpamCop	bl.spamcop.net	addresses	no	yes	Free. Listings expire on their own about a day after the reports stop; the lookup page shows why and offers delisting.
mailspike	Mailspike	bl.mailspike.net	addresses	no	no	Free at low volume. Lookup and delisting.
uceprotect_1	UCEPROTECT Level 1	dnsbl-1.uceprotect.net	addresses	no	no	Free to query. Listings expire after seven days without new spam; the check page also sells express delisting, which is never required. Few receivers use it.
psbl	PSBL (Passive Spam Block List)	psbl.surriel.com	addresses	no	no	Free. Self-service removal on the listing page.
spamrats	SpamRATS (Dyna, NoPtr, Spam, Auth)	all.spamrats.com	addresses	no	no	Free at low volume. RATS-NoPtr lists addresses without reverse DNS. Lookup and removal.
spamhaus_dbl	Spamhaus DBL	dbl.spamhaus.org	the domain	—	yes	Same terms as ZEN. Removal from the Spamhaus checker.
surbl	SURBL (multi)	multi.surbl.org	the domain	—	no	Free for low volume; refuses public and busy resolvers. Lookup and removal.
uribl	URIBL (multi)	multi.uribl.com	the domain	—	no	Free for low volume; refuses public and busy resolvers. Lookup, removal.

A listing on a major list fires a critical alert; one on the other lists an advisory one. IPv6 addresses of the MX are checked against Spamhaus ZEN only, the one list here that answers for IPv6; the others show them as not covered.

Your own lists

Under Custom lists, at the end of the checklist, add the DNSBL zones of any other list you use or run yourself (for example dnsbl.example.org). Each one has a Type: ip (the zone is asked about each address, as 1.2.0.192.dnsbl.example.org) or domain (about the mail domain), and a Major switch for a list whose listing should raise the critical alert. The zone must be a valid domain name, not an IP address, and cannot repeat another zone or one of the lists above; at most 20 custom lists. Any 127.x.x.x answer counts as listed; NXDOMAIN as clean.

The monitor queries exactly the ticked lists plus the custom ones. A monitor created before these options existed has no setting and keeps querying every list above. The lists option holds the ticked ids separated by commas (- when none is ticked) and custom_lists a JSON array such as [{"zone": "dnsbl.example.org", "subject": "ip", "major": false}].

Resolvers, refusals and timeouts

The lists are queried through DNS, and how they answer depends on which resolver asks:

• Spamhaus refuses queries that come through public resolvers (Google 8.8.8.8, Cloudflare 1.1.1.1, Quad9), through resolvers that forward to them, or through resolvers without an attributable reverse DNS. It then answers 127.255.255.254 instead of NXDOMAIN (127.255.255.255 when a resolver sends too many queries, 127.255.255.252 for a malformed query or a wrong DQS key). These look like listings and are not: DumbMonit marks the Spamhaus list as refused (“Spamhaus refuses this resolver” on the monitor page), never as “listed”, and the other lists keep their results. Only when no other selected list answered does the monitor show a configuration error (which sends no outage alert) instead of a result.
• URIBL and SURBL answer 127.0.0.1 to resolvers they refuse. That list is then shown as “Refused” (unknown), not as a listing.
• A list that does not answer in time is unknown, never clean. Only NXDOMAIN means “not listed”. An answer outside 127.0.0.0/8 (a resolver that rewrites NXDOMAIN into the address of a search page) is unknown too.

So use a recursive resolver of your own: Unbound, Knot Resolver, BIND or PowerDNS Recursor resolving from the root servers (not forwarding to a public resolver), and set its address under Resolver if it is not the system resolver. Pi-hole or AdGuard Home in front of Unbound works; in front of 1.1.1.1 it does not.

Or, only if you want Spamhaus too and cannot change the resolver, create a free Spamhaus Data Query Service account (non-commercial use, low volume) and enter its key as the credential (“Spamhaus DQS key (optional)”): Spamhaus is then asked under <key>.zen.dq.spamhaus.net and <key>.dbl.dq.spamhaus.net, which answer through any resolver. The key is stored encrypted and never shown again.

Pace

Blocklists limit how often a resolver may ask, and ban resolvers that sweep them. DumbMonit asks every list once per Refresh interval (6 hours by default), at most Queries per second (10 by default) with eight queries in flight, and shows the last result again at every check in between, so the alert rules see a continuous series. A check runs in the background: the first result appears a few seconds after the monitor is added, and changing the address, an option or the key starts a new check at once. A check whose result is an error is retried after ten minutes.

Check a mail server against the blocklists

1. Enter the domain you send mail for (“example.com”), or the public IP address the server sends from.

2. No API key is needed: leave the credential on No key.

3. Tick the blocklists to query under Blocklists, and add any other DNSBL zone under Custom lists.

4. If the monitor shows “Spamhaus refuses this resolver”, set “Resolver” to your own recursive resolver, or choose the free Spamhaus DQS key as the credential.

   https://www.spamhaus.com/data-access/free-data-query-service/

Warning

A blocklist that does not answer is shown as unknown, never as clean.

For a domain, DumbMonit checks the addresses of its MX and of the domain itself; if mail leaves through a relay that is not an MX, add its address under Extra addresses. Without a key, the blocklists are queried through this server’s DNS resolver, or through the one you set under Resolver. Only Spamhaus can refuse a query, and only when the resolver is a public one (Google, Cloudflare, Quad9) or forwards to one; every other list keeps working. To check the setup, add a monitor for 127.0.0.2, the test address every blocklist lists: each one should show it as listed. Gmail, Outlook.com and Yahoo publish no blocklist that can be queried: DumbMonit checks what they weigh instead (a reverse DNS that points back to the address, SPF and DMARC records) and links to their sender tools on the monitor page. The lists are asked every 6 hours by default: asking more often gains nothing and gets resolvers banned.

Vendor documentation: https://www.spamhaus.org/blocklists/zen-blocklist/

What it watches

All metrics are prefixed dumbmonit_blacklist_.

Metric	What	Labels
listed_major_lists	major lists (Spamhaus ZEN and DBL, Barracuda, SpamCop) that list an address or the domain
listed_lists	all lists that list an address or the domain
addresses_checked	addresses checked
addresses_listed	addresses listed on at least one list
domain_listed	1 when the domain is on a domain blocklist
unknown_checks	checks without an answer (timeout, refusal)
check	one series per address (or domain) and list: 1 listed, 0 clean, −1 no answer, −2 refused, −3 not covered	list, subject, state, code, meaning, reason
list_checked, list_listed, list_unknown	per list: subjects asked, listed, without answer	list
list_info	value 1, one per list actually queried (custom ones included): what the monitor page shows	list, name, zone, subject, major
address_info	value 1, where each address comes from	address, source (mx, domain, input, extra), mx
ptr_ok	1 when the reverse DNS resolves back to the address	address, ptr
mx_hosts	MX hosts of the domain
spf_records	v=spf1 records on the domain (1 is right)
dmarc_records	v=DMARC1 records at _dmarc.<domain>
dmarc_policy_info	value 1	policy
mail_auth_missing	0 to 2: SPF missing or duplicated, DMARC missing
scan_age_seconds, scan_duration_seconds, scan_running	the check shown: its age, how long it took, whether a new one runs

The built-in rules that apply: Listed on a major blocklist, Listed on a blocklist, Mail server reverse DNS mismatch, SPF or DMARC missing, plus Monitor unreachable when the resolver answers none of the queries.

The monitor page

The panel reads what the probe stored; opening the page never queries a blocklist. It shows the counts, then the lists actually queried (the ticked ones and your custom ones, each with how many subjects it lists, and “Spamhaus refuses this resolver” when that is the case), then every result with the list’s code, its published reason and links to its lookup and removal pages, then the reverse DNS of each address, SPF and DMARC, and the sender tools of Gmail, Outlook.com and Yahoo.

The page also has an Also check on MXToolbox link. It opens the public blocklist lookup of mxtoolbox.com in a new tab for the monitored address or domain; DumbMonit does not call their API.

Credentials

None needed (“No key (recommended)”, the default), or optionally a Spamhaus DQS key (see above), which only matters for Spamhaus.

Address: a domain (example.com) or a public IP address. Options: Resolver, Blocklists (the major ones ticked on a new monitor; all of them for a monitor created before), Custom lists, Extra addresses, Refresh interval (6 hours, from 1 to 168), Queries per second (10, from 1 to 50) and Timeout per query (5 s, from 1 to 30). Private addresses are never checked: blocklists only know the public Internet. 127.0.0.2 is accepted as the test address.