IP Reputation

Find out as soon as one of your server's IP addresses lands on a spam or abuse blocklist, before mail starts bouncing.

What the IP reputation check does

An IP reputation monitor asks public DNS blocklists (DNSBLs) whether an address is listed. It never connects to your server: each lookup is a DNS query for the address, reversed, under the list's zone — for 203.0.113.7 on SpamCop, that is 7.113.0.203.bl.spamcop.net. An answer means listed; no such name means not listed.

Each check:

• takes the address you entered, or resolves the hostname you entered. A hostname resolves to its first IPv4 address; if it has none, to its first IPv6 address. Only that one address is checked. A full URL works too — the hostname is taken from it;
• queries the lists set under Blacklist providers at once — all 31 below by default — for IPv4 and IPv6 addresses alike;
• also looks up the address's reverse DNS name and, for IPv4, the network it belongs to (ASN, prefix and country). These are shown on the monitor page and never fail the check.

The monitor goes down once the address is on at least as many lists as Alert threshold says — one by default, so a listing on any one list takes the monitor down, whichever list it is. Fewer listings than the threshold leave it up, and the check still records them. A list that doesn't answer, or answers with an error, counts as not listed.

The lists checked

The first six are the lists mail providers act on most; the monitor page calls a listing on one of them high impact.

UCEPROTECT L2 and L3 list whole networks and whole providers (ASNs) rather than single addresses, so an address can be listed there for what its neighbours sent.

Create an IP reputation monitor

1. 1
   Choose the type

   On the Monitors page, click New, open the type picker and choose IP reputation monitor. It is listed under Security & certificates.

2. 2
   Enter the address

   Fill in IP address or hostname — for example 203.0.113.7 or mail.example.com. For mail, enter the address your server sends from: that is the one receiving servers look up, and it isn't always what your domain's A record points to.

3. 3
   Choose the lists and the threshold

   Under Blacklist settings:

   Setting	What it does
   Blacklist providers	All 31 lists (the default) checks every list above. Spamhaus only checks Spamhaus ZEN, SBL and XBL; Barracuda only checks Barracuda BRBL; SpamCop only checks SpamCop.
   Alert threshold	How many lists the address must be on before the monitor goes down: 1 (the default), 2, 3 or 5.

4. 4
   Create it

   Pick who is alerted under How should we escalate incidents? and click Create monitor. Check frequency under Advanced settings defaults to 3 minutes; listings change slowly, so a longer interval such as an hour is enough. The other shared settings are described in Monitors.

With the defaults, every check queries all 31 lists and one listing is enough to take the monitor down. Monitor each sending address separately: a hostname with several addresses is checked on its first one only.

When it goes down

A passing check reads IP 203.0.113.7 is clean. Checked 31 providers. — or, when the address is listed on fewer lists than the threshold, IP 203.0.113.7 is listed on bl.spamcop.net (alerts at 2 listings). A timed-out check reports no listings at all, even for lists that had already answered. The incident stays open until checks find the address on fewer lists than the threshold, and after the Recovery period if you set one.

The monitor page

• The address and its standing: CLEAN, or LISTED with the number of lists, and how many blocklists were checked.
• Reputation score, over time and now: 100, less 25 for each listing on one of the six high-impact lists and 2 for each other listing. The badge reads CLEAN, GOOD STANDING (minor listings, score 90 or more), AT RISK (minor listings, score below 90) or BLOCKLISTED (any high-impact listing). The score helps you judge a listing; it doesn't change when the monitor goes down.
• IP information: IP address, Reverse DNS, ASN, Network and Country.
• Blocklist checks: one row per list from the latest check, listed ones first. Expand a row for the list's zone, the return code it answered with, how long the address has been listed, the likely effect on mail and how delisting works for that list.
• Blocklist coverage, beside it: lists checked, clean and listed, and the Spamhaus and Barracuda results.

Troubleshooting

The monitor is down for a list I don't care about

With All 31 lists, every list counts. Open the row under Blocklist checks to see the list and its category, then follow that list's delisting process — many remove an address on their own once the problem stops. A listing on UCEPROTECT L2 or L3 is about your provider's network, not your address; ask the provider. To alert only on the lists mail providers act on most, set Blacklist providers to one of them, or raise Alert threshold so a single minor listing doesn't take the monitor down.

The checked address isn't the one I expected

A hostname is resolved on every check and only its first address is looked up — compare IP address on the page. A name behind a CDN or load balancer resolves to their address, not your server's. Enter the IP itself to pin it.

The check times out

The lists are asked in parallel, and the check fails if they haven't all answered within 30 seconds. An occasional timeout is a slow list; it usually passes on the next check.

Reverse DNS shows Missing

The address has no PTR record. Some lists, such as SpamRATS NoPtr, list addresses for that alone, and many mail servers reject mail from them. Ask whoever owns the address — usually your hosting provider — to set one.