MXToolbox Blacklist Check: How to Use It for Cold Email (and What It Misses)
MXToolbox runs the most-cited free blacklist check on the internet. For cold email it's a useful one-off scanner — but it's a snapshot, not monitoring, and there are blocklists it doesn't include. Here's how to read the results, what to do per listing, and the gaps to fill.
MXToolbox is the most popular blacklist-checking tool on the internet — 600K+ monthly searches, ranking #1 for almost every "blacklist check" query. Free, no signup, results in 5 seconds against 100+ DNS blocklists.
For cold email, it's a useful first-pass scanner but has two limitations worth knowing about: it's a snapshot (not monitoring), and the list it checks is wider than necessary (includes lots of low-impact blocklists that pad the result without adding signal).
This guide is the cold-email-specific reading of MXToolbox's blacklist scanner: how to use it, which blacklists in their list actually matter for cold email, what to do when listed, and how ColdRelay's hourly monitoring fills the gap MXToolbox doesn't.
The 30-second answer
| Question | Answer |
|---|---|
| What is MXToolbox blacklist check? | Free DNS-blocklist scanner against 100+ DNSBLs |
| Is the free tool enough for cold email? | For a one-off check, yes. For ongoing monitoring, no. |
| Which blocklists actually matter? | Spamhaus SBL/XBL, Barracuda BRBL, SORBS, SpamCop. The other 95 lists in MXToolbox's roster mostly don't move inbox placement at major providers. |
| What if I'm listed? | Stop sending. Identify the cause. Submit delisting (per blocklist). Wait 24h–7d depending on which list. |
| How is ColdRelay's monitoring different? | Hourly checks against the 6 lists that actually matter, alert on listing, dedicated-IP-per-customer prevents shared-IP listings. |
Run MXToolbox's blacklist check or use ColdRelay's free blacklist checker which focuses on the 6 high-impact lists.
How MXToolbox's blacklist check works
You enter a domain or IP. MXToolbox queries 100+ public DNS blocklists in parallel (DNSBLs return a specific IP address if the queried IP is listed, NXDOMAIN if not). Results come back in 5-10 seconds with a per-list status indicator.
Each listing shows:
- The blocklist name
- The listed reason code (varies per blocklist)
- A link to the blocklist's delisting page
The scanner is good engineering — fast, free, comprehensive. The challenge isn't the tool; it's interpreting the result.
The 100+ blocklists isn't equally weighted
MXToolbox checks against a wide list of DNSBLs. Not all of them affect cold email deliverability equally. The blocklists that actually matter for cold email at major receivers:
| Blocklist | Impact | Notes |
|---|---|---|
| Spamhaus SBL | Catastrophic | Most providers (Gmail, Outlook, Yahoo) consult. Listed = rejected by major receivers. |
| Spamhaus XBL | Catastrophic | Same as SBL — major-provider rejection. Covers compromised hosts (malware, botnets). |
| Barracuda BRBL | Significant | Many enterprise Barracuda-protected receivers. |
| SORBS | Moderate | Some receivers consult; less consequential than Spamhaus. |
| SpamCop | Moderate | Cisco IronPort uses it. Auto-expires after 24h clean. |
| UCEPROTECT L1 | Mild | Some receivers consult; auto-expires after 7d clean. |
Lists in MXToolbox's roster that don't meaningfully affect cold email at major providers:
- Various regional / small-scale DNSBLs that few receivers consult
- Niche blocklists targeting specific spam patterns (e.g., bulk-mailer-specific, exit-node-specific)
- Lists that expire so quickly they're rarely actionable
- Lists where listing criteria don't match cold email patterns
A listing on a low-impact blocklist isn't urgent. A Spamhaus or Barracuda listing is.
How to read MXToolbox results for cold email
After running the scan:
All green (no listings): Setup is fine on the blocklist front. Move on to the other deliverability signals (Postmaster Tools Domain Reputation, bounce rate, real inbox placement).
1-2 minor listings (low-impact lists): Acknowledge but don't panic. Common for new IPs — some blocklists default-list dynamic IP ranges or fresh cloud-provider IPs. Usually auto-expires within days.
Listed on Spamhaus, Barracuda, or SORBS: Stop sending immediately on this IP. Investigate the cause (volume spike? list-quality drop? complaint surge?). Submit delisting per the specific blocklist's process.
Multiple major-list listings (Spamhaus + Barracuda + others): Your sending pattern is broadly being flagged as spam. Likely needs more than delisting — domain reputation needs to rebuild from a low baseline. Pause for 2-4 weeks; restart at 25% of normal volume.
What to do per listing type
Spamhaus SBL listing
- Visit spamhaus.org/lookup, enter your IP.
- The listing page shows the specific reason. Read it carefully.
- Fix the underlying issue. Spamhaus reviews manually — they want evidence the cause is addressed.
- Submit a delisting request with specifics (not "I cleaned my list" but "I removed 12,000 addresses from data source X after finding a 30% bounce rate").
- Wait 1-7 days. Spamhaus is the slowest to delist but the most consequential.
Barracuda BRBL listing
- Visit barracudacentral.org/rbl/removal-request.
- Submit the form with your IP and a brief explanation.
- Usually delisted within 24-48 hours automatically.
SORBS listing
- Visit sorbs.net, look up your IP.
- Check which specific SORBS list flagged you (DUHL = dynamic-IP range; SPAM = explicit spam source).
- DUHL is the easiest to clear — request reclassification as static; needs cooperation from your hosting provider.
- SPAM listings take longer; manual review by SORBS team.
SpamCop listing
Auto-expires after 24 hours of clean sending. Don't submit a removal request — just stop the offending pattern and wait.
UCEPROTECT L1/L2/L3
Auto-expires after 7 days of clean behavior at L1. L2 (the /24 subnet) and L3 (the ASN) are out of your control — you can be clean and still be on L2 because of a neighbor on the same /24. ColdRelay's dedicated IPs sit on subnets carefully managed for this; shared-IP cold email infrastructure providers often have customers stuck on L2 indefinitely.
What MXToolbox doesn't tell you
The tool has real gaps for ongoing cold email operations:
1. It's a snapshot. You ran it now. A listing that appears 2 hours later won't show until you re-run. For ongoing monitoring, manual re-running isn't viable.
2. It doesn't tell you why you got listed. The reason codes per blocklist are cryptic. You have to follow up on the blocklist's site to understand.
3. It doesn't alert. If your IP gets listed at 3am, you find out next time you happen to check. Hours of bad sending in between.
4. It doesn't fix anything. Confirms listing, then you have to do the fix work on each blocklist's site.
5. It doesn't distinguish high-impact from low-impact listings. A listing on a niche blocklist looks visually identical to a Spamhaus listing in MXToolbox's UI. The deliverability impact is dramatically different.
How ColdRelay's blocklist monitoring fills the gap
Three differences from MXToolbox's free scanner:
1. Continuous, not snapshot. Every ColdRelay-provisioned IP gets scanned every hour against the 6 blocklists that matter for cold email. New listings detected within an hour, not whenever you happen to check.
2. Email alert on listing. No need to remember to check. Listing happens → alert email goes out → you can pause sending immediately and start the delisting process.
3. Dedicated IPs prevent shared-pool listings. The biggest source of cold email blocklistings on shared-IP infrastructure is neighbor contamination — someone else on your IP block does damage, you wear the listing. Dedicated-per-customer IPs eliminate this entirely.
For the one-off scan, ColdRelay's free blacklist checker is faster than MXToolbox's full-roster scan (we focus on the 6 high-impact lists, no padding with niche blocklists). For ongoing monitoring, it's folded into the base infrastructure subscription.
A cold email blocklist monitoring routine
If you're not on dedicated infrastructure with continuous monitoring:
Weekly: run MXToolbox's blacklist check or ColdRelay's blacklist checker on each of your sending IPs. Five minutes total.
Monitor leading indicators daily:
- Postmaster Tools Domain Reputation per domain
- Bounce rate per workspace (above 1.5% = investigate)
- Sudden reply-rate drops on a campaign (could indicate infrastructure-side reputation slip)
On any sudden inbox-placement drop: run a blocklist scan immediately. Blocklist listings are one of the fastest ways to lose deliverability; catching them within an hour vs a day matters.
For dedicated-infrastructure setups (ColdRelay-style), the hourly automated monitoring replaces this. The manual weekly run becomes a secondary safety net. (Full IP blacklist guide → · How to read Postmaster Tools →)
FAQ
Is MXToolbox's blacklist check accurate?
Yes — the underlying DNS queries are deterministic. If MXToolbox shows your IP on Spamhaus SBL, the IP is on Spamhaus SBL. The accuracy question isn't whether the listing exists; it's whether the listing matters.
Why does MXToolbox show me listed on 3 lists I've never heard of?
Some DNSBLs are aggressive about listing fresh IPs, dynamic-IP ranges, or specific cloud-provider subnets. Most of these niche listings don't affect inbox placement at major receivers. Check if the lists are Spamhaus, Barracuda, SORBS, or SpamCop — if not, the impact is mild.
Can I get off a blocklist faster by using MXToolbox's "request removal" links?
The links route to each blocklist's own removal form. Speed depends entirely on the blocklist:
- Barracuda: 24-48 hours automated
- SpamCop: auto-expires in 24 hours
- UCEPROTECT: auto-expires in 7 days
- Spamhaus: 1-7 days manual review
- SORBS: weeks, sometimes
MXToolbox doesn't speed up any of these — it just gives you the link.
Should I run MXToolbox on my domain or my sending IP?
Both, ideally. The IP scan catches DNSBL listings (the most consequential for cold email). The domain scan catches URIBL/SURBL listings (which affect URLs in your message body, not the sending IP itself).
MXToolbox shows 95/100 lists clean — is the 5 I'm on a problem?
Depends which 5. If any are Spamhaus, Barracuda, SORBS, or SpamCop — yes, problem. If they're all niche / regional / specialty lists — usually not actionable for cold email at major-provider receivers.
Why isn't ColdRelay-monitored coverage 100+ blocklists like MXToolbox?
Signal-to-noise. Monitoring 100+ blocklists creates alert fatigue from listings that don't affect inbox placement. ColdRelay's 6-list focus (Spamhaus SBL, Spamhaus XBL, Barracuda BRBL, SORBS, SpamCop, UCEPROTECT L1) covers >95% of the inbox-placement impact with much less noise. Customers who need the long-tail scan can run MXToolbox on top.
Does being listed on MXToolbox's check affect MXToolbox's own opinion of me?
No — MXToolbox is a tool, not a blocklist. They aggregate other blocklists' data. Being listed in MXToolbox's results means you're listed by the underlying blocklist, not by MXToolbox itself.
MXToolbox's blacklist check is the right tool for a one-off scan. For cold email at scale, you need continuous monitoring focused on the blocklists that actually move inbox placement.
Run the free 6-list scan in 5 seconds → /tools/blacklist-checker · Cold email infrastructure with hourly blocklist monitoring + dedicated IPs → Try ColdRelay free