Reputation — IP & domain blacklist checks
The reputation check looks up a domain's web and mail IPs against a small set of vetted DNS blacklists (DNSBLs). A single listing is a warning — blacklists throw false positives — while a listing on two or more corroborating lists is a fail. The result names which IP is on which list so you can go request delisting.
The single check in this category — “IP / domain reputation (blacklist)” — gathers the IP addresses that matter for a domain's reputation: the apex A-record IPs plus the IPs of its top-three-priority MX hosts. It uses IPv4 only, dedupes them, and caps the set at six addresses.
Those IPs are looked up against three deliberately-chosen DNSBL zones: bl.0spam.org, psbl.surriel.com, and dnsbl-1.uceprotect.net. That last one is the Level-1 list only — UCEPROTECT's higher levels list entire cloud provider ASNs, which would false-positive constantly, so they're excluded. The blacklist set is curated and not user-configurable, on purpose, so the signal stays trustworthy.
The grading is built around corroboration. It passes when none of the IPs are listed anywhere. It warns when an IP is listed on exactly one of the three zones — one list on its own is often a false positive. It fails when an IP is listed on two or more zones, where independent lists corroborate a real reputation problem. If the domain has no resolvable IPv4 addresses the check is not-applicable, and if every lookup fails it's an error.
One list is a warning; two or more is a fail. DNSBLs disagree and produce false positives, so a single listing isn't treated as conclusive — it takes corroboration from independent lists before Domain Watchdog calls it a real problem.
The result names exactly which IP is listed on which blacklist. Use that to go to the listing provider's site and request delisting for that specific address — you don't have to guess which IP or which list is the problem.
The check is IPv4-only. If a domain resolves only to IPv6 addresses, there are no addresses to look up and the check is marked not-applicable rather than passed or failed.
Frequently asked questions
Which IPs and blacklists does this check use?
It gathers the apex A-record IPs plus the IPs of the top-three-priority MX hosts (IPv4 only, deduped, capped at six), and looks them up against three vetted DNSBL zones: bl.0spam.org, psbl.surriel.com, and dnsbl-1.uceprotect.net (Level-1 only). The list set is curated and not user-configurable.
Why is one listing only a warning?
DNS blacklists disagree and throw false positives, so a single listing isn't treated as conclusive — it's a warning. A listing on two or more independent zones corroborates a real reputation problem and fails. No listings passes.
How do I get delisted?
The check detail names which IP is on which blacklist. Take that specific IP to that specific list's provider and follow their delisting process — Domain Watchdog surfaces the exact listing so you don't have to hunt for it.
Why did my domain show not-applicable for reputation?
The check is IPv4-only. If the domain resolves only to IPv6, there are no addresses to look up, so the check is marked not-applicable rather than pass or fail. If every lookup fails for other reasons, it's recorded as an error.