How a DNSBL works
The receiving mail server reverses the sender IP's octets and queries the list's DNS zone: for 203.0.113.10 that is 10.113.0.203.zen.spamhaus.org. An answer of 127.0.0.x means the address is listed and the last octet tells why. NXDOMAIN means it is not listed. We run the same queries mail servers do and also read the TXT record with the explanation.
What to do if you are listed
A listing in Spamhaus SBL/XBL, SpamCop or Barracuda almost always means real spam from your address. Check the mail queue (postqueue -p, exim -bp), SMTP auth logs, website forms and outbound port 25 traffic from other hosts on the network. Request removal only after the spam has stopped, or the address will be relisted quickly.
FAQ
Why is Spamhaus shown as “not tested”?
Spamhaus, SURBL and URIBL do not serve queries via large public resolvers and answer 127.255.255.254 (or 127.0.0.1). That is a refusal, not a listing. We never report it as listed; check the address on the Spamhaus website via the link.
Is a Spamhaus PBL listing a problem?
PBL lists dynamic and end-user ranges that should not send mail directly. A mail server on a static IP with PTR can remove itself from PBL; a home or office address should send mail through the provider's relay instead.
How do I get an IP off a blocklist?
Fix the cause first: an open relay, a compromised mailbox, spam from a website form or an infected machine behind NAT. Then submit a request via the Remove link. Some lists (SpamCop, UCEPROTECT) drop the address automatically a day to a week after the spam stops.
Which IP should I check for a domain?
Deliverability depends on the IP your server sends mail from — see the Received header or the bounce text. If you enter a domain, the name itself is checked on domain lists (DBL, SURBL, URIBL) and its A/AAAA addresses on IP lists.