My site is on a DNS blocklist. What does Oh Dear do, and what should I do?
The DNS blocklist check tells you if your domain or the IP addresses it resolves to appear on well-known security / spam blocklists (Spamhaus, SORBS, Quad9, and others). Being listed doesn't necessarily mean your site is malicious. False positives happen, and listings are often caused by issues beyond your control (shared hosting neighbours, previously-assigned IPs, etc.).
What the Oh Dear DNS blocklist check does
We detect listings and alert you when they appear or disappear. We do not:
- Delist you from the blocklist
- Contact the blocklist operator on your behalf
- Remove the listing automatically
Each blocklist operator has their own delisting process, and they only accept requests from the affected party (not us).
What to do when you're listed
- Open the DNS blocklist report in Oh Dear to see exactly which blocklist is flagging you, and which domain or IP was listed.
- Visit the blocklist operator's website (the report links to it directly). They typically have a "check listing" or "delisting request" form.
- Fill out the delisting form. Most operators ask you to confirm the underlying problem has been fixed before they'll remove you. Common reasons for being listed:
- Compromised server sending spam without your knowledge
- Shared hosting where a neighbouring customer is misbehaving (common on cheap shared hosts)
- Recycled IP that was assigned to someone bad before you got it
- Outdated mail configuration (missing SPF, DKIM, DMARC) that looks like forgery
- Wait for the listing to clear. Most operators lift listings within hours to days of a valid delisting request.
Oh Dear's alert will fire again when we see the listing has been removed.
Common false positives
A few patterns come up regularly:
- Cloudflare origin vs proxy IPs: if your site is behind Cloudflare, we check the origin IP, not the Cloudflare edge. Your real origin is what matters for deliverability and reputation. See the DNS blocklist check settings to clarify which IP you want monitored.
- Missing A record: if a domain has no A record at all, some blocklists mark it as "unroutable" which shows up as a listing. Ensure your DNS is correct before delisting.
- Quad9 "suspicious domain" category: Quad9 is a DNS resolver that protects its users. Domains listed there are sometimes false positives based on heuristics, not on confirmed malicious behaviour. Quad9 has a straightforward delisting form.
When to get help from us
If you're seeing a listing that shouldn't exist and the blocklist operator is unresponsive, contact support. We can't delist you, but we can help you interpret the report and figure out what specifically triggered the listing.
