Skip to content
Log In
Oh Dear

The client found the listing

DNS blocklist monitoring.

The client, or their customer, found the listing first. Mail in a junk folder, or an office network that cannot open the site. This is a listing check of the domain and the IP it resolves to. It is not DNS record monitoring.

Start monitoring See how it works

10-day free trial · No credit card required · Every feature included

Capterra
4.9 (73) G2
4.7 (33)
Daily by default As often as every 4 hours
  • Bitmovin
  • HBO Nordic
  • Obsidian
  • Laravel
  • Fathom Analytics
  • PHP 8
  • Stanford University
  • Takeaway.com
  • IGN
  • VRT NWS
  • spatie

The agency roster

The client found the listing. You did not.

You manage a lot of client sites. You did not pick the host for most of them, and you did not pick the IP. You still get the call.

Mail from a client domain lands in spam. A password reset never shows up. An invoice thread goes quiet, then the client forwards a screenshot from their customer's junk folder. Someone on an office network running a filtering resolver cannot open the site at all. The homepage looks fine from your laptop. Their network does not.

That is a listing, not an outage. A blocklist, an RBL, a DNSBL, or a content-filter DNS resolver has the domain or the sending IP. Oh Dear looks for that listing on a schedule and tells you which list, which domain or IP, and whether the listing appeared or disappeared.

You still own the delisting conversation with the operator. You just stop finding out from the person who pays you.

Casey Sprague
Oh Dear detected an issue that our other uptime monitor did not!

Casey Sprague, CTO at thera-LINK

Uptime stayed green. A listing is a different question.

A different question

What this check sees, and what it does not.

A homepage can return 200 while the sending IP sits on Barracuda. MX can be correct while SpamCop has the IP. Records can be unchanged while a filtering resolver blocks the name.

What it checks

  • Whether the domain appears on SURBL or URLhaus.
  • Whether the IP it resolves to appears on Barracuda or SpamCop.
  • Whether AdGuard DNS, AdGuard Family, CleanBrowsing Security, Cloudflare Family, OpenDNS, OpenDNS Family or Quad9 blocks the name.
  • Whether a listing appeared or disappeared since the previous run, on either kind of list.

What it does not

This is not a synthetic checkout and it does not score deliverability. It answers one question: is this domain or IP listed?

Operational ownership

Send the listing to the person who owns the fix.

A listing on client A's sending IP is not the same person's problem as a filtered name on client B. Oh Dear sends each site's alerts to the channels that team already uses, configured per site.

Acknowledge and snooze work per check rather than per site, so you can mute this one while you wait on an operator without muting everything else that site monitors.

Slack
Email
Webhook
Explore notifications and routing

Agency first

Who needs this check most.

The buyer is whoever is responsible for client mail and client domains, which is usually not the person who chose the host.

Agencies with unrelated client domains.

You did not choose the shared host, the recycled IP, or the missing SPF, DKIM and DMARC records. You still get the mail when a reset lands in spam, or when an office network cannot load the site.

This is how you see the listing before the client forwards it to you. More at Oh Dear for web agencies.

SaaS teams sending transactional mail.

Password resets, invoices and signup confirmations can stop arriving while the site still answers every request. This check watches the domain and the IP you actually send from, including an origin IP you set yourself when a CDN sits in front.

It is a monitor on the sites you already run, not a page for looking up block lists.

No feature tiers

Every check.
Every plan.

DNS blocklist monitoring is included on every plan. You are not stacking a second blocklist vendor on top of your monitoring, and you pay for the number of sites rather than per check.

Start with everything on.

Uptime, DNS records, certificates, domain expiry, scheduled tasks, broken pages, application health and blocklist listings share one bill.

  • DNS blocklist monitoring included
  • Every feature on every plan
  • Pay for the number of sites
  • No second blocklist vendor
Start a free trial

10-day free trial. No credit card.

For the technically curious

How the listing check actually works.

Oh Dear checks the domain and the IP it resolves to, unless you have set an origin IP for the site.

Security blocklists

Four spam and malware lists.

  • Barracuda Queried with the IP
  • SpamCop Queried with the IP
  • SURBL Queried with the domain
  • URLhaus Queried with the domain

Content-filter DNS

Seven filtering resolvers.

  • AdGuard DNS
  • AdGuard Family
  • CleanBrowsing Security
  • Cloudflare Family
  • OpenDNS
  • OpenDNS Family
  • Quad9
  • The lists. Eleven lists in total, each one switchable per site. Turn off the ones that do not match the client and leave the rest running.
  • Security-list results. Each security check is a DNS lookup against that list. The IP-based lists use a reverse-IP query; the domain-based lists query with the domain. An answer means listed. SURBL encodes a reason in the code it returns, which Oh Dear decodes; the others report the listing itself.
  • Content-filter results. Oh Dear resolves the domain through each service. Most of them answer with a known block-page address, so that address is the signal. Quad9 and CleanBrowsing Security answer with nothing instead, so an empty answer counts as blocked only after Oh Dear confirms the domain resolves publicly.
  • Cadence. Once a day by default, and settable as often as every 4 hours per site. A listing surfaces on the next scheduled run rather than the moment an operator publishes it.
  • CDN and WAF. Set the origin IP under the monitor's general settings, in server details, so the IP-based lists are queried with your address instead of the CDN's. The content-filter resolvers always query the domain, so they are unaffected.
  • Detection, not removal. Oh Dear detects listings and alerts when they appear or disappear. It does not delist, does not contact the operator, and does not remove anything. The report names the list and the domain or IP.
  • Operator process. Barracuda, SpamCop, SURBL, URLhaus, Quad9, Cloudflare Family, OpenDNS, AdGuard and CleanBrowsing each run their own delisting path, and each only accepts a request from the affected party.
  • Fix DNS first. A missing A record can read as a listing on some lists, because an unroutable name looks the same as a blocked one. Repair DNS before you file for delisting.

Want all the technical details?

DNS blocklist monitoring My site is on a blocklist Snoozing a single check

Before the first check

Questions about DNS blocklist monitoring.

What Oh Dear looks for, how the lists are queried, and where the listing check ends.

What is DNS blocklist monitoring?

DNS blocklist monitoring is a listing check of a domain, or the IP it resolves to, on security and spam blocklists (RBLs and DNSBLs) and on content-filtering DNS services. Oh Dear reports which list and which domain or IP, and alerts you when a listing appears or disappears.

Is this the same as DNS record monitoring?

No. DNS record monitoring watches A, AAAA, MX, TXT, CNAME, NS and SOA for change. DNS blocklist monitoring asks a different question: is the domain or IP listed anywhere?

What is a DNS blocklist, RBL or DNSBL?

A DNS blocklist, also called an RBL or DNSBL, is a published list of domains or IPs that operators treat as spam sources, malware hosts, or otherwise unsafe. Content-filter DNS is related: a resolver returns NXDOMAIN or a block-page IP for names it will not serve. This check covers both kinds of listing.

Does Oh Dear check if my domain is on a blacklist?

Yes. It checks whether the domain, or the IP it resolves to, appears on the security blocklists you have enabled, and whether the content-filter DNS services you have enabled block the name.

Which blocklists does Oh Dear check?

Four security blocklists: Barracuda and SpamCop, which are queried with the IP, and SURBL and URLhaus, which are queried with the domain. Seven content-filter DNS services: AdGuard DNS, AdGuard Family, CleanBrowsing Security, Cloudflare Family, OpenDNS, OpenDNS Family and Quad9. Each one can be switched off per site.

How often does Oh Dear check DNS blocklists?

Once a day by default, and you can set it as often as every 4 hours per site. This is not an every-minute check: you hear about a listing after the next scheduled run. See how often checks are performed.

Will I know the moment I get listed?

No, and it would be misleading to claim otherwise. Blocklist operators publish on their own schedule, and Oh Dear reports after the next scheduled run of this check.

Does Oh Dear delist me?

No. Oh Dear detects listings and alerts when they appear or disappear. It does not delist, does not contact the operator, and does not remove the listing. Operators only accept requests from the affected party, so delisting stays with you.

What should I do if my site is on a DNS blocklist?

Read the report, confirm which list holds which domain or IP, then follow that operator's process. Fix a missing A record before you file, because some lists treat an unroutable name as listed. Start with my site is on a DNS blocklist.

How is this different from website uptime monitoring?

Website uptime monitoring is an HTTP(S) reachability check of a public URL, every minute. DNS blocklist monitoring never fetches that URL. A site can return 200 and still be on Barracuda, or blocked by Quad9 on some networks.

What if the site is behind Cloudflare or another CDN?

Set the origin IP in the monitor's general settings, under server details, so the check uses that IP rather than the CDN's. Otherwise the resolved IPs belong to the CDN and a listing on your own IP goes unseen.

Can agencies monitor client domains for blocklist listings?

Yes. Add each client domain, set an origin IP where a CDN sits in front, and route listed and delisted alerts to the people who can talk to the operator. Start at Oh Dear for web agencies.

Is DNS blocklist monitoring included in every plan?

Yes. Every feature is on every plan. You pay for the number of sites you monitor, not per check, so this is not an add-on blocklist product on top of your monitoring bill.

See all other FAQ items
Technical detail Read the DNS blocklist documentation A different check DNS record monitoring

Get started

Start monitoring the listings you're already responsible for.

A listing on a client domain will not wait for your next audit. Add a site in under a minute. Every feature on. No credit card.

Capterra
4.9 (73) G2
4.7 (33)
Start monitoring