Blacklist monitoring

Blacklists are public lists of domains and servers flagged for spam or bad behaviour. Land on one and your emails start dropping into spam folders while some security tools steer visitors away from your site, often without you realising why. TLDTrack checks your domain and its web server's IP address against 12 major lists every 12 hours and tells you when you appear on one.

What a blacklist is

A blacklist is a shared record of domains and IP addresses, the numeric addresses of the servers behind your site and email, that have been reported for spam or malicious activity. Email providers and security products check these lists constantly to decide whose messages to trust and whose to block, and whose sites to warn visitors about.

If your domain or its mail server appears on one, the effects are immediate and frustrating: your legitimate emails get filed as spam, and visitors may see a warning before they even reach you. Because these lists are consulted automatically by other people's systems, you have no way of knowing you are on one unless something, or someone, checks.

How the check works

On a regular cycle, roughly every 12 hours, TLDTrack checks your domain and its associated IP address against a set of major blacklists. If you appear on one, you get an alert naming the problem so you can act while the damage is still small.

• We check both the domain and the IPv4 address your website resolves to, because a listing can attach to either. Your mail server's address is not checked.
• You are alerted as soon as a listing is detected, and told which list you are on.
• Fast notice means you can start the removal request quickly, before too many emails are lost.
• When a listing clears, the status returns to clean, so you can confirm a delisting actually went through.

What you need before you start

• A domain added to TLDTrack. See Add your first website if you have not yet.
• The Blacklist check switched on for that site. It is a per-site toggle, so you decide which domains are watched.
• An owner or admin to receive it. Blacklist emails go to the account owner and admin users, not to notification contacts. A new listing also goes to the mobile app as a push notification and to any connected alert channel. See alerts and notifications.

What you will see, and what to do

On a site's Monitoring tab the blacklist check shows a clean status when all is well, and names any list you have landed on when it is not. If a listing appears:

• Find out why. A listing usually means something is sending spam or the site has been compromised. Look for the cause before you ask to be removed, or you will simply be relisted. Running malware monitoring helps you find a hidden compromise.
• Request removal. Each blacklist has its own delisting process. Once you have fixed the cause, follow the named list's steps to be taken off, then watch for the status to return to clean.
• If it is your shared host's fault, raise it with your hosting provider, since a neighbour on the same server can get the whole IP listed and only they can move you or clean it up.

How to switch it on, step by step

1. 1
   Open the website from your Domains list.
2. 2
   Go to the Monitoring tab and switch on the Blacklist check.
3. 3
   Blacklist emails go to the account owner and admins. To reach anyone else, connect a Slack, Teams or webhook alert channel.
4. 4
   That is it. The check runs on its regular cycle from then on, and you only hear from it if a listing appears.

A blacklisting often points to a deeper problem, so it pairs naturally with malware monitoring, which watches for the kind of compromise that gets a domain listed in the first place. To control where these warnings reach you, see alerts and notifications.

Where to set this up

Good to know

• The check covers both your domain and its server IP, since a listing can attach to either.
• Alerts name the specific list you are on, so you know where to go to be removed.
• A listing is often caused by something else (a hacked account or a shared-host neighbour), so pair this with malware monitoring.
• Once a delisting goes through, the status returns to clean on the next check.