Domain Blacklist Check
Example Data Table
| Domain | Typical Output | Why It Flags |
|---|---|---|
| example.com | Clean (low risk) | Valid DNS, no list match, few heuristic signals. |
| phish.payments.zip | Warning (medium risk) | High-risk TLD, suspicious structure, possible no MX. |
| bad-domain.test | Blacklisted (high risk) | Matches your custom list entry exactly. |
| xn--pple-43d.com | Warning (medium risk) | Punycode label suggests look‑alike potential. |
Tip: Replace the sample domains with your own, then export the report.
Formula Used
Each domain is evaluated with three signal groups: Custom List, DNSBL, and Heuristics. Scores are merged into a single risk score from 0 to 100.
DNSBLScore = 100 × (DNSBLHits ÷ SelectedDNSBLs)
HeuristicScore = min(100, sum of heuristic points)
RiskScore = wList×ListMatchScore + wDNSBL×DNSBLScore + wHeur×HeuristicScore
Decision rule: Blacklisted if list matches or any DNSBL hit exists; otherwise Warning if RiskScore ≥ 50; else Clean.
How to Use This Calculator
- Paste domains in the Domains box, one per line.
- Add your custom blacklist entries using exact or wildcard formats.
- Optionally enable DNSBL and select providers for IP reputation checks.
- Adjust weights and heuristic thresholds to match your policy.
- Click Check Domains to view the results above.
- Download CSV or PDF to share with your security team.
FAQs
1) What is a domain blacklist check?
It compares a domain to known-bad entries and reputation signals. If matches appear, you can block access, quarantine emails, or require extra verification.
2) Why do DNSBL checks use an IP address?
Most DNS-based blocklists track sending infrastructure, not website names. The tool resolves the domain to an IPv4 address, reverses it, then queries selected DNSBL zones.
3) Can a clean result still be risky?
Yes. New malicious domains may not be listed yet. Use this tool alongside URL scanning, content inspection, authentication checks, and user training.
4) What wildcard formats are supported?
You can use exact domains, *.suffix for suffix matches, or patterns with * and ?. Example: phish.* matches many TLDs.
5) Why does “No MX record” add risk?
Many phishing domains are not configured for email, so missing MX can be a weak signal. It’s not proof; some legitimate domains also lack MX records.
6) What do the weights change?
Weights control how strongly each signal group influences RiskScore. If your organization trusts DNSBL highly, increase its weight, or prioritize your internal list by raising list weight.
7) Why might DNSBL results be inconsistent?
DNSBL providers can rate-limit, vary in policy, or require credentials. Also, domains can rotate IPs. Use multiple providers and treat hits as indicators.
8) How should I act on “Warning” vs “Blacklisted”?
Blacklisted usually means block or quarantine immediately. Warning means apply friction: extra verification, sandboxing, or manual review before allowing access.