IP Blocklisted
An IP address associated with your DNS records appears on one or more IP reputation blocklists.
Severity: High
What does this mean?
One of the IP addresses your DNS records resolve to has been found on one or more IP reputation blocklists. These blocklists are maintained by security organisations and track IP addresses associated with malicious activity such as spam, malware distribution, phishing, or botnet command-and-control.
DNS Watchdog checks every public IP address in your inventory against an aggregated blocklist during the daily scan. When an IP is found on any list, this issue is raised with the specific blocklist providers that flagged it, and the IP's row and detail view on the IP Addresses page show the same listing.
Blocklist providers checked
DNS Watchdog aggregates data from the following upstream blocklist providers:
| Provider | Description |
|---|---|
| Spamhaus DROP | The Don't Route Or Peer list — IP ranges hijacked or leased by spammers and cyber criminals |
| IPsum | An aggregated threat-intelligence feed compiled from many public blocklists; DNS Watchdog counts an IP only when it appears on several of them |
| FireHOL Level 1 | A conservative, low-false-positive list of IP ranges that should never be a source of legitimate traffic |
The aggregated blocklist is refreshed from these providers every 6 hours. Each public IP in your inventory is checked against the combined dataset during the daily scan.
Private, loopback, link-local, carrier-grade NAT, documentation, reserved and multicast addresses never raise this issue. FireHOL Level 1 lists those ranges so that firewalls drop spoofed traffic, not because of anything a host there has done, and an internal address in your DNS is not reachable from the internet.
Why this is a problem
A blocklisted IP can cause:
- Email delivery failures — mail servers reject messages from blocklisted IPs
- Reputation damage — your domain may be associated with malicious activity
- Service disruption — some firewalls and security tools block traffic from blocklisted IPs
- SEO impact — search engines may penalise sites hosted on blocklisted IPs
If the IP is blocklisted because of activity on your infrastructure, it may indicate a compromise that needs investigation.
What you should do
- Check the blocklist providers listed in the issue details to understand why the IP was flagged
- Determine if the IP is shared — if you're on shared hosting, another tenant's activity may have caused the listing
- Investigate your infrastructure — if the IP is dedicated to you, check for signs of compromise (unexpected outbound traffic, open relays, malware)
- Request delisting — most blocklist providers have a delisting process once the underlying issue is resolved
- Consider migrating — if the IP is on shared infrastructure you don't control, moving to a clean IP may be faster than waiting for delisting
Automatic resolution
This issue resolves automatically when the IP is no longer found on any blocklist during a subsequent scan. The blocklist data is refreshed every 6 hours and your IPs are re-checked during the daily scan, so resolution typically appears within a day of the IP being delisted.
Ignoring this issue
If you've determined the blocklisting is a false positive or doesn't affect your use case, you can mark the issue as Ignored with a reason. Ignored issues are preserved across scans and won't generate new notifications. The IP Addresses page keeps showing the listing, marked as ignored, because the IP is still on the blocklist.