A DNS blacklist check answers one narrow question: does this address appear on a zone that mail servers consult? A DNS blacklist check reads a list of addresses that someone considers a source of abuse. Mail servers query these lists before accepting a message. A positive result is a signal, not a verdict. Shared hosting, forwarded mail and a compromised account can put a legitimate address on a list.
The DNS blacklist check queries a fixed set of zones and returns the zones where the address appears.
curl "https://api2.globus.studio/v2/dnsbl?ip=8.8.8.8&format=json"How a DNS blacklist check works
Each zone is queried by reversing the address and adding the zone name. A response means the address is listed. No response means it is not. The endpoint asks DNS directly, so the address is not sent to a third-party HTTP service.
A DNS blacklist check uses a fixed query set. A clean result means the address is not on those zones at that moment. It does not mean the address has never sent spam.
Reading the result
The JSON body has a listed flag and an array of zone names. Some zones publish a reason in their return code. The endpoint reports the zone, which is enough to decide what to do next.
A DNS blacklist check result is a signal, so do not reject mail on a single listing from a weak or abandoned list. Check which zone returned the hit, how recent the listing is and whether the same address appears elsewhere.
Why an address gets listed
A shared server can inherit the reputation of a neighbour. A contact form can be abused to send mail through your domain. A mailbox password can leak and a spammer can send from the account. In each case the address is yours and the listing is real from the receiver’s point of view.
Fix the cause before requesting removal. Remove the open relay, change the password, add authentication and rate limits. Then follow the zone’s removal process.
Use it in a pipeline
A signup form can check the address before it creates an account. A mail gateway can check the sending address and add a header instead of rejecting. A monitoring job can check your own ranges every hour and alert on a new listing.
$result = json_decode(file_get_contents(
'https://api2.globus.studio/v2/dnsbl?ip=' . urlencode($ip) . '&format=json'
), true);
if (!empty($result['listed'])) {
error_log('DNSBL hit for ' . $ip . ': ' . implode(',', $result['zones']));
}Limits
A DNS blacklist check waits for DNS answers from many zones, so it is slower than the other endpoints. It is also rate limited. Do not run it on every page view. Cache the result for an hour or run it in a background job.
Read the endpoint documentation for the zone list, response shape and limits.
Return codes and reasons
Some zones return a code that explains the listing. A code for a dial-up range is different from a code for a compromised server. If the response includes a reason, store it with the zone name. It helps the person who has to fix the cause.
Watch your own ranges
Run the check on your outbound mail addresses on a schedule. A new listing is easier to fix before a customer complains. Keep the history so you can see whether a listing repeats after removal. A repeated listing usually means the cause was not fixed.
Use the documentation for the zone list and the response fields.
A note on public lists
Some lists are free for low volume and require a subscription for heavier use. The endpoint queries a fixed set, so you do not need an account with each zone. If you need a specific commercial list, check its terms and query it directly.
Related reading
A DNS blacklist check covers the address; for the domain behind it, use the WHOIS lookup. For login abuse, pair the check with IP bot detection.
Further reading: RFC 5782, DNS Blacklist.