Blacklist and DNSBL monitoring
Ken checks every sending domain against major spam blocklists every six hours and surfaces the result as a live chip on each domain row - so you can see a blacklist problem before it kills your inbox rate.
Overview
Blacklist monitoring is built into the Email Delivery section of Ken. Every domain you send from displays a "BL" (blacklist) chip directly in the Domains table, next to the SPF, DKIM, DMARC, and NS health chips. The chip tells you at a glance whether the domain is clean, listed on a blocklist, pending delisting, or has not yet been checked.
Where to find it:
- Open the sidebar and click Email Delivery (or navigate to
/delivery). - Select the Domains tab.
- Look at the DNS column for each row. The BL chip appears alongside the SPF / DKIM / DMARC / NS chips.
Ken also monitors the sending IP pool. That view is on the IP & SMTP tab and is visible to internal team members only.
Before you start
You must have an active workspace and at least one sending domain added to your account. The Domains tab shows a workspace-selection prompt if no workspace is active.
How to check your domain's blacklist status
Read the BL chip
Each domain row in the Domains table contains a row of DNS health chips. The BL chip uses the following labels and colors:
| Label | Color | Meaning | |---|---|---| | Clean | Green (active) | The domain is not on any monitored blocklist. | | Listed | Red (danger) | The domain is listed on one or more blocklists. | | Delisted | Orange (warning) | The domain was listed and has been removed, but monitoring continues. | | Pending delisting | Orange (warning) | A delisting request is in progress. | | (grey, no label) | Grey (neutral) | The domain has not been checked yet. This is normal for a brand-new domain before its first sweep. |
Open the blacklist detail popover
Click the BL chip on any domain row to open a detail popover. The popover shows:
- The current overall status (Clean / Listed / Delisted / Pending delisting).
- How many blocklists the domain is listed on (listed count).
- The specific blocklist names the domain appears on (when listed).
- When the domain was last checked.
The detail only loads when you click - Ken fetches it on demand rather than loading it for every row.
How it works
Ken runs a recurring background job that sweeps every sending domain against six major DNS-based blocklist zones - Spamhaus, Barracuda, SpamCop, SORBS, CBL, and PSBL - every six hours. Results are written to a structured record keyed by domain, with an overall status, a listed count, the specific blocklist names, and a timestamp.
When you open the Domains tab, Ken loads blacklist summary data (status, count, last-checked time) for all your domains in a single request - one call covers the entire table with no per-row fetch. The full list of offending blocklists loads separately and only when you click a chip, so the table stays fast regardless of how many domains you have.
The BL chip uses the same four-state model that the internal IP monitoring tab uses (Clean, Listed, Delisted, Pending delisting), so the status shown to you matches exactly what Ken's own team sees internally.
How a DNSBL lookup works: Blocklists are queried via DNS. For a domain, Ken constructs a lookup like yourdomain.com.dbl.spamhaus.org and checks whether it resolves. If the query returns no result (DNS NXDOMAIN), the domain is clean on that list. If it resolves, the domain is listed. Ken treats any response other than NXDOMAIN - including DNS errors, timeouts, and SERVFAIL - as a genuine check failure, not a "clean" result. This means Ken never falsely reports a domain as clean when the blocklist itself was unreachable.
IP monitoring (internal): The IP & SMTP tab extends this to every sending IP address in Ken's pool, checked every four hours against approximately 44 IP blocklist zones. IP checks also validate reverse DNS (PTR) - Ken confirms that the PTR record for each IP resolves back to the same IP, which is what strict mail receivers require.
Severity ranking for IPs: When an IP is listed, Ken classifies severity internally: Spamhaus ZEN / SBL-XBL is critical, Barracuda / SpamCop is high, two or more lists is medium, a single minor list is low. This drives internal alerting and remediation priority.
Check cadence:
- Domain sweep: every six hours.
- IP sweep: every four hours.
Troubleshooting and debugging
Symptom: BL chip shows "Listed" on one of my domains.
- Likely cause: The domain is on one or more blocklists, most often from a spam complaint, a shared-infrastructure listing, or a sending-volume spike.
- What to check: Click the BL chip to see which blocklists flagged the domain and when.
- How to fix: Follow each blocklist's delisting process directly (most have a self-service removal form). Once delisted, Ken will reflect the updated status within six hours on the next sweep. The chip will show "Delisted" first, then "Clean" after confirmed removal.
- Gotcha: Delisting is not instant. Some blocklists take 24-48 hours to propagate. The chip will remain "Listed" or "Pending delisting" until the next successful sweep confirms removal.
Symptom: BL chip is grey with no label - "not checked".
- Likely cause: The domain was added recently and has not yet gone through a sweep cycle.
- What to check: Wait up to six hours. If the chip is still grey after 24 hours, contact support - the monitoring job may not be running for your workspace.
- Important: Grey is genuinely "not yet checked," not "clean." Do not treat a grey chip as a clean bill of health.
Symptom: BL chip disappeared or stopped updating.
- Likely cause: The background monitoring job is not running or is not writing fresh rows. This is an infrastructure issue, not a domain issue.
- What to check: Look at the "last checked" timestamp in the detail popover. If it is more than 12 hours old, the job has likely stalled.
- How to fix: Contact Ken support. Include the domain name and the last-checked timestamp from the popover.
Symptom: Domain shows "Clean" but deliverability is still poor.
- Likely cause: The six monitored blocklists are not exhaustive. A domain can be clean on all six and still have reputation problems with specific inbox providers (Gmail, Outlook, etc.) that do not use standard DNSBLs.
- What to check: Review the Analytics tab for open-rate and bounce-rate trends. Check sending volume and complaint history. Gmail reputation signals, if available, appear in the deliverability summary.
- Gotcha: Blacklist status is one signal, not the whole picture. A green BL chip does not mean all inbox providers will accept your mail.
Symptom: IP & SMTP tab shows "Not checked" for sending IPs.
- Likely cause: The pool IP was recently added or the IP sweep has not yet enumerated it.
- What to check: "Not checked" is the honest state for an IP before its first sweep. If the status persists beyond 8 hours, the sweep may not be covering that IP.
- How to fix: Contact Ken support with the IP address and the timestamp. This is an ops-level issue.
Symptom: IP shows "Listed" with a PTR warning.
- Likely cause: The IP's reverse DNS record (PTR) either does not exist or does not resolve back to the same IP - a configuration that many strict mail receivers reject outright, separate from blocklist standing.
- What to check: The PTR status appears in the IP detail panel. "PTR valid" means the forward-confirmed reverse DNS check passed. Any other state is a misconfiguration.
- How to fix: Contact Ken support. PTR records are configured at the hosting or IP-provider level, not in Ken.
FAQ
How often are domains checked?
Every six hours. Sending IPs are checked every four hours. The last-checked timestamp is visible in the detail popover.
What blocklists does Ken check?
For domains: Spamhaus, Barracuda, SpamCop, SORBS, CBL, and PSBL. For IPs: approximately 44 zones including Spamhaus ZEN, Barracuda, SpamCop, SORBS, UCEPROTECT levels 1-3, SpamRats, Invaluement, and others.
Can I trigger an immediate re-check?
Not from the UI. Checks run on the fixed cadence. If you need an urgent check after completing a delisting, contact Ken support.
What does "Pending delisting" mean?
Ken has recorded that a delisting request is in progress. The domain will continue to show this state until the next sweep confirms the listing has been removed.
Does a green BL chip mean my emails will reach the inbox?
Not on its own. Blacklist status is one deliverability signal. Inbox placement also depends on domain reputation with individual providers, sending volume, engagement rates, authentication (SPF, DKIM, DMARC), and content.
Does the BL chip cover all sending domains, including newly added ones?
Yes, once they go through their first sweep. Brand-new domains show a grey "not checked" state until the first six-hour cycle completes.