Free blacklist check API for IPs and domains
One GET request tells you whether an IP address or a domain is on the public email blocklists the API queries, list by list, with the official removal page. JSON, CORS enabled, no sign-up.
- Free, no sign-up
- No key, CORS enabled
- 10 checks per hour per IP
$ curl "https://app.mailsenpai.com/tools/blacklist-check?target=8.8.8.8"
{
"target": "8.8.8.8",
"type": "ip",
"status": "done",
"summary": "Not found on any of the lists this API queries",
"listed": false,
"counts": { "checks": 7, "listed": 0, "unreachable": 0, "clean": 7 },
"targets": [ { "target": "8.8.8.8", "lists": [ ... ] } ],
"lists_not_queried": [ ... ],
"cached": false
}Parameters and examples
| Name | Required | Description |
|---|---|---|
target | Yes | A public IPv4 address, e.g. 203.0.113.10, or a domain, e.g. example.com. For a domain the API checks the domain, its registered domain, the IPs of its first MX servers and its A record. IPv6 and private addresses are not accepted: for IPv6 pass the domain. |
lang | No | Language of the summary, labels and notes: en (default) or it. Field names and result values stay in English. |
job | No | Only after a 202 answer: the job you received. The API returns the result of that check without starting a new one. |
curl "https://app.mailsenpai.com/tools/blacklist-check?target=8.8.8.8"
const res = await fetch("https://app.mailsenpai.com/tools/blacklist-check?target=" + encodeURIComponent(target));
const report = await res.json();
if (res.status === 200) console.log(report.summary, report.counts.listed);What you get back
Real response for 8.8.8.8, shortened.
{
"target": "8.8.8.8",
"type": "ip",
"status": "done",
"lang": "en",
"summary": "Not found on any of the lists this API queries",
"listed": false,
"counts": { "checks": 7, "listed": 0, "unreachable": 0, "clean": 7 },
"targets": [
{
"target": "8.8.8.8",
"role": "ip",
"role_label": "IP address",
"name": "dns.google",
"listed_count": 0,
"lists": [
{ "id": "psbl", "name": "PSBL", "result": "clean", "reason": "", "removal_url": "https://psbl.org/listing?ip=8.8.8.8" },
{ "id": "uceprotect1", "name": "UCEPROTECT Level 1", "result": "clean", "reason": "", "removal_url": "https://www.uceprotect.net/en/rblcheck.php" },
{ ... }
]
}
],
"lists_queried": 7,
"lists_not_queried": [
{ "name": "SpamCop", "url": "https://www.spamcop.net/bl.shtml", "checked_by_web_tool": true, "note": "Queried by the web tool, not by this API." },
{ "name": "Spamhaus (ZEN)", "url": "https://check.spamhaus.org/", "checked_by_web_tool": false, "note": "The list mail providers rely on most: check on their official site." },
{ ... }
],
"license_notices": [ "UCEPROTECT Level 1 data: Copyright © 2001-2021 UCEPROTECT-Network http://www.uceprotect.net. Permission to use, copy, ..." ],
"note": "",
"checked_at": "2026-10-12T09:57:04Z",
"cached": false,
"more": "https://en.mailsenpai.com/blacklist-check/",
"docs": "https://en.mailsenpai.com/blacklist-check-api/",
"source": "MailSenpai"
}| Field | Values |
|---|---|
status | done with HTTP 200. If the lists take more than 12 seconds you get HTTP 202 with in_progress, a job and a retry_url: call it again after a couple of seconds. |
listed | true when at least one list reports the target. counts has the numbers: checks, listed, unreachable, clean. |
targets[].role | ip, domain, registered_domain, mx (incoming mail server) or a (website address). |
targets[].lists[].result | listed, clean or unreachable (the list did not answer: the reason says why). removal_url is the list’s official page to check and ask for removal. |
lists_not_queried | Lists this API does not query, each with the link to its official lookup. checked_by_web_tool tells you whether the MailSenpai web tool queries it. |
license_notices | Attribution notices of the lists queried. If you display the results, display these next to them. |
cached | true when the same target was checked in the last 30 minutes. |
The lists this API queries
The MailSenpai web tool queries 15 lists. This API queries 9 of them: 7 for IP addresses and 2 for domains.
The lists this API does not query come back in lists_not_queried, each with the link to its official lookup page.
For the full picture on 15 lists, with a free monitor and email alerts, use the blacklist check page.
| List | Checks | Official site |
|---|---|---|
| PSBL | IP addresses | Official site |
| 0spam | IP addresses | Official site |
| 0spam RBL | IP addresses | Official site |
| ZapBL | IP addresses | Official site |
| s5h.net | IP addresses | Official site |
| DroneBL | IP addresses | Official site |
| UCEPROTECT Level 1 | IP addresses | Official site |
| 0spam URL | Domains | Official site |
| ZapBL RHSBL | Domains | Official site |
UCEPROTECT copyright notice, returned in license_notices: UCEPROTECT Level 1 data: Copyright © 2001-2021 UCEPROTECT-Network http://www.uceprotect.net. Permission to use, copy, modify, and/or distribute this data for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
Simple rules, no surprises
10 checks per hour
From the same IP address. Answers served from the 30-minute cache don’t count. The headers X-RateLimit-Limit and X-RateLimit-Remaining tell you where you stand.
300 checks per day in total
Shared by everyone who uses the API. When it is reached the API answers 429 until midnight UTC.
Clear errors
Over a limit you get HTTP 429 with a Retry-After header; a missing or invalid target returns 422. Errors share one shape: {"code": "mspck_error", "message": "...", "data": {"status": 429, "retry_after": 1800}}.
Public data only
The API only reads public blocklists through DNS: no account and no personal data needed. Only GET requests are accepted.
Use it from Claude, ChatGPT or Cursor
A blacklist check is also the check_blacklist tool of the MailSenpai MCP server, for Claude, ChatGPT, Cursor and other MCP clients. How to connect it.
https://mcp.mailsenpai.com/mcp
tool: check_blacklist
input: { "target": "203.0.113.10" }Frequently asked questions
Do I need an API key?
No. Call the endpoint directly from your server or the browser: CORS is enabled.
What does it check for a domain?
The domain and its registered domain on the domain lists, then the IP addresses of its first MX servers and of its A record on the IP lists. Each one comes back as a separate entry in targets.
Which lists does the API not query?
The ones in lists_not_queried: each comes with the link to its official lookup page. The API queries 9 lists, the web page 15.
What happens over the limit?
You get HTTP 429 with a Retry-After header that says how many seconds to wait. Answers already in the 30-minute cache keep working.
Can I use it in a commercial product?
Yes, within the limits on this page. Show the notices in license_notices next to the results when they are present. A link to the MailSenpai blacklist check where you show the results is appreciated, not required.
Does a clean result mean my emails reach the inbox?
No. It means the target is not on the lists this API queries. Mailbox providers also use their own data and other lists, such as the ones in lists_not_queried.
Is there an OpenAPI description?
Yes, in OpenAPI 3.1, as YAML and as JSON: the links are below the examples.
Prefer a page? Check an IP or a domain
Check an IP address or a domain in your browser on 15 lists and turn on the free monitor with email alerts. If your website or app still sends from the hosting server, SMTP Senpai signs your emails with DKIM on your own domain, with servers and data in the EU.