How to Check an Expired Domain for Blacklists Before Buying

Published 2026-11-03 ／ Updated 2026-11-03 ／ By Yuki Nakazawa

Before you register a dropped domain or buy one on the aftermarket, look it up on the domain-based blocklists (Spamhaus DBL, SURBL and URIBL) and on Google Safe Browsing. The three DNS lists record the domain name itself, so a listing earned under a previous owner does not go away when you move the domain to new hosting or a new IP address.

A clean result is useful, but it is not a clean bill of health. These lookups show the current state, not a full history, and some of Google's own signals can only be seen once the domain is yours. This guide covers where to look, how to read the answers, what a listing can do to email, browsers and search, and the limits of what any pre-purchase check can tell you.

It is based on the official pages of each list operator and on Google's own documentation as of November 2026. Policies and tools change, so confirm the details on the official sites before you rely on them. If you are new to blocklists in general, start with what a DNSBL (RBL) is.

Check for free whether your domain or IP address is on any of about 345 blacklists.

Why an expired domain needs a blacklist check

There are two broad kinds of DNS blocklist. IP-based lists record the addresses that mail comes from. Domain-based lists record domain names. When you are buying a used domain, the second kind is the one that matters, because it travels with the name.

RFC 5782, the informational document that describes how DNSBLs work, notes that name-based lists have been used to check the domains found in URLs in message bodies, the domain names of email addresses, and host names in mail headers. If a domain was used for spam or phishing before it expired, mail you send from it, or mail that merely links to it, may be treated with suspicion by receivers that consult those lists.

Separately, if Google Safe Browsing has flagged the site as dangerous, browsers that use it can show a warning to visitors. Search is a third area, and we stick to what Google's own help pages say about it further down.

You can change servers and IP addresses as often as you like, but the domain name stays the same. That is why the check is worth doing before you spend money or effort on the domain.

Which lists to check and where

These are the main places to look up a domain's reputation:

Source	What it lists	Official lookup
Spamhaus DBL	Domains with poor reputation, including those used for spam, phishing, fraud and malware, plus hostnames on hijacked legitimate sites	check.spamhaus.org (IP and Domain Reputation Checker)
SURBL	Abused sites (ABUSE), phishing (PH), malware (MW), cracked sites (CR), click-trackers (CT) and disposable email domains (DM)	The SURBL Lookup page
URIBL	Domains that appear in spam, split into black, grey and red lists	lookup.uribl.com
Google Safe Browsing	Social engineering (phishing and deceptive) sites and sites hosting malware or unwanted software	Site Status on Google's Transparency Report; Search Console once you own the site

A few points from the operators' own descriptions are worth knowing. The DBL lists only domains, never IP addresses, and it is not part of Spamhaus ZEN, so it has to be checked on its own. URIBL is explicit that it lists domains that appear in spam, not where the spam was sent from. SURBL notes that cracked sites usually still contain the original legitimate content, which is exactly the situation you can inherit with a domain that was once a real site.

To see the same domain against several lists at once, you can also run it through our blacklist checker.

Step-by-step check before you buy

Write down the registrable domain. Use the domain you would actually own (example.com), not a hostname under it. The DBL lists at the main domain level, and URIBL says it generally strips host parts from URIs before adding them (a few heavily abused domains are listed with the subdomain).
Look it up on Spamhaus. Enter the domain at check.spamhaus.org. This is also the only place where DBL removals are handled, so it is the page you will come back to if there is a problem later.
Look it up on SURBL and URIBL. Use SURBL's Lookup page and URIBL's lookup.uribl.com.
Check Google Safe Browsing. Google's Transparency Report has a Safe Browsing site status lookup.
Record what you find, with the date. Note each list, the return code or category, and the explanation shown. That record helps with the buying decision and with any removal request you file afterwards.

Checking from the command line

Domain-based lists are queried by appending the list's zone to the domain name, as described in RFC 5782:

dig +short example.com.dbl.spamhaus.org
dig +short example.com.multi.surbl.org
dig +short example.com.multi.uribl.com

No answer means not listed, and a 127.x.x.x answer should be read against the tables in the next section. Be careful, though. Spamhaus's DNSBL usage FAQ says that if you query through a free public resolver such as Google Public DNS (8.8.8.8), in most cases you will get a "not listed" (NXDOMAIN) reply, and sometimes the error code 127.255.255.254. A clean result from a machine that uses a public resolver proves nothing. When in doubt, trust the operators' own lookup pages.

If you are screening a long list of candidates, respect each operator's usage terms. Spamhaus, for example, asks that its website not be queried with automated tools.

Reading the results

Spamhaus DBL

Return code	Meaning
127.0.1.2	Spam domain
127.0.1.4	Phish domain
127.0.1.5	Malware domain
127.0.1.6	Botnet C&C domain
127.0.1.102 to .106	Abused legitimate domain (spam, spammed redirector, phish, malware, botnet C&C)
127.0.1.255	IP queries prohibited, not a listing

Answers in the 127.255.255.x range are error codes. Spamhaus states that they must not be taken to imply that the queried object is listed. For a wider reference, see DNSBL return codes explained.

SURBL (multi.surbl.org)

The last octet is a sum of list values: 4 for DM, 8 for PH, 16 for MW, 32 for CT, 64 for ABUSE and 128 for CR. So 127.0.0.80 means MW plus ABUSE. A 127.0.0.1 answer from the public nameservers means your access is blocked, not that the domain is listed. SURBL also recommends basing automated decisions on the A record only, since TXT records are meant for human readers.

URIBL (multi.uribl.com)

The last octet is a bitmask: 2 for black, 4 for grey and 8 for red. A value of 1 (127.0.0.1) means your query was blocked, for example because of high volume, not that the domain is listed. According to URIBL, black holds domains belonging to and used by spammers, with a goal of zero false positives. Grey holds domains seen in bulk mail that may honour opt-outs, and URIBL warns that it can and probably will cause false positives. Red holds domains seen in mail flow that are being monitored, are very young by WHOIS domain age, or use WHOIS privacy; it is automated and meant to be used at your own risk. A red-only hit means something quite different from a black hit.

What a listing can affect: email, browsers and search

Email delivery

If a receiving mail server checks the domains in your links or your sender address against a domain-based list, a listed domain can lead to messages being filtered or rejected. How a listing is used is up to the receiver. URIBL, for instance, describes its data as a way to tag mail as spam and says it does not block anything itself; if you are blocked, it tells you to take it up with whoever is blocking you. Either way, if you plan to send mail from the domain, a current listing is a serious warning sign.

Browser warnings

Google's Chrome help says Chrome may show a red "Dangerous site" warning for sites involved in phishing, malware, unwanted software or social engineering. Search Console's help adds that visitors may see an interstitial warning page in the browser when they try to open a page with security issues.

Google Search

Pages affected by issues in Search Console's Security Issues report (hacked content, malware and unwanted software, social engineering) can appear with a warning label in search results.

Google's spam policies also include expired domain abuse, defined as an expired domain name being purchased and repurposed primarily to manipulate search rankings by hosting content that provides little to no value to users. The examples Google gives include affiliate content on a site previously used by a government agency and casino-related content on a former elementary school site. The policy targets that kind of use, not the act of buying an expired domain. Sites that violate Google's policies may rank lower or not appear in results at all, and a human review can lead to a manual action.

What Google's help pages do not say is just as important. They do not say how long a previous owner's history affects search, or whether a past blocklist listing hurts rankings. We do not make claims about either here.

What a pre-purchase check cannot tell you

Past listings are invisible. Spamhaus says most DBL listings expire automatically once they cease to have associated activity. A lookup shows today's state only, so "not listed now" does not mean "never abused".
Listing criteria are not public. Spamhaus does not disclose its specific criteria and says domains must match several of them to be listed. A lookup will not always explain why.
A fresh start is not a good reputation. Spamhaus notes that unknown reputations begin as "poor" by default and that a good reputation takes longer to build than a bad one. Even a clean domain needs a careful start, especially for email.
Google's internal view is not open to you yet. Manual actions and security issues are reported in Search Console to whoever manages the site, which is the current owner until you take the domain over. Unless the seller shares that information with you, you cannot see them before purchase, and Google does not publish its other ranking signals.
Receivers make their own decisions. Which lists a receiver consults, and what it does on a hit, is its own configuration. A lookup cannot fully predict how your mail will be treated.
The lookup path can mislead. Public resolvers can turn a listing into a false "not listed", and SURBL warns that DNS proxies or ISPs that rewrite NXDOMAIN answers can cause misidentification.

Treat these checks as a way to reduce risk, not as a guarantee that a domain is safe.

If the domain is listed after you take it over

The same rule applies everywhere: if the cause is still there, a removal may not last, and the final decision always rests with the list operator.

Spamhaus DBL. Removals are handled only through check.spamhaus.org. Submitting a request is no promise that the listing will be lifted, and excessive requests may be blocked. Approved removals are processed immediately, though some receivers can take up to 24 hours to update their local systems. Spamhaus states that removal is free and that any offer to remove a listing for a fee is a scam. For an abused-legit listing, first take the site offline if you can, remove infected files, update the CMS and plugins, secure the server, and change passwords with two-factor authentication where possible.
SURBL. Start at the Lookup page and follow the instructions on the removal form. For CR, PH or MW listings, remove and secure the threats first; SURBL warns that systems that are not properly secured may be broken into again, and that compromised DNS control panels can be used to add malicious subdomains.
URIBL. Delisting requests require a login. Create an account on the registration page, then use the submission form.
Google security issues. Fix the problem across the whole site, then select Request Review in the Security Issues report. Reviews can take several days or weeks, and Google asks you not to resubmit while a request is pending.
Google manual actions. If you bought a site that already violated the spam policies, Google's help says to fix the issues, mention in your reconsideration request that you recently acquired the site, and confirm that it no longer violates the policies.

For the other Spamhaus lists and their removal paths, see Spamhaus removal, list by list. If working out the cause or filing requests becomes more than you can handle on your own, you can contact us with the details.

If you would rather not handle this yourself

We introduce providers who take on delisting requests, consulting and advice (from JPY 50,000). Delisting is decided by each list operator and cannot be promised.

Get help

This site may receive a referral fee from listed providers. About

FAQ

Can I check a domain that has expired and is not registered to anyone?

Yes. A domain-based DNSBL is queried by asking the list's own DNS about the name plus the list zone, so the domain itself does not need to be live. The official lookup pages of Spamhaus, SURBL and URIBL are the most reliable way to do it.

If a domain is on no list, is it safe to buy?

Not necessarily. Most DBL listings expire once the abuse stops, so past history does not show up in a lookup, and Google's manual actions are reported only to the people who manage the site, so you cannot see them yourself before you own it. Use the result as one input to your decision, not as proof.

Will Google penalise me for buying an expired domain?

Google's spam policy targets buying an expired domain and repurposing it primarily to manipulate rankings with content of little or no value to users. It does not say that buying an expired domain is itself a violation. Google's help pages do not say how a previous owner's history affects search.

The domain only hits URIBL red. Should I worry?

URIBL describes red as an automated list of monitored domains, very young domains and domains using WHOIS privacy, to be used at your own risk. That is different from a black listing. Compare it with the Spamhaus and SURBL results before deciding.

Official pages used

The facts in this article were checked against the official pages below at the time of publication. Policies and behavior change without notice, so check the official pages before relying on anything important.

Listed on Spamhaus? Find out which list you are on (ZEN, PBL, XBL, CSS, SBL, DBL), what the return codes mean, and the right delisting path for each.

What Is a DNSBL (RBL)? How DNS Blacklists Work

What is a DNSBL? How DNS blacklists and RBLs work: reversed IP lookups, A and TXT records, IPv6, IP vs domain lists, whitelists, and why IPs get listed.

DNSBL Return Codes Explained: 127.0.0.2, 127.255.255.x and NXDOMAIN

How to read DNSBL return codes: what 127.0.0.2 means under RFC 5782, codes for Spamhaus, SpamCop and UCEPROTECT, error codes, and NXDOMAIN vs SERVFAIL.

All guides →