DroneBL — Check, Delist & Monitor
Check if you're listed on DroneBL. Community-maintained DNSBL targeting compromised hosts, open proxies, and botnets. Manual removal requires remediation proof.
Impact & Usage
Primarily used by IRC networks and niche mail servers. Not referenced by major email providers. A listing indicates a security issue with your host rather than a spam problem.
Typical users: IRC networks, mail servers, and security-conscious operators seeking to block traffic from compromised infrastructure
What Gets You Listed
Community-reported and automated detection of compromised hosts, open proxies, open resolvers, and botnet participants
How to Get Delisted
- Check your listing at dronebl.org/lookup by entering your IP address. Note the listing type — DroneBL classifies entries by threat category (open proxy, botnet drone, open relay, etc.).
- Remediate the security issue identified by the listing type. Close open proxies, remove botnet malware, patch vulnerable services, or disable unauthorized relay.
- Submit a removal request at dronebl.org/lookup with evidence of remediation. DroneBL volunteers review requests manually.
- Wait for the review and approval. Verify removal with mxio Blacklist Check.
Expected Timeline
1-7 days (manual review by community volunteers)
Auto-delist: Manual removal via DroneBL lookup page after verifying the host is no longer compromised; active listings require evidence of remediation
Common Causes
- Server compromised and participating in a botnet or used as a spam drone
- Open proxy (SOCKS, HTTP) allowing unauthorized traffic relay through your IP
- Open mail relay or misconfigured SMTP server permitting unauthorized sending
- Vulnerable web application exploited to relay traffic or send spam
Prevention Tips
- Regularly scan your servers for malware, rootkits, and unauthorized processes
- Ensure no open proxies (SOCKS4/5, HTTP CONNECT) are running on your servers — scan all ports
- Keep all server software updated and apply security patches promptly
- Use firewall rules to restrict outbound connections to only necessary services and ports
Overview
DroneBL is a community-maintained blacklist with roots in the IRC (Internet Relay Chat) ecosystem. Its original purpose was to identify and block compromised hosts — botnet drones, open proxies, and open relays — from connecting to IRC networks. Over time, some mail server administrators have adopted it as a supplementary DNSBL, though its primary audience remains IRC operators and network abuse teams.
What makes DroneBL distinct from spam-focused blacklists is its classification system. Rather than simply flagging an IP as "spam source," DroneBL categorizes listings by threat type: open SOCKS proxy, open HTTP proxy, botnet drone, open SMTP relay, and several other categories. This classification can be genuinely useful for diagnosing what is wrong with a listed host, even if the listing itself has limited email delivery impact.
The delisting process is manual and community-driven. You submit a removal request with evidence that the security issue has been resolved, and DroneBL volunteers review and approve (or deny) the request. Response times vary depending on volunteer availability, but most requests are processed within a few days.
For email delivery specifically, DroneBL has low impact. Major providers like Gmail, Microsoft 365, and Yahoo do not reference it. However, a DroneBL listing is a meaningful security signal — if your IP is flagged here, it likely means your server has a genuine compromise or misconfiguration that needs attention regardless of its effect on email delivery.
Monitor Your Blacklist Status
Get alerted the moment your IP or domain appears on a blacklist. Catch listings early, before they impact deliverability.
Set Up MonitoringRelated Blacklists
Check if you're listed on Blocklist.de. Attack-focused DNSBL aggregating Fail2Ban reports for SSH brute force, web exploits, and mail abuse. Popular in European hosting.
Check if you're listed on Backscatterer.org. Detects IPs sending misdirected bounce messages (backscatter NDRs). Auto-removes after 4 weeks of clean behavior.