What percentage of domains are on email blacklists?

In our September 2026 analysis of 1,247 domains, 8.3% (104 domains) appeared on at least one major DNS-based blacklist. Spamhaus SBL was the most common at 5.1%, followed by Barracuda BRBL at 3.4% and SpamCop at 2.8%.

Does having DMARC reduce the chance of being blacklisted?

Our data shows a clear correlation. 66.3% of blacklisted domains had no DMARC enforcement (p=none or no record), compared to 37.1% in the full dataset. Only 19.2% of blacklisted domains had p=reject, versus 43.4% overall. While DMARC alone does not prevent blacklisting, its absence is a consistent characteristic of listed domains.

How do I check if my domain is on a blacklist?

Run your domain through the InboxGreen free checker at inboxgreen.email/check. It queries major DNS-based blacklists as part of the standard scan and links to removal request pages for any list your domain appears on.

Which blacklist is most commonly used?

Spamhaus SBL is the most widely adopted and most impactful blacklist. It appeared in 5.1% of our 1,247-domain sample. Many enterprise email systems and ISPs query Spamhaus by default, making a listing there the most damaging for inbox placement.

How do I get removed from a blacklist?

Each blacklist has its own removal process. For Spamhaus, visit spamhaus.org/removal and follow the delisting request form after fixing the underlying cause. Barracuda and SpamCop have similar self-service portals. You must fix the root cause first — sending spam, spam trap hits, or list hygiene problems — or the listing will return.

Blacklist Prevalence Report 2026

Name: Blacklist Prevalence Report 2026
Creator: InboxGreen.email
Published: 2026-10-02
License: https://creativecommons.org/licenses/by/4.0/

October 2026 · 1,247 domains · By The InboxGreen Team

Dataset: Same 1,247 domains from our ongoing research series. Each domain was checked against five major DNS-based blacklists. Results reflect a snapshot taken in September 2026. See methodology for blacklist sources and query method.

Key Findings

8.3%

on at least one blacklist
(104 of 1,247 domains)

2.1%

on two or more blacklists
simultaneously

66.3%

of blacklisted domains
had no DMARC enforcement

5.1%

Spamhaus SBL — the most
common single blacklist

Blacklist Distribution

Of the 1,247 domains checked, 104 (8.3%) appeared on at least one of the five major blacklists queried. Spamhaus was the most common listing. Multiple-listing (appearing on two or more simultaneously) affected 26 domains (2.1%).

Domains listed per blacklist (% of 1,247 total)

Spamhaus SBL5.1% — 64 domains

Barracuda BRBL3.4% — 42 domains

SpamCop SCL2.8% — 35 domains

SORBS DUHL1.9% — 24 domains

UCEPROTECT L11.4% — 17 domains

Note: domains can appear on more than one blacklist. Percentages are of total 1,247 domains, not of total listings.

Blacklisting vs DMARC Policy

We cross-referenced blacklisted domains against DMARC policy from our August 2026 DMARC Enforcement Report. The pattern is clear: domains without DMARC enforcement are significantly over-represented among those appearing on blacklists.

DMARC policy of blacklisted domains (104 total)

Compared to full 1,247-domain dataset in brackets

No DMARC record29.8% [13.5% in full dataset]

31 domains

p=none (no enforcement)36.5% [23.6% in full dataset]

38 domains

p=quarantine14.4% [19.5% in full dataset]

15 domains

p=reject19.2% [43.4% in full dataset]

20 domains

66.3% of blacklisted domains had no DMARC enforcement (p=none or no record at all). Only 19.2% of blacklisted domains had p=reject, compared to 43.4% across the full dataset. Domains without enforcement are 2.5x less likely to have achieved p=reject than the general population.

Blacklisting vs DKIM Configuration

Cross-referencing with DKIM data from our September 2026 DKIM Selector Report, blacklisted domains show notably weaker DKIM configuration than the overall dataset.

DKIM status of blacklisted domains (104 total)

Compared to full 1,247-domain dataset in brackets

No DKIM found33.7% [22.6% in full dataset]

35 domains

RSA-1024 (deprecated key)19.2% [11.8% in full dataset]

20 domains

RSA-2048 or stronger47.1% [65.6% in full dataset]

49 domains

Blacklisted domains are 49% more likely to have no DKIM and 63% more likely to be using a deprecated RSA-1024 key compared to the broader dataset. While this is correlation rather than causation, weak email authentication is a common characteristic of domains that end up on blacklists.

What Gets a Domain Blacklisted

Blacklisting happens when a sending IP or domain is flagged by a blocklist operator for one or more of the following:

High spam complaint rates — recipients marking mail as spam at rates above provider thresholds
Sending to spam traps — email addresses used specifically to catch unsolicited mail
Lack of list hygiene — sending to invalid or unengaged addresses repeatedly
Shared IP abuse — on shared hosting, another tenant's behavior can affect your IP reputation
No authentication — some blacklists factor in missing or misconfigured DMARC/SPF as a risk signal

Authentication does not guarantee inbox placement, but its absence correlates with higher blacklist rates. The 66.3% figure for blacklisted domains lacking DMARC enforcement suggests that domains without authentication infrastructure are either being used to send unsolicited mail, or are being spoofed by third parties in ways that damage the domain's reputation.

How to Check if Your Domain is Blacklisted

The InboxGreen free checker queries the major DNS-based blacklists as part of its standard domain scan. If your domain appears on a blacklist, the result page links to the relevant removal request process for each list. See also: Domain Blacklisted: What It Means and How to Recover and Spamhaus Listed: Recovery Steps.

Methodology

The 1,247 domains in this dataset were selected from a cross-industry sample of active domains with MX records, first scanned for our June 2026 Email Authentication Report. Each domain was queried against five DNS-based blacklists in September 2026: Spamhaus SBL, Barracuda BRBL, SpamCop SCL, SORBS DUHL, and UCEPROTECT Level 1. Queries targeted the domain name (not IP address). The dataset does not include domains without MX records or parked domains. Full methodology at inboxgreen.email/methodology.

DKIM Selector Report 2026

September 2026 · DKIM coverage, key lengths, and alignment gaps across 1,247 domains.

DMARC Enforcement Report 2026

August 2026 · DMARC policy distribution and enforcement gaps.

SPF Mistakes Report 2026

July 2026 · Common SPF errors and how often they occur.