When mail starts landing in spam, the first instinct is to check whether the sending IP is blacklisted. That is half the picture. Modern blacklists score two separate things, and they fail in different ways for different reasons. If you only watch one, you will eventually spend a day fixing an IP that was never the problem.
Two Reputations, One Message
Every email carries two reputational identities. There is the IP address the message was delivered from, and there are the domains inside the message: the From domain, the Return-Path, the links in the body, and the domains those links redirect to.
IP reputation answers a narrow question: is this sending host known to emit spam? It is built from volume patterns, spam trap hits, and complaint rates tied to the address. Domain reputation answers a broader one: is this brand, this sender, this URL associated with abuse anywhere, regardless of which IP sent it today?
The distinction matters because the two move independently. You can send from a spotless IP and still get filtered because a link in your newsletter points at a domain someone else burned. You can also have a clean domain and get throttled because you share an IP block with a spammer.
How IP Blacklists Work
IP blacklists are the older model and the one most people picture. A receiving mail server takes the connecting IP, reverses it, and queries a DNS blocklist. If the address is listed, the server can reject, defer, or score the message.
These lists react to behavior at the connection level. Spamhaus zones like the SBL, XBL, and PBL each describe a different reason an IP is untrusted: a known spam source, a compromised host, or a range that should not be sending mail directly at all. An IP listing usually points at something about the host or its neighbors, which is why a shared address can drag you down through no fault of your own.
How Domain and URI Blacklists Work
Domain blacklists, sometimes called URI blacklists, score the domains found inside a message rather than the IP that carried it. The best known are the Spamhaus DBL and SURBL. A filter extracts every domain from the headers and body, including the destinations of shortened links, and checks each one.
This model is harder to dodge. A spammer can rotate through thousands of IPs cheaply, but the message still has to name a domain the recipient can click, and that domain is the thing being sold. Burn it and rotating IPs does not help. For senders, it means a single bad link, an unmaintained redirect, or a compromised tracking domain can poison otherwise clean mail.
Why You Have to Watch Both
Because the two reputations move on their own, monitoring one leaves a blind spot the size of the other. A clean IP tells you nothing about whether a domain in your footer got listed. A clean primary domain tells you nothing about the shared IP your provider just added a bad neighbor to.
This gets worse as infrastructure spreads out. A typical sender now has a primary domain, a separate domain for click tracking, another for images, a bounce domain, and often a third-party domain a marketing platform sends from. Each one is scored independently. Each one can be listed independently. We covered the broader set of signals that decide placement in email deliverability signals, and the specific behaviors that trigger a listing in common blacklist triggers.
Diagnosing the Right One
When delivery drops, check both before you act. A quick blacklist check against your sending IP and your domains tells you which reputation moved. If the IP is listed but the domains are clean, the problem is the host or its neighbors, and the fix is delisting plus a look at what you or a co-tenant sent. If the domains are listed but the IP is clean, chasing the IP wastes a day; the fix is finding which domain got flagged and why, often a compromised link or a redirect you forgot you owned.
Generator Labs blacklist monitoring watches both your IPs and your domains across hundreds of data sources, so a listing on either side surfaces with the context to act on it instead of a guess. Knowing which reputation broke is most of the work. Start monitoring before the next bounce report makes you guess.