dan.me.uk DAN TOREXIT DNS Blacklist

The dan.me.uk Tor exit node blacklist is an automated IP blocklist. Monitor your domain reputation with Suped.
Updated on 17 Jun 2026: We updated this guide with DNSBL query examples and clearer Tor exit delisting guidance.
Summarize with
Check if you are listed on dan.me.uk DAN TOREXIT DNS Blacklist
And 143 other blocklists.















What is dan.me.uk DAN TOREXIT DNS blacklist?
The dan.me.uk DAN TOREXIT DNS blacklist is an IP-based DNSBL that identifies IP addresses currently acting as Tor exit nodes. The DNS zone is torexit.dan.me.uk, and it differs from tor.dan.me.uk, which lists all Tor nodes, including entry, transit, and exit nodes.
The blocklist policy is narrow: it lists Tor exit IPs, not spam sources, malware hosts, or general abuse signals. Network administrators use this blacklist (blocklist) when they want a separate policy for traffic that leaves the Tor network. For email, the listing should be treated as an infrastructure issue, because a normal outbound mail server should not also run a Tor exit relay.
Who runs dan.me.uk DAN TOREXIT DNS blacklist?
This blacklist service is run by Daniel Austin in the UK. It is one of several DNS blacklists (blocklists) published on dan.me.uk, alongside a broader Tor node DNSBL.
Published technical details include:
- The zones run on diverse nameservers in multiple locations.
- The DNSBLs are reachable over IPv6.
- The DNS blacklist is DNSSEC signed with a chain of trust from the DNS root to individual entries.
- The service is free to query, with no published query limits.
- For thousands of queries per hour, the operator says zone transfers can be reviewed case by case for local caching.
How do I get removed from dan.me.uk DAN TOREXIT DNS blacklist?
Removal from the dan.me.uk DAN TOREXIT DNS blacklist is automated. There is no manual delisting form or complaint process for this DNSBL.
The Tor node list is refreshed every 30 minutes from the live Tor network. If the IP address stops operating as a Tor exit node, the listing drops automatically, with a maximum delay of one hour. The practical fix is to stop the Tor exit relay on that IP, then check that the host no longer advertises itself as an exit node.
How to query torexit.dan.me.uk
The DNSBL uses inverse addressing. For IPv4, reverse the octets and append torexit.dan.me.uk. A listed IP returns an A record of 127.0.0.100; the TXT response includes extra Tor node details such as node name, ports, and flags.
IPv4 query exampletext
IP: 192.0.2.123 DNSBL query: 123.2.0.192.torexit.dan.me.uk Listed response: 127.0.0.100
For IPv6, expand the address first, reverse it in nibble format, then append the DNS zone. Automation should handle the expansion and reversal, because hand-built IPv6 DNSBL queries are easy to mistype.
IPv6 query shapetext
IP: 2001:db8::1 Expanded: 2001:0db8:0000:0000:0000:0000:0000:0001 DNSBL query: 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.torexit.dan.me.uk
What's the impact of being listed on dan.me.uk DAN TOREXIT DNS blacklist?
The impact is low for most legitimate email senders, because normal email infrastructure should not run Tor exit traffic on the same IP used for outbound mail. If a mail server IP appears on this blocklist, treat it as a server role problem or a compromise that started a Tor exit relay.
Some receiving systems, chat networks, web apps, and firewalls block or challenge Tor exit traffic. For email, the root cause matters more than the listing itself: disable the Tor exit service and verify the IP no longer resolves in the DNSBL after the next update cycle.
In Suped's DMARC and email authentication workflows, this kind of listing belongs in infrastructure reputation monitoring rather than DMARC policy enforcement. DMARC, SPF, and DKIM do not remove a Tor exit listing, but correlating blocklist alerts with sending domains helps separate authentication failures from IP reputation issues.
