UCEPROTECT DNSBL Level 2
UCEPROTECT Level 2 is an IP-based blocklist (or blacklist) that escalates listings from single IPs to entire networks based on high spam volume.
Updated on 17 Jun 2026: We updated this guide with DNSBL lookup details, provider-wide delisting guidance, and clearer impact notes for Level 2 listings.
Summarize with
Check if you are listed on UCEPROTECT DNSBL Level 2
And 143 other blocklists.
Spamhaus
0Spam
Cisco
NoSolicitado
URIBL
abuse.ro
ALPHANET
Anonmails
Ascams
BLOCKEDSERVERS
Calivent Networks
EFnet
JustSpam
Kempt.net
NordSpam
RV-SOFT Technology
Scientific Spam
Spamikaze
SpamRATS
SPFBL
Suomispam
System 5 Hosting
Team Cymru
Validity
www.blocklist.de Fail2Ban-Reporting Service
ZapBL
2stepback.dk
Fayntic Services
ORB UK
technoirc.org
TechTheftSpamhaus0SpamCiscoNoSolicitadoURIBLabuse.roALPHANETAnonmailsAscamsBLOCKEDSERVERSCalivent NetworksEFnetJustSpamKempt.netNordSpamRV-SOFT TechnologyScientific SpamSpamikazeSpamRATSSPFBLSuomispamSystem 5 HostingTeam CymruValiditywww.blocklist.de Fail2Ban-Reporting ServiceZapBL2stepback.dkFayntic ServicesORB UKtechnoirc.orgTechTheftSpamhaus0SpamCiscoNoSolicitadoURIBLabuse.roALPHANETAnonmailsAscamsBLOCKEDSERVERSCalivent NetworksEFnetJustSpamKempt.netNordSpamRV-SOFT TechnologyScientific SpamSpamikazeSpamRATSSPFBLSuomispamSystem 5 HostingTeam CymruValiditywww.blocklist.de Fail2Ban-Reporting ServiceZapBL2stepback.dkFayntic ServicesORB UKtechnoirc.orgTechTheftSpamhaus0SpamCiscoNoSolicitadoURIBLabuse.roALPHANETAnonmailsAscamsBLOCKEDSERVERSCalivent NetworksEFnetJustSpamKempt.netNordSpamRV-SOFT TechnologyScientific SpamSpamikazeSpamRATSSPFBLSuomispamSystem 5 HostingTeam CymruValiditywww.blocklist.de Fail2Ban-Reporting ServiceZapBL2stepback.dkFayntic ServicesORB UKtechnoirc.orgTechTheftSpamhaus0SpamCiscoNoSolicitadoURIBLabuse.roALPHANETAnonmailsAscamsBLOCKEDSERVERSCalivent NetworksEFnetJustSpamKempt.netNordSpamRV-SOFT TechnologyScientific SpamSpamikazeSpamRATSSPFBLSuomispamSystem 5 HostingTeam CymruValiditywww.blocklist.de Fail2Ban-Reporting ServiceZapBL2stepback.dkFayntic ServicesORB UKtechnoirc.orgTechTheftWhat is UCEPROTECT DNSBL Level 2?
UCEPROTECT DNSBL Level 2 is an IP-based blocklist (blacklist) that expands some Level 1 activity into wider network listings. Level 1 lists individual IP addresses that have hit UCEPROTECT spamtraps or triggered trusted reports. Level 2 lists larger allocations when too many IPs inside a provider's netblock are on Level 1, so a sender can be affected by activity from other customers in the same network.
The policy is designed to put pressure on hosting providers and internet service providers (ISPs) to take action against abusers on their network. The idea is that if providers are held accountable for spam originating from their systems, they will implement stronger abuse controls. According to UCEPROTECT, their blacklists (or blocklists) are rebuilt hourly based on data collected from spamtraps and reporting systems.
Who runs UCEPROTECT DNSBL Level 2?
The UCEPROTECT DNSBL Level 2 blacklist is operated by UCEPROTECT-Network and UCEPROTECT-Orga. Public UCEPROTECT pages describe listing data as coming from trusted reporting systems, people who distribute spamtraps, and UCEPROTECT-Orga members.
Trusted reporting systems report IP addresses that hit spamtraps or try unauthorized relaying. UCEPROTECT-Orga members can also make manual listings and removals, which means the database is not fed only by automated spamtrap hits.
How to check UCEPROTECT DNSBL Level 2
The DNSBL lookup zone for Level 2 is dnsbl-2.uceprotect.net. To query it, reverse the IPv4 address octets and append the zone. A positive DNSBL answer means the IP falls inside a Level 2 listed allocation; no answer generally means it is not listed at that level.
Example DNSBL lookupBASH
dig +short 10.2.0.192.dnsbl-2.uceprotect.net
This example checks the IP address 192.0.2.10. UCEPROTECT says DNS distribution is intended for small and medium mail servers. Systems making more than 100,000 requests per day are directed to use its rsync distribution instead.
How do I get removed and delisted from UCEPROTECT DNSBL Level 2?
According to UCEPROTECT, every listed IP expires automatically and free of charge 7 days after the last abusive activity was detected. Before requesting any delisting, resolve the source of the spam or abuse and confirm whether the listing is Level 1, Level 2, or Level 3.
If the Level 2 listing covers your provider's netblock and you do not control that allocation, UCEPROTECT's removal policy treats you as an affected user rather than the operator responsible for the listing. In that case, send evidence to the hosting provider or ISP and ask them to stop the abuse inside the netblock; fixing only your own host does not remove a provider-wide listing.
UCEPROTECT offers an optional paid immediate removal, but this option is not always available. It is only offered if certain criteria are met. You can check your IP status and the available options on the UCEPROTECT removal page. Immediate removal is unavailable in the following circumstances:
- Abuse has been detected from IPs on the Level 1 blacklist or the Backscatterer blacklist within the last 3 hours.
- The listing limit for a network on Level 2 has been exceeded by a factor of 10 or more.
- An entire Autonomous System (AS) is listed on Level 3 and is ranked in the top 5 of their Level 3 charts.
- The number of listings for the network in Level 2 or Level 3 is still increasing.
- The owner of the IP address or their ISP has previously stated they do not want the paid removal option.
What's the impact of being listed on UCEPROTECT DNSBL Level 2?
The impact of being listed on the UCEPROTECT DNSBL Level 2 blacklist is receiver-specific. Receivers that use this blocklist for blocking reject mail from any IP inside the listed allocation, which creates delivery problems with those mail systems. Receivers that do not use Level 2 will not block mail because of this listing alone.
Because Level 2 targets netblocks rather than only individual IPs, it has a higher false-positive risk than a single-IP blacklist. Legitimate senders can be blocked when they share a provider network with abusive customers. Treat a Level 2 hit as a provider and routing issue first, then verify your own outbound mail for compromised accounts, open relays, open proxies, malware, and unexpected bulk sending.
For teams using Suped, DMARC aggregate reports can help identify which authenticated sources are using the affected provider network, so escalation goes to the right owner instead of a general deliverability queue.
Other UCEPROTECT blocklists
UCEPROTECT DNSBL Level 1
Organization
UCEPROTECT
Zone
dnsbl-1.uceprotect.net
Type
IP
Impact
Medium
Delisting
Manual
UCEPROTECT BACKSCATTERER Blacklist
Organization
UCEPROTECT
Zone
ips.backscatterer.org
Type
IP
Impact
Low
Delisting
Automatic
UCEPROTECT DNSBL Level 3
Organization
UCEPROTECT
Zone
dnsbl-3.uceprotect.net
Type
IP
Impact
Low
Delisting
Manual
