How to remove your IP from DroneBL

DroneBL flags compromised and abused hosts. Here is what a listing means, and how to get your IP removed.

Check your domain free → DroneBL removal tool ↗

What it is

The list, in plain terms.

DroneBL is a DNS-based blocklist (DNSBL) that tracks IP addresses associated with compromised machines, botnet drones, open proxies and other abused hosts. It has been run by the community-maintained DroneBL Team since 2004 and publishes its data through the zone dnsbl.dronebl.org.

It was built primarily to protect IRC networks and similar real-time services from drones and proxies, and it is also queried by some mail systems and security tools. It is a niche list rather than a mainstream mail blocklist, so a DroneBL entry is more likely to affect IRC access than large-scale email delivery, though some receivers do consult it.

DroneBL lists IP addresses, not domains, so it is your sending or connecting host that is flagged. A listing usually reflects abuse seen from that IP — often by a previous user of a reassigned address — not necessarily anything you did deliberately.

Why you get listed

What a listing on DroneBL means.

A compromised or infected host A machine on the IP was detected acting as a botnet drone, bottler or autorooting worm, or as a brute-force attacker. It means something on that address was abused, not that you knowingly sent traffic.

An open proxy or relay DroneBL detects SOCKS proxies, HTTP proxies, proxy chains, Wingate proxies and web page proxies. Open or misconfigured proxy software on the IP is a common cause.

A compromised router or open resolver Hijacked routers and gateways, and open DNS resolvers that can be abused for amplification, are listed as infrastructure that is being exploited.

An inherited listing ISPs reassign addresses frequently, so a previous holder's malware or proxy can leave the IP listed after it passes to you. The entry stays until someone who controls the IP requests removal.

How to get removed

Delisting, in order.

Removal is free. Fix the cause first — a listing you clear without a fix comes straight back.

1 Look your IP up on DroneBL. Search the address at dronebl.org/lookup. This confirms whether it is listed and under which classification, and it is where the removal request form lives. If your mail or connection is blocked, use the affected device to find its public IP first.
2 Fix the underlying abuse. Clean the malware, close the open proxy or relay, or secure the compromised router before you ask for removal. DroneBL is automated: if the abuse is still detectable, the listing returns after any delisting.
3 Only request removal for an IP you control. Removal is appropriate for addresses you administer — typically a residential or mobile IP from your own ISP. You cannot request removal for shared VPN addresses, public Wi-Fi, or servers you do not run.
4 Submit the removal request. Use the form on the lookup page. Name the IP, acknowledge the classification, state what you checked and what you changed, and give the reviewer enough to trust the listing will not return. Submitting from the affected device helps confirm the address.
5 Wait for a volunteer to review it. Requests are reviewed manually by volunteers, so removal is not instant. Do not resubmit repeatedly; if nothing has happened after about a week you can follow up via the project's IRC channel.
6 Re-check, then tell the blocking service. Confirm the entry is gone at dronebl.org/lookup. Services that blocked you only learn of the removal when they next query DroneBL, on their own schedule, so contact that service directly if you need it applied sooner.

The official route

Straight to the source.

Removal happens on DroneBL's own tool — never through a paid service.

DroneBL removal tool ↗

Return codes

127.0.0.3 IRC drone

127.0.0.5 Bottler

127.0.0.6 Unknown spambot or drone

127.0.0.7 DDoS drone

127.0.0.8 SOCKS proxy

127.0.0.9 HTTP proxy

127.0.0.10 ProxyChain

127.0.0.11 Web page proxy

127.0.0.12 Open DNS resolver

127.0.0.13 Brute-force attackers

127.0.0.14 Open Wingate proxy

127.0.0.15 Compromised router or gateway

127.0.0.16 Autorooting worms

127.0.0.17 Automatically determined botnet IP (experimental)

127.0.0.255 Unknown

How long it takes

Removal is not automatic. Requests are reviewed by volunteers and can take from a day to a week or more. If your request has not been actioned after about a week, you can follow up on the project's IRC channel. Delist without fixing the compromise and the automated detection re-adds the IP.

Common questions

About DroneBL, specifically.

Does DroneBL charge to remove my IP? No. Removal is free through the request form at dronebl.org/lookup. Any service offering to remove a DroneBL listing for a fee is a scam — no third party can influence or speed up a volunteer-reviewed removal.

Why is my IP on DroneBL if I did nothing wrong? Most listings reflect abuse seen from the IP before it was assigned to you. ISPs reassign addresses often, so a previous holder's malware or open proxy can leave the address listed. Once you control the IP and the abuse is gone, you can request removal.

How long does DroneBL removal take? There is no fixed time. Volunteers review each request manually, so it can take from a day to a week or more. If nothing has happened after about a week, you can follow up via the project's IRC channel rather than resubmitting.

Can I remove an IP I do not control? No. DroneBL only accepts removal requests for addresses you administer, typically a residential or mobile IP from your own ISP. You cannot delist a shared VPN address, public Wi-Fi, or a server you do not run — the operator of that host must request it.

I was delisted but got listed again — why? Because the abuse was still present. DroneBL detects compromised hosts and proxies automatically and re-adds the IP when it sees the behaviour again. Clean the malware or close the proxy first, then request removal.

My mail still bounces after DroneBL cleared me — why? A service that blocked you only sees the removal when it next queries DroneBL, on its own schedule. Confirm the entry is gone at dronebl.org/lookup, then contact that service directly if you need the block lifted sooner.

The bounce behind the listing.

554 5.7.1 message rejected → The permanent bounce a listing most often triggers — what it means and how to clear it. 550 5.7.1 blocked → A rejection on reputation grounds — usually the same listing, seen from the sender side. Blacklist checker → Re-check your domain and every sending IP once the cause is fixed.

Do not fix it blind.

See every list you are on and every authentication problem behind the listing in one 40-second check — then let monitoring tell you the day a listing comes back.

Check your domain free → See monitoring