ES 
EN 
A catch-all domain can look perfectly healthy in your control panel and still get rejected at the recipient’s edge. The usual culprit is not the domain itself but the mail exchanger behind it. Spamhaus DBL judges the domain name, ZEN judges the IP that carries the SMTP conversation, and those are two separate verdicts that have to be checked separately. If you only look at one, you are flying half blind.
Two different checks that people keep collapsing into one
Spamhaus DBL is a domain-based blocklist. You query it with the domain name, and it answers with a return code that tells you whether that name is listed and for what reason. ZEN is an IP-based composite list (SBL, XBL, PBL and CSS under one zone). You query it with a reversed IP address. These are not interchangeable. A domain with a pristine A record can sit on an MX host whose IP is deep in XBL because of a compromised relay two racks over, and the receiving MTA will still refuse the message at the SMTP banner.
That separation matters enormously when you are running bulk infrastructure. Most providers hand you a catch-all inbox on a shared domain, and the MX for that shared domain is a shared IP. Your slice of the reputation is whatever the worst tenant did last week. A clean domain on a listed shared MX IP fails verification at plenty of targets, and no amount of warm-up on your side fixes it, because the listing is not yours to clear.
The practical answer is to instrument both layers independently. Query the A record of the sending domain against DBL. Query the resolved MX host IPs against ZEN. Log both. Alert on both. Treat a ZEN hit on an MX IP as a hard stop even when the domain reads clean, because the SMTP transaction will not care that your half of the equation was fine.
The exact lookup sequence to run
Start with the domain. Resolve the A record for the domain you actually put in the From header and in the HELO, then check that name against DBL. A hit here is usually about the domain’s history: a prior owner, a spam campaign, a wildcard email setup that got abused. Domain replacement support exists for exactly this case, and swapping the domain is often faster than waiting out a listing.
Then resolve the MX. Pull the MX records for the domain, resolve each host to its A and AAAA records, and reverse the octets before querying ZEN. Do this for every MX, not just the first one in priority order, because outbound routing and inbound verification do not always agree on which host gets hit. If any MX IP returns a ZEN code, you have a deliverability problem that the domain check will never show you.
- Resolve the sending domain’s A record and query Spamhaus DBL with the domain name.
- Resolve every MX host to its IPv4 and IPv6 addresses, reverse the octets, and query ZEN.
- Check the HELO name separately, since some receivers validate it against DBL too.
- Record the return code, not just pass or fail, so you can tell a PBL listing from an XBL one.
- Re-run the whole sequence after any infrastructure change, including a new subdomain or a domain swap.
Run this on a schedule, every few hours, and keep the results. A single snapshot tells you nothing about trend. What you want is the moment a listing appears, so you can pull the affected domain out of rotation before a registration bot burns through a thousand signups on a dead IP.
Why shared MX IPs poison otherwise clean domains
Shared hosting economics push everyone onto the same handful of mail exchangers. That is fine until one customer’s compromised WordPress install starts blasting. The IP lands in XBL, and suddenly every domain on that MX is suspect at the receiving end, including yours. Your domain reputation is spotless and it does not matter one bit.
This is the failure mode that catches people running GSA Search Engine Ranker, RankerX or Xrumer at volume. The tools push account registration and email verification through a catch-all inbox, and the inbox lives on a shared domain with a shared MX. cachall offers additional context worth reviewing. When that MX IP gets listed, verification emails start bouncing or silently landing in a quarantine, and the campaign stalls with no obvious error. People spend hours blaming the email scraper when the actual problem is an IP they do not control.
The mitigation is to know your MX IPs by heart and to have a fallback ready. Services that provide catch-all email addresses on infrastructure you can swap are worth more than a marginally cheaper option on a permanently dirty shared IP. When you check ZEN and see a hit, you want a domain replacement path that takes minutes, not a support ticket that takes days.
Blacklist monitoring belongs in the same dashboard as your bounce rates. If ZEN shows a listing on an MX IP the same morning your verification rate drops 30 percent, you have your answer before you start debugging SMTP logs. Domain reputation and IP reputation move on different clocks, and the IP clock is usually the one that ruins your day.
Building a monitoring loop that catches both layers
A workable loop is boring and cheap. Cron job resolves the A record and the MX set, fires the DNSBL queries, writes the return codes to a table, and pages you on any non-empty answer. Spamhaus publishes the return codes, so you can map them to human-readable reasons and route alerts accordingly. A PBL hit means the IP is a residential or dynamic range and should never be sending mail at all; an XBL hit means exploitation; an SBL hit means a known spam source.
Pair the DNSBL checks with SPF, DKIM and DMARC validation on a test message, because a listed IP will often fail authentication checks that depend on the sending host matching the envelope. Send a probe through the catch-all inbox to a seed address at a major provider and watch the SMTP response. A 550 with a Spamhaus URL in the body is the clearest possible confirmation that the IP layer, not the domain layer, is your problem.
Keep a rotation of domains ready. Anonymous catch-all email domains on fresh .xyz or .one names cost little and give you somewhere to move when a listing appears. Services that accept crypto payments in USDT or USDC over TRC-20, BEP-20 or Polygon and require zero KYC let you spin up replacements without dragging identity paperwork into the loop. That matters when you are running dozens of domains across tools and need to swap one at 2am without a verification queue.
Test the whole path end to end before you commit volume. A 3-day free trial on a catch-all email provider is enough to run the DBL and ZEN checks, send probe messages through Thunderbird or your email client of choice, and confirm POP3 and IMAP access works for the verification workflow. If the provider monitors DNSBL blacklists on your behalf, compare their alerts against your own queries for a week. You want to know whether they catch MX IP listings or only domain listings, because the gap between those two is where campaigns die.
Document the MX IPs for every domain you run and recheck them whenever the provider changes infrastructure. Shared MX hosts get renumbered, and a quiet migration can move you onto a range with a bad history overnight. The domain A record will still read clean, the DBL query will still pass, and your verification emails will still fail. That is the trap this whole exercise exists to close.
Set the loop running today: one script, two query types, an alert on anything non-empty. Check the domain against DBL, check every MX IP against ZEN, and treat either hit as a reason to act. Keep a spare domain and a crypto-funded replacement path warm so a listing costs you an afternoon rather than a week. The infrastructure is only as good as the last check you actually ran, so run both, and run them often.
