Find the blacklist listing before your users find the bounce.

AbuseBox is a self-hosted monitor for the IPs and domains you run. It checks them on a schedule against 24 DNS blacklists, SSL and domain expiry, SPF, DKIM and DMARC, and uptime, then tells you what changed and why.

Install with Docker View on GitHub

MIT licensed, no telemetry. Runs with Docker Compose on amd64 and arm64.

Example report Sample data, not a live check

Target: 203.0.113.25
Checked: 24 blacklists, each verified against its test addresses

Listed on 2 of 24 blacklists

List	Status	Reason
zen.spamhaus.org	Listed	HIGHPBL: end-user range, listed by its ISP
b.barracudacentral.org	Listed	HIGHpoor sending reputation
bl.spamcop.net	Clear
ips.backscatterer.org	Clear

20 more lists answered clear and are not shown here.

A clean result you can trust

Ask Spamhaus through Google or Cloudflare DNS and it answers "not listed" or an error code for everything. Many tools show that as clean.

Try it: 127.0.0.2 is Spamhaus's test address and should always come back listed.

$ dig +short 2.0.0.127.zen.spamhaus.org @8.8.8.8
(nothing, which looks like "not listed")

Before AbuseBox trusts a blacklist, it asks about the list's test addresses. A list that refuses, rate-limits or times out shows as No answer, never as a false Clear. A dead list that starts listing everything is ignored.

127.0.0.2: Must be listed. If not, the list is refusing to answer.
127.0.0.1: Must not be listed. If it is, the list is listing everything.

What it checks

Add your IPs and domains once. AbuseBox re-checks them on a schedule, keeps a history of every check, and alerts you by email, Slack, Discord or webhook when something is listed, delisted, goes down or is about to expire.

Blacklists: 24 DNS blacklists, each listing decoded with its meaning and a severity.
AbuseIPDB: Abuse confidence score, reports, ISP and country for an IP, with your free API key.
SSL: Validity, issuer, expiry and the names the certificate covers.
WHOIS: Registrar, name servers and when the domain expires.
DNS: A, AAAA, MX, TXT, CNAME, NS, SOA and PTR records.
Email-Auth: SPF, DKIM and DMARC, graded A to F, plus DMARC report parsing.
Server-Status: DNS resolution, ports 80 and 443, HTTP status and response time.

AbuseBox dashboard: a status line saying three assets need action, the attention list, scheduler and blacklist history — The dashboard opens on what needs action, with the reason for each.

One asset's report: verdict, header fields and the blacklist table — Every asset gets a full report and a history of its checks.

The dashboard in dark mode — Light and dark themes.

Runs on your server

Three commands on any machine with Docker and Compose. Your asset list, check history and API keys stay in its database; only the lookups themselves leave it.

$ git clone https://github.com/bekkaze/abusebox.git
$ cd abusebox
$ docker compose up -d

Then open http://localhost:3000 and sign in with the default account from the README. Change its password right away.

To update later: docker compose pull && docker compose up -d. Configuration, the Spamhaus key for commercial use and running your own DNS resolver are covered in the README.