warnwell

Warnwell / Checks

Domain reputation check

A hacked site or one bad mailing can get a domain blocked, and the owner is usually the last to know. Warnwell asks Cloudflare's 1.1.1.2 malware filter about each domain and links to the main spam list lookups.

  • Free
  • No sign-up
  • Up to 50 domains at once

01

What it checks

Cloudflare runs a public resolver, 1.1.1.2, that refuses to look up domains it knows host malware or phishing. Many homes, schools and offices use it, or a resolver like it. Warnwell asks it about each domain. A refusal shows as "Blocked as malware or phishing" in red, because people behind that filter cannot open the site or send mail to it.

A clean answer reads "Not on Cloudflare's malware filter". That is a hint, not a clean bill of health: browsers, mail filters and spam lists each keep their own lists.

02

Spam lists

Spamhaus DBL and SURBL decide whether mail that mentions your domain gets refused. Their terms do not allow a free service to query them on your behalf, so Warnwell does not. Each report has a "Check it yourself" link that opens the lookup for that domain on check.spamhaus.org and surbl.org.

We found one of our own domains on the Spamhaus list this way in October 2026. Nothing else had told us.

03

If a domain is listed

  1. Find the cause first: a hacked page, an old form that sends mail, a compromised mailbox. A delisting without a fix gets relisted.
  2. Ask for removal at the list that has it: Spamhaus and SURBL both have a form, and Cloudflare takes reports through its 1.1.1.2 feedback page.
  3. Run the check again a day later.
04

Questions

What is domain reputation?
How much mail filters, browsers and security resolvers trust a domain. It drops when the domain sends spam, hosts malware or phishing, or is very new.
Does Warnwell check IP blacklists?
No. It looks at the domain, not the IP addresses of your mail servers. MXToolbox and the lists' own sites check IPs.
Why is a brand-new domain flagged?
The renewal lamp says "Registered 3 days ago" because mail filters treat new domains with suspicion. That is normal for a launch and fades after a few weeks of clean mail.
05

Updated 20 Oct 2026.