Which VPS provider has clean IPs? 360 fresh IPs tested across 12 providers (Nov 2026)

2026-11-12 · data from public, reproducible sources · by One IP · a re-test of the September 2026 audit, same method, new random draw (seed 20261112, zero IPs overlap the September sample)

Check your own IP

Most "best VPS" comparisons talk about CPU, RAM and price. Almost none of them talk about the thing that gets you into trouble after you buy: whether the IP range is clean. A cheap box with a poisoned IP costs you more in lost mail, blocked logins and refund cycles than the spec sheet ever saved you.

So I sampled IPs from the actual announced prefixes of 12 providers and measured them against public records. 360 fresh IPs, 30 per provider, fixed seed, reproducible. This is the monthly re-test of the September audit — and the headline this time is not about the providers. It is about the blocklists: 7 of the 11 lists I probed in September are dead now, and with them gone, 11 of 12 providers come back completely clean.

What I measured

• Reverse DNS (PTR) — whether the IP has a PTR record at all. Low PTR coverage means the provider is not managing its address space; it is a strong signal that mail from that range will be treated as suspicious.
• Blocklist status — 4 public DNSBLs still alive (UceProtect level 1, SpamCop, DroneBL, PSBL) out of 11 probed. A list only counts as alive if its SOA resolves and none of six control IPs (documentation ranges and public resolvers that no legitimate list should flag) is listed on it.
• RDAP registrant — whether the registered organisation actually matches the provider you think you bought from.

Reverse DNS: 0% to 100%, and the spread is the story

The range is 0% to 100%. That is not noise — it is policy. The Chinese cloud providers essentially do not set PTR records on their international ranges, which means if you buy an Alibaba or Tencent box for a mail server you are starting from the worst possible position. BandwagonHost, Hetzner, Contabo and DMIT manage reverse DNS properly.

Blocklists: the lists died, not the providers

One hit in 360 samples: BandwagonHost's 176.122.174.110 on DroneBL (127.0.0.8). Everything else is clean — on the four lists that are still alive.

That needs unpacking, because in September the same test found 47 hits. September's hits were 41 on SPFBL, 3 on S5H, 2 on HostKarma and 1 on DroneBL. Since then, SPFBL's domain is gone, S5H's domain is gone, HostKarma's nameservers do not answer, SpamRBL's and Unsubscore's domains are gone, Manitu's nameservers refuse queries, and Blocklist.de's nameservers refuse queries. Four lists survive: UceProtect level 1, SpamCop, DroneBL and PSBL.

The sharpest case is RackNerd. In September it was 25/30 listed — the worst result in the study — and all 25 hits were SPFBL. With SPFBL dead, RackNerd is 0/30. Nothing about RackNerd's network changed in the data; the judge left. The September ranking measured which lists were alive as much as which vendors were dirty, and a ranking that leans on one small list is a ranking of that list's opinion. That is why this re-test exists, and why the site's VPS cards now break the 11-way tie on PTR coverage instead of pretending the blocklists still separate these vendors.

The honest limits of this data

• 30 IPs per provider is a sample, not a census. A provider with a large network has more ranges than 30 IPs can cover.
• Blocklists are dynamic — and, as this round shows, they die. A clean result today does not promise a clean result tomorrow — this snapshot was taken in November 2026, against 4 surviving lists out of 11 probed.
• With 359 of 360 samples clean, the blocklist test barely separates vendors any more. The ranking breaks ties on PTR coverage, which is a management signal, not a cleanliness verdict.
• A clean blocklist does not mean ChatGPT or Claude will load. AI services maintain their own IP reputation that public DNSBLs do not measure. That is a separate test and I cover it separately.
• PTR coverage is a proxy for "does this provider manage its address space", not a deliverability score.
• RDAP lookups failed for 16 of 360 samples (LACNIC timeouts, mostly DMIT ranges); those rows record the failure instead of a fabricated value.

What to actually do with this

1. Before you buy, look up the specific IP you would be assigned. 2. If you are running mail, prioritise providers with high PTR coverage and low blocklist hits — Hetzner, Contabo, DMIT and BandwagonHost score well on both. 3. If you already have a box that is blocked, check whether the whole /24 is listed. If it is, changing IP is wasted effort; change provider instead.

You can check any IP here, no account needed: PureIP

The full dataset — every IP, every record, the seed and the method — is public domain (CC BY 4.0): vps-audit-2026-11.json. The sampler is scripts/collect-vps-audit.mjs in the site repo.