This snapshot of Tor exit node retention measured on October 10, 2026 compared stopped relays with the exit-address list. In that run, 8 of 8 relays in the 6 to 24 hour bucket and 15 of 15 in the 24 to 48 hour bucket were still listed; 1 of 282 in the over-48-hour bucket was still listed. This is a single observation, not a guaranteed retention period or a security policy.
Tor exit node retention across time windows
Tor exit node retention describes whether a relay address appeared in the exit-address snapshot after publishing stopped. One measurement run on October 10, 2026 checked 653 stopped relays by elapsed time; one run cannot establish a general retention period. The under 6 hours bucket covers the most recent hours, which change between measurements.
| Time Since Relay Stopped | Relays Tracked | Relays Still Listed | Retention Rate |
|---|---|---|---|
| Under 6 hours (most recent) | 348 | 345 | 99.14% |
| 6 to 24 hours | 8 | 8 | 100.00% |
| 24 to 48 hours | 15 | 15 | 100.00% |
| Over 48 hours | 282 | 1 | 0.35% |
How Tor consensus updates and reputation decay work
The Tor network relies on directory authorities that vote hourly to produce a network status consensus document. This consensus publishes the active list of relays alongside their assigned flags, such as Running, Valid, Guard, and Exit. When a relay operator shuts down their node or changes their exit policy, directory authorities remove the Exit flag in subsequent consensus updates.
Web firewalls and fraud prevention systems ingest the Tor exit list to protect web services from automated abuse. However, if a security platform caches exit lists without frequent updates, an IP address previously used by a Tor exit node can remain flagged after the relay has ceased operation. Our analysis of 1 measurement run on October 10, 2026 shows that for relays stopped between 6 and 48 hours ago, 100.00% (23 of 23) remain listed in the Tor exit list. After 48 hours, 99.65% (281 of 282) of stopped relays are fully purged from the Tor exit list.
False-positive mitigation and IP reassignment dynamics
Because residential and commercial ISPs frequently rotate dynamic IP addresses, a subscriber who receives a newly assigned IP address may inherit an address recently used by a temporary Tor exit node. If threat intelligence feeds maintain unverified blocklists without automated expiration, that subscriber may experience unexpected access restrictions or CAPTCHA challenges.
This single snapshot does not establish when another list will remove an address. It does not support a guaranteed expiration window or protection claim.
Comparing reputation lists and DNSBL expiration times
Different network security systems implement varying cache policies for Tor exit addresses. Real-time API checkers query official Tor consensus endpoints directly, reflecting status changes within one hour. In contrast, static DNS-based blocklists (DNSBLs) and local IP caches often apply fixed Time-To-Live (TTL) expiration schedules.
In the October 10, 2026 snapshot, 8 of 8 relays in the 6 to 24 hour bucket and 15 of 15 in the 24 to 48 hour bucket were listed. In the over-48-hour bucket, 1 of 282 was listed. These results describe that run only.
Monitoring Tor relay bandwidth metrics and uptime stability
Directory authorities assign consensus bandwidth weights to relays based on active performance measurements. Relays that maintain high uptime and fast throughput receive higher consensus weight fractions, increasing the probability that client circuits will choose them for anonymous browsing.
When a relay experiences temporary network instability or packet loss, directory authorities lower its bandwidth weight before stripping the Running flag entirely. This gradual weighting reduction ensures that Tor clients route traffic around degrading nodes before an exit relay fully disappears from published consensus documents.
Directory authority voting and consensus protocols
Tor directory authorities reach consensus using a two-phase voting protocol. Every hour, authority servers measure relay bandwidth, test reachability, and exchange signed votes containing active relay flags. A relay must receive votes from a majority of active directory authorities to gain the Exit flag in the published consensus.
When a relay operator stops their node, directory authority health checks fail within 1 to 2 voting cycles. Once the majority of authorities drop the Running and Exit flags, the node is eventually excluded from the published Tor exit list as directory data changes; this measurement does not show a fixed 48-hour retention window.
How we measured Tor exit node listing retention
We recorded one snapshot on October 10, 2026 at 06:55:44 UTC. It compared the 1,205 exit addresses in the fetched list with Onionoo relay last-seen times and counted stopped relays by age bucket. The result is limited to this run and these sources.
Among stable offline buckets (6 hours and older), relays stopped between 6 and 24 hours ago (8 relays) and between 24 and 48 hours ago (15 relays) were 100.00% still listed in the Tor exit list. For relays stopped over 48 hours ago (282 relays), only 1 relay remained listed (0.35%), while 281 relays (99.65%) were cleared. The under 6 hours bucket (348 relays tracked, 345 still listed) reflects recent hours that change between measurements.
Impact on website blocking and IP reputation lists
Because residential internet service providers assign dynamic IP addresses to home subscribers, an IP address released by a former Tor relay operator may be reassigned to an ordinary household within days. If security systems maintain stale listings indefinitely, innocent users face unexpected CAPTCHAs or blocked sessions.
This snapshot cannot set an expiration interval for other blocklists or establish protection against active exit traffic.
Checking Tor exit status and next steps
If you experience persistent security blocks or want to verify whether your current public IP address is listed as an active or recent Tor exit relay, test your connection with our free proxy, VPN, and Tor check tool. You can also inspect your connection's ISP, ASN, and geographic routing using our IP lookup tool. To learn more about identifying proxy traffic and verifying network security, read our guides on how to check if a VPN is working and proxy vs VPN differences.