Mail transport & reputation

What is Blocklist (DNSBL)? DNS-based blocklists explained

DNS blocklists (DNSBL) list IP addresses and domains that have been seen sending spam. Many mail servers reject or spam-filter mail from listed senders.

How Blocklist (DNSBL) works

Mail servers query blocklists via DNS: for the IP 203.0.113.25, for example, the name 25.113.0.203.zen.spamhaus.org. If an address such as 127.0.0.2 comes back, the IP is listed; no answer means not listed.

IP lists such as Spamhaus ZEN, SpamCop or Barracuda cover sending servers. Domain lists such as Spamhaus DBL or SURBL cover domains that appear in spam messages or links.

Common causes are hacked mailboxes, contact forms abused for spam, newsletters without consent or an IP address shared at the hosting provider. Fix the cause first, then request removal at the respective list; some lists remove entries automatically after a while.

Example

$ dig +short 25.113.0.203.zen.spamhaus.org
127.0.0.2

An answer in the 127.0.0.x range means the IP is listed. No answer (NXDOMAIN) means it is not listed.

Common mistakes

Requesting removal before the cause is fixed – the IP is listed again right away.
Missing a listing of the web server because only the mail server was checked.
Missing reverse DNS, which leads to entries on policy lists.

How the Domain Trust Check rates Blocklist (DNSBL)

Criterion “Blocklists & reputation” (weight 3 of 5): Looks up mail and web server IPs on Spamhaus ZEN, SpamCop, Barracuda, PSBL, Mailspike and UCEPROTECT, and the domain on Spamhaus DBL and SURBL.

Standard: RFC 5782