What are DNS blacklists?
DNS blacklists (DNSBL or RBL) are lists of IP addresses and domains that have sent spam or were advertised in spam. Receiving mail servers query them for every incoming message: the IP is reversed, appended to the list name and resolved via DNS. If an answer in the 127.0.0.x range comes back, the IP is listed and the message is rejected or flagged as spam.
The consequences of a listing are felt immediately: mail to clients does not arrive or lands in spam, often with a bounce naming the list. Because many receivers use the same lists, a single Spamhaus listing affects a large share of mail traffic.
Which lists the checker queries
There are hundreds of blacklists, but only a few that receivers actually use. The checker focuses on these:
- Spamhaus ZEN (zen.spamhaus.org): the most important list. Combines SBL (spam sources), XBL (infected machines) and PBL (dynamic address ranges that should not send mail).
- Spamcop (bl.spamcop.net): based on user reports; entries expire after 24 hours without new reports.
- Barracuda (b.barracudacentral.org): used by Barracuda appliances found in many companies.
- PSBL (psbl.surriel.com): Passive Spam Block List, lists addresses that hit spam traps.
- Spamhaus DBL and SURBL: domain lists. Here it is not the IP but the domain itself that is listed when it was advertised in spam.
How to read the result
For every IP the table shows the source (website or mail server) and the status per list. A listed mail server IP is critical because it affects delivery directly. A listed website IP is a warning: it does not disturb mail as long as the web server does not send, but points to a compromised system or a bad neighbour on shared hosting. The status unknown means the list refused the query, for example because Spamhaus blocks requests via public resolvers.
The checker queries the lists the way a mail server does. For the IP 203.0.113.10 the query is:
10.113.0.203.zen.spamhaus.org. IN A
; answer 127.0.0.2 to 127.0.0.11 = listed, NXDOMAIN = not listedDelisting: how to get off again
Before requesting delisting, the cause must be fixed, otherwise the IP is back on the list within hours. Typical causes are a hacked client account sending spam, an unprotected contact form, an open relay or a website with malware. Then use the form of the respective operator; the checker links it directly for every listed entry.
- Spamhaus: check.spamhaus.org shows the reason for the listing and offers removal. PBL entries can be removed yourself, SBL entries only with an explanation.
- Spamcop: entries expire automatically after 24 hours without new reports. No manual delisting needed.
- Barracuda: form with explanation, usually processed within 12 hours.
- PSBL: self-service delisting on the website, effective immediately.
- SURBL: the analysis page shows the reason; delisting after cleaning up the domain.
Monitor blacklists continuously
You usually learn about a listing from clients whose mail does not arrive. By then days have often passed. DomainWarn checks the mail server and website IPs of all client domains regularly against these lists and reports a listing immediately as an incident, including the delisting link.
Frequently asked questions
- My IP is listed on Spamhaus PBL, but I do not send spam.
- The PBL does not list spammers but address ranges from which, according to the ISP, no mail should be sent directly, such as DSL and mobile networks. For a mail server you need a static IP from a server network, or you send through your provider's smarthost.
- How long does delisting take?
- Spamhaus and PSBL usually take effect within minutes to an hour, Barracuda within half a day, Spamcop expires after 24 hours. Receivers with their own cache additionally need until the list TTL expires.
- Why does the checker not test IPv6 addresses?
- Most blacklists do not carry IPv6 addresses or only partially, and mail servers normally send over IPv4. The checker therefore limits itself to IPv4.