What a DNSBL is
A DNS blacklist (DNSBL, also RBL) is a list of IP addresses queryable over DNS, containing addresses associated with spam, attacks or misconfiguration. The receiving mail server reverses the IP, appends the list's domain and issues an A query. If an answer comes back, the IP counts as listed — the lookup takes milliseconds and runs on every inbound connection.
Consequences range from a spam point in the filter to outright rejection at the SMTP level. With Spamhaus ZEN, many large providers reject without any further evaluation. A listing is therefore the fastest way to lose your deliverability completely.
Which lists are queried
The sending IP is checked against 25 lists in parallel:
- Spamhaus ZEN — the single most important list, combining SBL, XBL and PBL
- SpamCop, Barracuda, SORBS and SORBS Spam
- UCEProtect Level 1 and Level 2
- PSBL, S5H, InterServer, DroneBL
- Mailspike and Mailspike Z, GBUdb
- abuse.ch and abuse.ch Combined
- SpamEatingMonkey and SEM Backscatter
- NordSpam, WPBL, INPS, NiX Spam (manitu)
- Blocklist.de, SpamRATS and a dedicated Axigen DNSBL
For each listing the returned answer code is shown. These codes carry meaning: with Spamhaus, for example, they distinguish a manually curated spam source (SBL) from a compromised machine (XBL) and from an address in an end-user network that should not be sending directly at all (PBL).
Not every list carries equal weight
Interpretation depends heavily on which list fired:
- Spamhaus, SpamCop, Barracuda — widely deployed, act immediately.
- UCEProtect Level 2 and 3 — list entire netblocks or autonomous systems because of what neighbours did. Such a listing often says little about you and is ignored by most receivers.
- PBL entries usually only mean the IP sits in a dynamic range. Anyone sending directly from there needs a relay anyway.
What matters is therefore less the number of listings than which list is firing.
What to do about a listing
Delisting without fixing the cause is pointless — most lists re-add the IP within hours. Work in this order:
- Find the cause: a compromised mailbox, an open relay, a script with a broken recipient list, or an infected machine on the network.
- Stop it: reset passwords, close the relay, introduce rate limits, flush the outbound queue.
- Request delisting — the process differs considerably between lists.
- Prevent recurrence: configure SPF, DKIM and DMARC properly, set up FCrDNS, monitor outbound volume.