DNS blacklists (DNSBL)

What it is

DNS blacklists (DNSBLs, also RBLs) are reputation databases queried over DNS. Receiving mail servers look up the connecting IP address, or domains found in messages, and reject or score mail that is listed.

A listing on a major list such as Spamhaus can block most of your outbound mail, so monitoring is important.

How it works

• For an IP 192.0.2.10 the receiver queries 10.2.0.192.<list zone>; an answer in 127.0.0.0/8 means listed. The return code encodes the reason.
• Domain lists (URIBL/DBL) are queried as <domain>.<list zone>.
• Reasons include spam traps hits, compromised hosts, open relays, dynamic/residential IP ranges and missing reverse DNS.
• Most lists offer a lookup page explaining the listing and a delisting form, once the cause is fixed.

Examples

127.0.0.2

NXDOMAIN

Common mistakes

• Requesting delisting before fixing the cause

  You will be relisted quickly. Find the compromised account, open relay or bad list first.

• Missing or generic reverse DNS

  Set a PTR record for sending IPs that resolves back to the same IP (FCrDNS).

• Ignoring low-impact lists

  Small lists matter less, but a listing often points at a real problem.

• Sending from shared or dynamic IPs

  Residential ranges are listed by policy; use a proper relay.