Most people picture a blocklist as a list of bad IP addresses, and the connecting mail server either is or is not on it. Domain-based blocklists work on a different signal entirely: they list domains, and a filter checks them against the domains found inside your message. This distinction matters enormously in practice, because it means changing your sending infrastructure, moving to a fresh IP, switching providers, does nothing at all if the domain in your links or your From: address is what got listed. The reputation follows the name, and the name travels with the message wherever you send it from.
What Gets Checked, and Where
When mail arrives, a filter extracts every domain it can see and looks each one up against domain blocklists. That includes far more than the sender:
From: news@example.com ← sender domain
Reply-To: support@example.com ← reply domain
body: https://links.example.net ← every URL host in the body
https://track.vendor.io ← including tracking and CDN domains
That last category is the one that surprises senders. A link shortener, a tracking domain, or a hosting domain embedded in your template can be the thing that trips a domain blocklist, even when your own sending domain is spotless. You inherit the reputation of every domain you reference.
The Major Domain Blocklists
Three sources dominate, and they overlap in purpose but differ in scope and how they build their data.
| Blocklist | Query zone | Lists |
|---|---|---|
| Spamhaus DBL | dbl.spamhaus.org |
Domains seen in spam: sender domains, URL domains, and compromised legit domains |
| SURBL | multi.surbl.org |
Domains appearing in the body of spam and phishing messages |
| URIBL | multi.uribl.com |
URI host domains extracted from spam message bodies |
Spamhaus's DBL is the broadest, and unusually it will list otherwise-legitimate domains that have been compromised or abused, alongside domains registered for spam. That means a hacked WordPress site or a hijacked subdomain of a real company can land on the DBL until it is cleaned up.
How a Lookup Actually Works
Like IP-based DNSBLs, these are queried over DNS. The filter reverses nothing (domains are already the key) and appends the zone, then reads the A record response as a coded answer:
# is example.com listed in the Spamhaus DBL?
dig +short example.com.dbl.spamhaus.org
A response in the 127.0.1.x range means listed, with the final octet encoding the reason:
127.0.1.2 → spam domain
127.0.1.4 → phishing domain
127.0.1.5 → malware domain
127.0.1.6 → botnet C&C domain
(no answer) → not listed
Reading the return code tells you why you are listed, which shapes the remediation. A phishing listing on a subdomain points at a compromised host; a spam listing on your main domain points at your own sending practices.
Why the "Just Move IPs" Reflex Fails
When deliverability drops, the common instinct is to blame the IP and get a new one. Against a domain blocklist that is wasted effort. Consider the two failure modes side by side:
IP blocklist hit: new IP → problem gone (until the new IP earns a listing too)
Domain blocklist hit: new IP → problem unchanged, domain still listed everywhere
Because the domain is portable, the only real fix is to address why the domain was listed and then request delisting from each source. If the listing is on a domain you reference but do not control, a tracking or shortener domain, the fix may be switching to a different one entirely.
You Have to Watch Both Kinds
The reason domain blocklists are easy to miss is that a tool built only for IP checks will report your IPs as clean while your mail keeps getting filtered on a listed domain. Effective monitoring covers IPs, domains, and the URI hosts in between. Generator Labs blacklist monitoring checks IPs, domains, and CIDR ranges against hundreds of data sources, including domain and URI sources, so a DBL or SURBL listing on your sending or link domain shows up as an alert before it turns into a slow, unexplained decline in delivery. For a one-off lookup while you investigate, the blacklist check at mrdns.com tests an IP or a domain against major sources on the spot. Understanding the broader split between the two signals is worth the read: our piece on IP reputation versus domain reputation covers why receivers increasingly weight the domain. Start monitoring.