To be blacklisted is to be on a list that other people use to turn you away. For an IP address or a domain, it means a blocklist operator has flagged it as a source of spam, malware, or abuse, and every mail server, spam filter, or DNS resolver that consults that list will act on the flag. A listed mail server IP gets its messages rejected or sent to junk. A listed domain gets filtered wherever it shows up in a message, and on some networks the website behind it stops resolving. The flag can come from spam the list caught from that address, from malware on the host, or simply from the address sitting in a range that shouldn't send mail directly.
What Is an RBL?
An RBL is a blocklist that mail servers query in real time, while deciding whether to accept a message. The name comes from the first one: the Real-time Blackhole List, which Paul Vixie's Mail Abuse Prevention System (MAPS) started in 1997 as a BGP routing feed. Eric Ziegast then rebuilt it to answer over DNS. Almost every public list still works that way, because every mail server already has a resolver and answers get cached.
| Term | What it means |
|---|---|
| Blacklist, blocklist, denylist | The general idea: a list of addresses to refuse |
| RBL | Real-time Blackhole List; now used for any of these lists |
| DNSBL | A blocklist published as a DNS zone, which is nearly all of them |
| URIBL, RHSBL | A DNSBL that lists domain names |
How a Blacklist Lookup Works
A DNSBL is just a DNS zone. To ask whether an IPv4 address is listed, reverse its four octets, append the list's zone, and look up an A record. Checking 192.0.2.10 against SpamCop means querying 10.2.0.192.bl.spamcop.net. NXDOMAIN means not listed. An answer in 127.0.0.0/8 means listed, and the TXT record for the same name usually says why.
RFC 5782, which documents how these lists work, says every IPv4 list must carry a test entry for 127.0.0.2 and must never list 127.0.0.1. That gives you both answers on demand:
$ dig +short 2.0.0.127.bl.spamcop.net
127.0.0.2
$ dig +short TXT 2.0.0.127.bl.spamcop.net
"Blocked - see https://www.spamcop.net/bl.shtml?127.0.0.2"
$ dig 1.0.0.127.bl.spamcop.net | grep status
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 37578
The value of the A record is a code. Lists that bundle several datasets use it to say which one fired: Spamhaus ZEN answers 127.0.0.2 for a manual SBL listing, 127.0.0.4 for a compromised host on the XBL, and 127.0.0.10 or 127.0.0.11 for the PBL. Our walkthrough of reading a Spamhaus listing maps every code to who has to file the removal.
IPv6 addresses are reversed one hex nibble at a time, all 32 of them. Domain lists skip the reversal, since the name is already the key:
IPv6: 2001:db8::25
query: 5.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.dnsbl.example.net
domain: example.com
query: example.com.dbl.spamhaus.org
One trap catches a lot of homemade checkers. Spamhaus won't answer queries that arrive through a public or open resolver, and it says so with an error code that sits in the same 127.x space as a real listing:
$ dig +short 2.0.0.127.zen.spamhaus.org
127.255.255.254
$ dig +short TXT 2.0.0.127.zen.spamhaus.org
"Error: open resolver; https://check.spamhaus.org/returnc/pub/203.0.113.53/"
Spamhaus reserves 127.255.255.0/24 for these errors. Read every 127.x answer as "listed" and every address you check looks blacklisted. Postfix's documentation gives the same advice: keep DNSBL queries off public and ISP resolvers.
The Main Kinds of Blacklists
Hundreds of lists are published, and they don't all measure the same thing. What a list is built to catch tells you what a listing on it means.
| Kind | What gets listed | Examples |
|---|---|---|
| Spam-source IP lists | IPs seen sending spam or hitting spamtraps | Spamhaus SBL and CSS, SpamCop, Barracuda |
| Compromised-host lists | IPs running malware or botnet code | Spamhaus XBL |
| Policy lists | Ranges that shouldn't send mail straight to MX hosts, like residential broadband | Spamhaus PBL |
| Domain and URI lists | Domains in the sender address or in links in the body | Spamhaus DBL, SURBL, URIBL |
| DNS security filters | Domains and IPs tied to malware or phishing, blocked at the resolver | Quad9, OpenDNS, Cloudflare's filtered resolvers |
| Mailbox provider lists | Whatever the provider decides | Gmail and Microsoft's internal reputation systems |
The evidence varies too. SpamCop lists an IP when its users and spamtraps receive enough spam from it; a spamtrap is an address that never signed up for anything, so whatever reaches it is unsolicited. The Spamhaus SBL is curated by people. Policy listings accuse no one: they mark address space that's meant to relay through a provider.
Moving to a clean IP does nothing for a listed domain, which is why domain-based blocklists need watching on their own. Mailbox provider lists can't be queried at all; the only views into them are bounce text and the providers' postmaster tools, Microsoft SNDS and Google Postmaster Tools.
What a Listing Does to Your Mail
Each receiver decides what a listing is worth. Some reject outright during the SMTP conversation. A common Postfix setup:
smtpd_recipient_restrictions =
permit_mynetworks,
reject_unauth_destination,
reject_rbl_client zen.spamhaus.org=127.0.0.[2..11],
reject_rbl_client bl.spamcop.net,
permit
From the sending side, that rejection shows up in your mail log as a hard bounce, with the list's name in it:
postfix/smtp[18231]: 4XkP2r1QbZz9t: to=<jane@example.net>, relay=mx.example.net[198.51.100.7]:25,
delay=0.9, dsn=5.7.1, status=bounced (host mx.example.net[198.51.100.7] said: 554 5.7.1 Service
unavailable; Client host [203.0.113.25] blocked using bl.spamcop.net; Blocked - see
https://www.spamcop.net/bl.shtml?203.0.113.25 (in reply to RCPT TO command))
Other receivers weigh lists against each other. With Postfix's postscreen, this config blocks an IP listed on Spamhaus alone, or on SpamCop and Barracuda together, but lets through an IP listed on only one of those two:
postscreen_dnsbl_action = enforce
postscreen_dnsbl_threshold = 3
postscreen_dnsbl_sites =
zen.spamhaus.org=127.0.0.[2..11]*3,
bl.spamcop.net*2,
b.barracudacentral.org*2
Content filters do the same thing at a finer grain, adding points to a spam score for each list hit. Put together, the effect depends on what's listed and who's checking:
| What's listed | What happens |
|---|---|
| Sending IP, on a list the receiver rejects on | 5xx bounce; the message never arrives |
| Sending IP, on a list the receiver scores | Accepted, but more likely to land in junk |
A domain in your From: or your links |
Filtered no matter which IP sends it |
| A domain on a DNS security filter | Your site and links don't resolve for anyone on that resolver |
| An IP on a mailbox provider's internal list | Bounces or junking at that provider only |
A listing on a list that few receivers consult may cost you nothing you can measure.
Why Clean Senders Get Listed
Most listings land on people who never meant to send spam. The lists record what came from the address and leave intent out of it:
| What happened | What ends up listed |
|---|---|
| A mailbox password got phished and the account started sending | Your outbound mail server IP |
| A contact form with no rate limit got used to mail strangers | Your web server or mail relay IP |
| An outdated CMS plugin got exploited to host a phishing page | Your domain, on domain lists and DNS filters |
| A customer on a shared platform mailed a purchased list | The shared IP, for every customer on it |
| An MTA was left open as a relay | The server's IP |
| A desktop picked up malware that sends spam | Your office's public IP, on compromised-host lists |
The common blacklist triggers post goes through the patterns that get legitimate senders listed most often.
How to Find Out You're Listed
The slowest way is from your own bounces. If you run Postfix, the evidence is already in the log:
$ grep -E 'status=(bounced|deferred)' /var/log/maillog | grep -iE 'blocked using|blocklist|blacklist|listed'
By the time that grep returns anything, mail is already lost, and a list that only junks your mail never shows up there at all.
Faster is to ask the lists. A few lines of shell will do it, as long as the script tells a refusal apart from a listing:
#!/bin/sh
# usage: ./rblcheck.sh 203.0.113.25
rev=$(echo "$1" | awk -F. '{print $4"."$3"."$2"."$1}')
for zone in zen.spamhaus.org bl.spamcop.net b.barracudacentral.org; do
answer=$(dig +short "$rev.$zone" A | head -n 1)
case "$answer" in
"") echo "$zone: not listed" ;;
127.255.255.*) echo "$zone: query refused ($answer)" ;;
*) echo "$zone: LISTED ($answer)" ;;
esac
done
Run against the test address from a machine behind a public resolver:
$ ./rblcheck.sh 127.0.0.2
zen.spamhaus.org: query refused (127.255.255.254)
bl.spamcop.net: LISTED (127.0.0.2)
b.barracudacentral.org: LISTED (127.0.0.2)
Our free blacklist check does the same across the major lists, for IPs and domains, without the resolver problem. Either way it's a snapshot. The listing that hurts is the one that appears while nobody's looking.
How to Get Off a Blacklist
Work through it in this order:
- Find the exact list and code. The
TXTrecord or the bounce text names the list and usually links to its lookup page. - Fix the cause. Reset the phished password, clean the infected host, close the relay, pull the plugin. Request removal before this and you'll be relisted, and some lists slow down repeat requests.
- Request removal, or wait. Use the list's own site. Many lists expire entries on their own once the abuse stops.
- Check again after removal. Delisting can take hours to reach every mirror, and a relisting says step 2 wasn't finished.
How removal works depends on the list:
| List | How removal works |
|---|---|
| SpamCop | Automatic, 24 hours after the last spam report |
| Spamhaus SBL | Requested by the network operator that controls the IP range |
| Spamhaus CSS and XBL | Self-service through Spamhaus, after the cause is fixed |
| Spamhaus PBL | Send through your provider's relay, or file an exclusion if it's a static IP running a real mail server |
| UCEPROTECT | Every level expires on its own (Level 1 after 7 days without spam); express removal is sold but never required |
| Domain lists (DBL, SURBL, URIBL) | Clean up the domain, then request removal from each list |
Spamhaus doesn't charge for removal, and a page asking you to pay to delist from it is a scam. Our delisting checklist covers the request itself: what to include, and the mistakes that get a request ignored.
The gap between getting listed and finding out is where the damage happens. Generator Labs Blacklist Monitoring checks your IPs, domains, and CIDR ranges against 90+ blocklists, DNS security filters, and threat sources, and alerts you by email, Slack, SMS, or webhook when a listing appears or clears. The free plan covers one IP or domain with no time limit.
