Blocklists, also known as spam blacklists and DNSBLs or RBLs, are databases used by email administrators to prevent unsolicited bulk email (spam) from reaching inboxes. These lists contain Internet Protocol (IP) addresses or domain names that have been identified as sources of spam, malware, or other malicious activity.
When an email server receives an incoming message, it can query a blocklist to determine if the sender is reputable. If the sender’s IP address or domain appears on the list, the email is typically rejected or flagged as spam.
History and Terminology
The concept of blocking email based on the sender’s reputation dates back to the early days of the commercial internet. The first notable implementation was the Real-time Blackhole List (RBL), created in 1997 by Paul Vixie. The term “RBL” is often used generically, though technically it refers to the specific system Vixie developed.
Today, the industry-standard term is DNSBL (Domain Name System Blocklist), reflecting the method used to query these databases. Administrators configure their mail transfer agents (MTAs) to check specific DNS zones that host these lists in real-time.
How Blocklists Work
The process of blocklisting relies on the Domain Name System (DNS). When a sending server attempts to deliver an email:
- The receiving server identifies the IP address of the connecting machine.
- The receiving server sends a DNS query to the blocklist provider (e.g.,
4.3.2.1.zen.spamhaus.org). - If the IP is listed, the blocklist provider returns a specific code (usually
127.0.0.x). - The receiving server rejects the connection, often sending a bounce message to the sender with an explanation.
Types of Blocklists
Blocklists are generally categorized by what they list and how they gather data:
- IP-based Blocklists: The most common type, listing the IP addresses of servers known to send spam or infected by botnets.
- Domain-based Blocklists (URI Blocklists): These list domain names found within the body of the email. Even if the sending IP is clean, an email may be blocked if it contains a link to a known spam site.
- Public vs. Private: Public lists (such as Spamhaus or SpamCop) are available for general use, often free for low volumes. Private lists are maintained internally by large email providers (like Gmail or Outlook) based on their proprietary data.
False Positives and Delisting
A significant criticism of blocklists is the potential for false positives, where legitimate email is blocked because a shared IP address was abused by a different user, or a server was temporarily compromised.
Most reputable blocklist operators provide a delisting process. Administrators can submit a request to have their IP removed from the list after proving they have resolved the underlying security issue (such as securing an open relay or removing malware).
Is My Website Okay allows you to check whether your website has been added to these types of blacklists, so you can take action and ask for its removal before it affects your business. Sign up for a free account to try it out!