DNS Blocklist (DNSBL / RBL)

A DNS blocklist (DNSBL), historically called a realtime blackhole list (RBL), distributes a list of IP addresses or domains over the DNS protocol. A mail server queries the list during the SMTP connection and decides whether to accept the message before the body has even been transferred.

Using DNS as the transport is what makes this practical: the answer is cached, the query costs a few milliseconds, and no list has to be downloaded or kept in sync. It is the mechanism behind almost all IP blacklisting in production mail systems.

How does a DNSBL query work?

The IP address is reversed octet by octet and prefixed to the list’s zone. To check 192.0.2.25 against zen.spamhaus.org:

$ dig +short 25.2.0.192.zen.spamhaus.org A
127.0.0.4

An answer means listed. NXDOMAIN — no output above — means not listed. The address returned is not routing information; it is a code that says why, and every list defines its own:

Most lists also publish a TXT record explaining the listing and linking to the delisting page:

$ dig +short 25.2.0.192.zen.spamhaus.org TXT
"https://check.spamhaus.org/query/ip/192.0.2.25"

Which kinds of list exist?

• IP blocklists rate the connecting address. This is the classic case, and the one that fires before any content is examined.
• Domain blocklists (DBL) and URI lists (URIBL, SURBL) rate domains found in the message body. They catch a spam run that rotates sending IPs but keeps reusing the same payload domain.
• Right-hand-side lists rate the sender’s domain rather than its IP.
• Whitelists, queried the same way, mark known-good senders so that later checks can be skipped.
• Policy lists such as PBL are not reputation at all — they simply declare which address ranges are not supposed to deliver mail directly, which is why a consumer connection ends up listed on one.

How is a DNSBL used in a mail server?

In Postfix, as a restriction in the SMTP conversation:

smtpd_recipient_restrictions =
    permit_mynetworks
    permit_sasl_authenticated
    reject_unauth_destination
    check_client_access hash:/etc/postfix/rbl_allow
    reject_rbl_client zen.spamhaus.org
    permit

Order matters. The whitelist lookup sits above the blocklist so that an important sender is never rejected by a third-party listing — see whitelisting hosts, IP addresses and networks in Postfix.

Rspamd queries lists as scored symbols rather than hard rejects, so a listing contributes to a total rather than deciding on its own. Exim uses dnslists in an ACL.

Combining a public list with a local one built from your own logs is usually more effective than either alone; the local list catches the repeat offenders specific to your users, as described in blacklisting single hosts, IP addresses and even networks in Postfix.

What should you watch out for?

• Query limits on free lists. Spamhaus and others cut off high-volume use of their public resolvers, and a blocked lookup can return a wildcard answer that makes everything appear listed. If your rejection rate suddenly hits 100 %, check this first.
• Dead lists that wildcard. Several once-popular zones were shut down and later began answering positively for every query. njabl.org and msrbl.net are the classic examples — a configuration still referencing them will reject all mail.
• Your own resolver. Query through a local caching resolver, not a public one. Public resolvers are shared, and lists rate-limit them aggressively.
• Listing policy differs wildly. Some lists are conservative and evidence-based; others list entire ranges on thin grounds and are painful to get removed from. Evaluate a list before you reject on it.
• Reject, do not accept-then-bounce. Rejecting at the connection or at RCPT TO avoids generating backscatter.

How do you know whether a list is working?

Count the hits per list over time. If one list contributes almost nothing, it is costing you a DNS lookup on every connection for no benefit; if one suddenly contributes everything, it has probably started wildcarding.

Graphing this is straightforward with the Munin plugin described in monitoring your local Postfix blacklist with Munin, which counts rejections per list from the mail log and lets you compare your own list against the public ones side by side.