---
title: "DNS Blocklist (DNSBL / RBL)"
description: "A DNSBL, also called RBL, publishes lists of IP addresses or domains over DNS so mail servers can check a sender's reputation during the SMTP connection."
url: "https://mailmum.io/glossary/dns-blocklist-dnsbl/"
---

# DNS Blocklist (DNSBL / RBL)

A DNS blocklist (DNSBL), historically called a realtime blackhole list (RBL),
distributes a list of IP addresses or domains over the DNS protocol. A mail
server queries the list during the SMTP connection and decides whether to accept
the message before the body has even been transferred.

Using DNS as the transport is what makes this practical: the answer is cached,
the query costs a few milliseconds, and no list has to be downloaded or kept in
sync. It is the mechanism behind almost all
[IP blacklisting](https://mailmum.io/glossary/ip-blacklisting/) in production mail systems.

## How does a DNSBL query work?

The IP address is reversed octet by octet and prefixed to the list's zone. To
check `192.0.2.25` against `zen.spamhaus.org`:

```sh
$ dig +short 25.2.0.192.zen.spamhaus.org A
127.0.0.4
```

An answer means listed. `NXDOMAIN` — no output above — means not
listed. The address returned is not routing information; it is a code that says
*why*, and every list defines its own:

| Answer | Typical meaning on Spamhaus ZEN |
| --- | --- |
| `127.0.0.2` | SBL, direct spam source |
| `127.0.0.3` | CSS, snowshoe spam |
| `127.0.0.4`–`127.0.0.7` | XBL, exploited machine or open proxy |
| `127.0.0.10`, `127.0.0.11` | PBL, address space that should not send mail directly |

Most lists also publish a TXT record explaining the listing and linking to the
delisting page:

```sh
$ dig +short 25.2.0.192.zen.spamhaus.org TXT
"https://check.spamhaus.org/query/ip/192.0.2.25"
```

## Which kinds of list exist?

* **IP blocklists** rate the connecting address. This is the classic case, and
  the one that fires before any content is examined.
* **Domain blocklists (DBL) and URI lists (URIBL, SURBL)** rate domains found in
  the message body. They catch a spam run that rotates sending IPs but keeps
  reusing the same payload domain.
* **Right-hand-side lists** rate the sender's domain rather than its IP.
* **Whitelists**, queried the same way, mark known-good senders so that later
  checks can be skipped.
* **Policy lists** such as PBL are not reputation at all — they simply
  declare which address ranges are not supposed to deliver mail directly, which
  is why a consumer connection ends up listed on one.

## How is a DNSBL used in a mail server?

In Postfix, as a restriction in the SMTP conversation:

```txt
smtpd_recipient_restrictions =
    permit_mynetworks
    permit_sasl_authenticated
    reject_unauth_destination
    check_client_access hash:/etc/postfix/rbl_allow
    reject_rbl_client zen.spamhaus.org
    permit
```

Order matters. The
[whitelist](https://mailmum.io/glossary/ip-whitelisting/) lookup sits above the blocklist so that
an important sender is never rejected by a third-party listing — see
[whitelisting hosts, IP addresses and networks in
Postfix](https://mailmum.io/posts/whitelisting-hosts-ip-addresses-and-even-networks-in-postfix/).

Rspamd queries lists as scored symbols rather than hard rejects, so a listing
contributes to a total rather than deciding on its own. Exim uses `dnslists` in
an [ACL](https://mailmum.io/glossary/access-control-list-acl/).

Combining a public list with a local one built from your own logs is usually
more effective than either alone; the local list catches the repeat offenders
specific to your users, as described in
[blacklisting single hosts, IP addresses and even networks in
Postfix](https://mailmum.io/posts/blacklisting-single-hosts-ip-addresses-and-even-networks-in-postfix/).

## What should you watch out for?

* **Query limits on free lists.** Spamhaus and others cut off high-volume use of
  their public resolvers, and a blocked lookup can return a wildcard answer that
  makes *everything* appear listed. If your rejection rate suddenly hits 100 %,
  check this first.
* **Dead lists that wildcard.** Several once-popular zones were shut down and
  later began answering positively for every query. `njabl.org` and
  `msrbl.net` are the classic examples — a configuration still referencing
  them will reject all mail.
* **Your own resolver.** Query through a local caching resolver, not a public
  one. Public resolvers are shared, and lists rate-limit them aggressively.
* **Listing policy differs wildly.** Some lists are conservative and
  evidence-based; others list entire ranges on thin grounds and are painful to
  get removed from. Evaluate a list before you reject on it.
* **Reject, do not accept-then-bounce.** Rejecting at the connection or at
  `RCPT TO` avoids generating [backscatter](https://mailmum.io/glossary/backscatter/).

## How do you know whether a list is working?

Count the hits per list over time. If one list contributes almost nothing,
it is costing you a DNS lookup on every connection for no benefit; if one
suddenly contributes everything, it has probably started wildcarding.

Graphing this is straightforward with the Munin plugin described in
[monitoring your local Postfix blacklist with
Munin](https://mailmum.io/posts/monitoring-your-local-postfix-blacklist-with-munin/), which counts
rejections per list from the mail log and lets you compare your own list against
the public ones side by side.