IP Block Listing or Blacklisting

IP blacklisting is a technique used by Internet Service Providers (ISPs) and email providers to block or filter incoming messages from IP addresses that have been identified as sources of spam or other malicious activity. By blocking or filtering messages from these IP addresses, ISPs and email providers can help protect their users from spam and other unwanted email.

IP Blacklisting on local systems

IP blacklisting can be applied using configuration files in several different ways, depending on the specific needs of the organization and the type of system that is being used. Here are a few examples of how this might be done:

• In a mail server system, an administrator can use a configuration file to specify a list of IP addresses that should be blocked. The mail server will then automatically reject any incoming messages from these IP addresses.
• In a firewall system, an administrator can use a configuration file to specify a list of IP addresses that should be blocked from accessing the network. The firewall will then automatically block any incoming connections from these IP addresses.
• In a content management system, an administrator can use a configuration file to specify a list of IP addresses that should be blocked from accessing the system. The content management system will then automatically reject any attempts to login or access the system from these IP addresses. This can be useful for contact forms, which may result in an email being sent to customer or sales service.

Overall, the use of configuration files to specify IP blacklists can make it easier to manage and maintain the blacklist, and can help ensure that the blacklist is applied consistently across the system.

A locally maintained list only reflects what you have seen yourself. It does not scale to the volume of spam sources on the internet, which is why most mail servers additionally query shared lists over DNS.

IP Blacklisting using the DNS system (DNSBL)

A DNSBL (DNS-based Blackhole List, also called an RBL or DNS blacklist) is not a list you download and configure locally. It is a list somebody else maintains and publishes as a DNS zone, which your mail server queries once per incoming connection. Nothing is stored on your side.

The query works by reversing the octets of the connecting IP address and appending the zone name of the list. To check 192.0.2.10 against a list published at zen.spamhaus.org, the mail server looks up:

$ dig +short 10.2.0.192.zen.spamhaus.org a
127.0.0.4

The answer is what matters:

• NXDOMAIN (no answer) — the IP address is not listed. This is the normal case, and it is what a healthy mail server should get.
• An address in 127.0.0.0/8 — the IP address is listed. The exact address encodes why it is listed, and each list documents its own return codes. A different code can mean a known spam source, a dynamic/residential IP range, or a compromised host, and many admins treat those categories differently.

Most lists also publish a TXT record with a human-readable reason and a removal link:

$ dig +short 10.2.0.192.zen.spamhaus.org txt
"https://check.spamhaus.org/query/ip/192.0.2.10"

Well known public lists include Spamhaus and SpamCop. Both offer a free tier for low-volume lookups and require a subscription (typically via a dedicated query key) above that, so check the terms of the list before you point a busy mail server at it.

What does a mail server do with a listing?

Being listed is a signal, not automatically a rejection. Servers commonly:

• Reject outright at connection time, usually only for high-confidence lists. The sending server then receives a bounce.
• Add a score in a filter such as SpamAssassin or rspamd, so a listing contributes towards a spam verdict without deciding it alone.
• Apply greylisting or rate limits to listed sources instead of blocking them.

Scoring is generally the safer default. A single list having a false positive should not be enough to lose legitimate mail.

How do I get an IP address delisted?

If your own sending IP address is listed, the process is roughly:

1. Find out which lists you are on and what return code they gave you.
2. Fix the underlying cause — a compromised account, an open relay, a missing reverse DNS record, or a genuine spam complaint from your users.
3. Use the list’s own removal form. Most lists refuse to delist, or relist immediately, if the cause is still present.

Some lists expire entries automatically once the sending behaviour stops, so fixing the cause and waiting is sometimes the whole procedure. What you should not do is request delisting repeatedly without changing anything.