---
title: "IP Block Listing or Blacklisting"
description: "IP blacklisting is a way for ISPs and email providers to block incoming messages from known spammer IPs. This helps protect users from spam and other unwanted email."
url: "https://mailmum.io/glossary/ip-blacklisting/"
---

# IP Block Listing or Blacklisting

IP blacklisting is a technique used by [Internet Service Providers
(ISPs)](https://mailmum.io/glossary/internet-service-provider-isp/) and email providers to block
or filter incoming messages from IP addresses that have been identified as
sources of spam or other malicious activity. By blocking or filtering messages
from these IP addresses, ISPs and email providers can help
protect their users from spam and other unwanted email.

## IP Blacklisting on local systems

IP blacklisting can be applied using configuration files in several different
ways, depending on the specific needs of the organization and the type of system
that is being used. Here are a few examples of how this might be done:

* In a mail server system, an administrator can use a configuration file to
  specify a list of IP addresses that should be blocked. The mail server will
  then automatically reject any incoming messages from these IP addresses.
* In a firewall system, an administrator can use a configuration file to specify
  a list of IP addresses that should be blocked from accessing the network. The
  firewall will then automatically block any incoming connections from these IP
  addresses.
* In a content management system, an administrator can use a configuration file
  to specify a list of IP addresses that should be blocked from accessing the
  system. The content management system will then automatically reject any
  attempts to login or access the system from these IP addresses. This can be
  useful for contact forms, which may result in an email being sent to customer
  or sales service.

Overall, the use of configuration files to specify IP blacklists can make it
easier to manage and maintain the blacklist, and can help ensure that the
blacklist is applied consistently across the system.

A locally maintained list only reflects what you have seen yourself. It does not
scale to the volume of spam sources on the internet, which is why most mail
servers additionally query shared lists over DNS.

## IP Blacklisting using the DNS system (DNSBL)

A DNSBL (DNS-based Blackhole List, also called an RBL or DNS blacklist) is not a
list you download and configure locally. It is a list somebody else maintains
and publishes as a DNS zone, which your mail server *queries* once per incoming
connection. Nothing is stored on your side.

The query works by reversing the octets of the connecting IP address and
appending the zone name of the list. To check `192.0.2.10` against a list
published at `zen.spamhaus.org`, the mail server looks up:

```sh
$ dig +short 10.2.0.192.zen.spamhaus.org a
127.0.0.4
```

The answer is what matters:

* **NXDOMAIN (no answer)** — the IP address is not listed. This is the
  normal case, and it is what a healthy mail server should get.
* **An address in `127.0.0.0/8`** — the IP address *is* listed. The exact
  address encodes *why* it is listed, and each list documents its own return
  codes. A different code can mean a known spam source, a dynamic/residential
  IP range, or a compromised host, and many admins treat those categories
  differently.

Most lists also publish a `TXT` record with a human-readable reason and a
removal link:

```sh
$ dig +short 10.2.0.192.zen.spamhaus.org txt
"https://check.spamhaus.org/query/ip/192.0.2.10"
```

Well known public lists include [Spamhaus](https://www.spamhaus.org) and
[SpamCop](https://www.spamcop.net). Both offer a free tier for low-volume
lookups and require a subscription (typically via a dedicated query key) above
that, so check the terms of the list before you point a busy mail server at it.

## What does a mail server do with a listing?

Being listed is a signal, not automatically a rejection. Servers commonly:

* **Reject outright** at connection time, usually only for high-confidence
  lists. The sending server then receives a bounce.
* **Add a score** in a filter such as SpamAssassin or rspamd, so a listing
  contributes towards a spam verdict without deciding it alone.
* **Apply greylisting or rate limits** to listed sources instead of blocking
  them.

Scoring is generally the safer default. A single list having a false positive
should not be enough to lose legitimate mail.

## How do I get an IP address delisted?

If your own sending IP address is listed, the process is roughly:

1. Find out *which* lists you are on and what return code they gave you.
2. Fix the underlying cause — a compromised account, an open relay, a
   missing [reverse DNS record](https://mailmum.io/glossary/reverse-dns-rdns/), or a genuine
   spam complaint from your users.
3. Use the list's own removal form. Most lists refuse to delist, or relist
   immediately, if the cause is still present.

Some lists expire entries automatically once the sending behaviour stops, so
fixing the cause and waiting is sometimes the whole procedure. What you should
not do is request delisting repeatedly without changing anything.

## How do you set this up on your own server?

The practical side of blacklisting is covered in more detail in these how-tos:

* [Blacklisting single hosts, IP addresses, and even networks in
  Postfix](https://mailmum.io/posts/blacklisting-single-hosts-ip-addresses-and-even-networks-in-postfix/)
  — building a local `cidr` map and adding it to
  `smtpd_recipient_restrictions`.
* [Whitelisting hosts, IP addresses, and even networks in
  Postfix](https://mailmum.io/posts/whitelisting-hosts-ip-addresses-and-even-networks-in-postfix/)
  — the exception mechanism that has to sit above the blocklist. See also
  [IP whitelisting](https://mailmum.io/glossary/ip-whitelisting/).
* [Monitoring your local Postfix blacklist with
  Munin](https://mailmum.io/posts/monitoring-your-local-postfix-blacklist-with-munin/) — how
  to tell whether a list is earning the lookup it costs you.

For lists distributed over DNS rather than kept in a local file, see
[DNS blocklist (DNSBL / RBL)](https://mailmum.io/glossary/dns-blocklist-dnsbl/).