What a DNS blocklist is
A DNS blocklist, also called a DNSBL, RBL or blacklist, is a published list of IP addresses that have sent spam, or that should not be sending mail at all.
Mail servers consult these lists for every incoming connection. The lookup is an ordinary DNS query: the server reverses the four numbers of the sender's address and adds the list's zone, so 203.0.113.42 becomes 42.113.0.203.zen.spamhaus.org. If the name does not exist, the address is clean. If it resolves to an address in 127.0.0.x, the address is listed, and the last number says which category it falls in. The receiving server then rejects the message, marks it as junk, or adds the listing to a spam score. Each mail system chooses which lists it trusts, so one listing can matter a lot or not at all.
Reading the result
| Result | What happened | What to do |
|---|---|---|
| Listed | The list returned a 127.0.0.x code for this address | Read the reason, fix the cause, then use the list's removal page |
| Clean | The list has no entry for this address | Nothing |
| No answer | The list timed out or refused the query | Check again later. This is not a listing |
Why home addresses sit on policy lists
Some lists are not about bad behaviour. The Spamhaus PBL lists the address ranges that providers hand out to home and mobile customers, and SpamRATS Dyna lists addresses whose reverse DNS name looks like a home connection. The reasoning is that ordinary customer devices are not expected to deliver mail straight to other mail servers. A listing like this is normal and is not an accusation. It does not affect mail you send through your provider, your webmail or your company's mail service, because that mail leaves from their servers, not from your address. It only matters if you run your own mail server on that connection. In that case, relay outgoing mail through your provider or ask for a static business address.
How an address ends up listed
- An infected device. Malware on a computer, phone or router sends spam or probes other machines without the owner noticing.
- A compromised account or website. A stolen mailbox password or an unprotected contact form lets someone send spam through your server.
- Poor mailing lists. Sending to old, bought or scraped addresses hits spam traps, which exist only to catch that kind of mail.
- Complaints. Enough recipients pressing the spam button gets a sender reported to lists such as SpamCop.
- Missing reverse DNS. Some lists add addresses that have no PTR record or a generic one. Check yours with reverse DNS.
- The previous user. A newly assigned address can carry a listing earned by whoever had it before you.
How delisting works
Fix the cause first. If spam is still leaving the address, it will be listed again, and repeat listings take longer to clear. Then open the removal page linked in the result row and follow that list's process. Most lists remove an address for free. Some drop entries on their own once the spam stops: SpamCop does so about a day after the last report. Removal only changes that one list, and mail servers that cached the old answer can take a few hours to notice.
Listed because of someone else
An address is often shared. Shared web hosting, VPN exits, cloud servers and carrier-grade NAT all put many users behind one address, and a listing caused by any of them applies to all. A few lists go further. UCEPROTECT Level 2 and Level 3 list whole address ranges and whole providers when enough of their addresses misbehave. If you are caught in one of these, your own delisting request will not help. Ask your host for a different or dedicated address, or send mail through a relay service with a clean reputation.