The acronym DNSBL stands for Domain Name System Block List. Understanding DNSBL Filtering explains the concept in words and diagrams.

DNSBLs list IP addresses. These IP addresses are often those that the list operator has observed sending spam, hosting the web sites of spammers, or providing other services to spammers (collectively called spam support services). The Spamhaus Policy Blocklist (PBL) lists IPs that the ISP does not (or should not) allow to send email directly to other SMTP servers, but should send email only via the ISP's designated outgoing SMTP servers. Some DNSBLs have other listing criteria, such as geographic lists of IPs by country. Those DNSBLs may be used for a variety of purposes.

DNSBLs are used by companies, ISPs, and even individual email applications to help determine whether an email is likely to be spam, and if it is to prevent that email from being delivered to the recipient. Usually a company or ISP's SMTP server checks the DNSBL when an email is received, and refused that email if it is coming from a listed IP or if it contains a URL that is hosted on a listed IP.

DNSBLs are sometimes called RBLs (Realtime Blackhole Lists) after MAPS, the granddaddy of all DNSBLs. They can also be called just blocklists, blacklists, or simply BLs.

IMPORTANT: A DNSBL cannot stop anyone from sending mail. It only prevents delivery at the receiving end when the receiver specifically configures his mail server or mail software to consult it. DNSBLs are strictly defensive tools; they cannot be used to launch denial-of-service (DOS) attacks or to do any offensive damage.

All modern mail servers have a 'DNSBL' feature (sometimes called 'RBL Servers' or 'Blacklist'). If you are not sure whether yours does, read its 'Help' file or ask your mail server vendor.

Depending on how much email traffic you have, you can either use Spamhaus public mirrors free by setting your mail server's 'DNSBL' feature to query zen.spamhaus.org, or - if you have high traffic - you will need a special Data Feed from us.

There is more information in our "How-to-Use" FAQ, and see the following FAQ 'What zone should my server or spam filter query?'

Remember, use your mail server to query a Spamhaus DNS zone such as zen.spamhaus.org. Do not automate queries of our website lookup form!

There are other ways to use SBL beyond just checking the connecting IP. Our Effective Spam Filtering page has suggestions for checking URIs in the spam against SBL, which is very effective at stopping spam. Nameserver IPs of connecting hosts are another check which some admins have found effective. If you decide to do such checks on your mailstream, be very careful which Spamhaus zone you select for each step. Checking against SBL is quite conservative and will have few false positives. Checking against XBL is more aggressive and while it will catch more spam it may also intercept more non-spam mail. Don't use URI checks against PBL unless you know exactly what you're doing; that will result in rejecting non-spam mail for most servers. Remember that Zen zone contains SBL, XBL and PBL combined, so you will need to select the correct response based on the 127 return code.

An overview off Effective Spam Filtering strategies explains additional uses of spam block lists such as URI_SBL in SpamAssassin and SURBLs and URIBL, domain-based DNS spam blocking lists.

There can be several reason one would be seeing this:

When you implement Spamhaus DNSBL filtering in your mail server, you must check that the zone you have just entered is spelt properly. If you accidentally put in a wrong domain such as 'spamhous.org' or 'spamhouse.com', the DNS queries generated by your mail server will go to some entirely different and unrelated place which can answer your queries with a valid A record containing an IP address (this is often done by "typosquatters" to catch web traffic). Even if this IP is not a conventional DNSBL answer 127.0.0.x, your mail server may still interpret this answer as a "listed" answer, and act accordingly.

Another problem we've seen is where ISPs "hijack" DNS replies. This is done to monetize website traffic by rather than returning a "not found" (NXDOMAIN) for a DNS request that cannot be found (resolved), a pointer to an advertizing page or search page is given. We have heard that a US ISP, Cox Communication has been doing this in some areas and points people to a webpage like this one. As Spamhaus's "not listed in our zone" replies are the same as a webpage not found reply, users behind this sort of DNS monetization will always see an IP address returned rather than the correct NXDOMAIN DNS answer. If this is the issue, contact your ISP to see if you can opt-out. The above mentioned ISP has an informational page with opt-out instructions. Or set up your own DNS resolver.

A second form of DNS hijacking has been seen, where an ISP cuts off DNS traffic to DNS servers it feels are being queried too often. This at times returns a IP value, which will cause all emails to flagged as spam. They may even null the value of the DNSBL's name, this can cause unpredictable results. In this case, you will need to contact your ISP.

First, check our FAQ answer for "Your DNSBL blocks the whole Internet!" and make sure you've not made a spelling mistake in your mailserver configuration.

Check what DNS resolvers you are using: If you are using a free "open DNS resolver" service such as Google Public DNS or Level3's public DNS servers to resolve your DNSBL requests, in most cases you will receive a "not listed" (NXDOMAIN) reply from Spamhaus' public DNSBL servers. Please use your own DNS servers when doing DNSBL queries to Spamhaus.

The Spamhaus Blocklists are only some of many public DNSBL systems. In addition to publicly-queriable lists, many networks maintain their own private blocking lists. And DNSBLs are only one of many reasons that could cause a Delivery Status Notication (DSN).

Read the bounce ('DSN') messages carefully; they should provide clues as to why your mail was rejected. Unfortunately, some of them are not accurate or helpful; sometimes they even point to Spamhaus SBL for no reason at all. But, since each system which rejects your mail may give a different DSN, do read several of the messages and you will find some that make sense and help you track down the problem.

Locate the IP address which was rejected, generally the IP address of your outbound mail server and usually noted in the DSN message. Test it in the "IP Removal" form at www.spamhaus.org/lookup.lasso. If it does not show up with that form, the address is not listed in any Spamhaus DNSBL (that form queries all the most current Spamhaus zones).

A few sites which might help you track down DNSBL issues with other lists are:
         http://www.dnsbl.com/ (general DNSBL info)
         http://emailstuff.org/ (selection of meaningful DNSBLs)
         http://moensted.dk/spam/
         http://openrbl.org/
         http://shopping.declude.com/Articles.asp?ID=97
Remember that none of those sites is a DNSBL itself so it cannot possibly block your mail, and that they are offered on a voluntary basis, without support. Use their web services, but please don't pester them!

Some DNSBLs are simply too aggressive, unreliable or otherwise unsuited to use by more than a few hobbyist domains, places where most legitimate senders are unlikely to ever send any mail. If your IP address is in such a list, just ignore it! It's not stopping you from mailing anyone and no one who knows anything about mail cares about such lists.

Advanced users with access to procmail on a shell server may wish to investigate the highly effective SpamBouncer, which supports Spamhaus lists, and optionally other DNSBLs.

You can query the SBL and XBL to prevent things such as blog-comment and guestbook spamming, click-fraud, and automated email address harvesting. You do this by programming your application(s) to query our DNS server(s) to determine whether a specific IP is on one of our blocklists. You can use such queries to stop posts from users who use IPs on the SBL or XBL to connect to your web site, or to block comment and guestbook posts that contain URIs hosted on IPs listed in the SBL or XBL.

There are open-sourced code bases available in Perl and PHP for performing DNS queries. You can find these by searching the Web. Two useful web sites that have code to perform DNS lookups are on PHP.net and The Code Cave.

If you prefer to brew your own code, below is the information you will need:

• ZONE = zen.spamhaus.org
• PROTOCOL & PORT = UDP/53
• QUERY SYNTAX = <REVIP>.zen.spamhaus.org, where "<REVIP>" is the IP you are querying, reversed.

For example, if you want to check 192.168.25.1, you would query 1.25.168.192.zen.spamhaus.org.

• RESPONSE CODES
• IP NOT FOUND = (NXDOMAIN)
• DNS SERVER ERROR = (SERVFAIL) (These are quite rare.)
• IP FOUND = See the Spamhaus DNS Return-Codes list.

Whenever possible, we encourage applications to query zen.spamhaus.org and then parse the return code(s) to determine whether to block an IP. This prevents unnecessary queries and speeds processing on your application. If your application cannot parse return codes, you can query sbl.spamhaus.org to determine whether an IP is on the SBL, and xbl.spamhaus.org to determine whether an IP is on the XBL. Either of these zones returns 127.0.0.2 if the IP is on that blocklist.

WARNING! Do not block users using IPs listed on the PBL from accessing Web-based applications. The PBL is not a list of "spamming IP addresses"; treating IPs on it as if they all belong to spammers will result in blocking large numbers of legitimate users. Consult the Spamhaus FAQ on the PBL for more information on what the PBL is and how it works.