The Spamhaus Project

Spamhaus' Blocklists

For over 25 years, we have been compiling DNS Blocklists (DNSBLs) to help email administrators filter emails and protect their users.
Our targeted blocklists contain IPs and domains that are seen to be associated with malicious behavior, including phishing, malware, spam, and more. They also cover IP addresses that are legitimate, but shouldn't be sending emails e.g. from Internet of Things (IoT) devices. These DNSBLs can be easily utilized with most email servers.

How blocklists work (simplified)

The IPs, domains, or hashes associated with an email can be queried against a DNSBL to see if they're listed in the relevant blocklist. An email administrator can then choose to either:

a. Reject the email in real-time, with an appropriate delivery code, or

b. Accept the message and tag it for additional filtering.

Diagram of a simplified blocklist flow

Which blocklists should you use?

Each DNSBL Spamhaus produces has a different focus and purpose. They should be applied at different stages of the email transaction. From the initial connection, where you would query the Spamhaus Blocklist (SBL), Policy Blocklist (PBL), and Exploits Blocklist (XBL), through to the content filtering stage, where the Domain Blocklist (DBL) should be used.

Blocklists available from Spamhaus

CSS

Combined Spam SourcesLearn More

DBL

Domain BlocklistLearn More

XBL

Exploits BlocklistLearn More

PBL

Policy BlocklistLearn More

SBL

Spamhaus BlocklistLearn More

ZEN

PBL, SBL & XBL combinedLearn More

How to access the blocklists

Initially, Spamhaus Project set up servers across the world to enable users to query our blocklists for free (subject to a fair use policy). This service still exists but is being deprecated. Today, Spamhaus Technology provides a free service on our behalf that provides users with a commercial-grade service with access to an increased number of DNSBLs - see the DNSBL usage criteria here.

Free Data Query Service

How to configure and query the blocklists

Spamhaus' DNSBLs can be easily queried via SpamAssassin, Rspamd, or most current Mail Transfer Agents.

Configuration Examples
Free Datasets and Tools