DNSBL and RBL Explained: How Mail Blocklists Actually Work

A DNSBL (DNS-based Blackhole List) is a list of IP addresses caught sending spam, published so that it can be queried over the DNS protocol. The term RBL (Realtime Blackhole List) is usually used interchangeably. Whether your mail lands in the inbox or straight in the bin is largely decided by these lists.

How the query actually works

When your mail server accepts a connection, it reverses the peer's IP address, prepends it to the list's domain, and issues an ordinary DNS query. 203.0.113.45 is checked against zen.spamhaus.org like this:

45.113.0.203.zen.spamhaus.org

An NXDOMAIN answer means the address is not listed. An A record of the form 127.0.0.x means it is, and the final octet says which sub-list matched — one for direct spam sources, another for compromised machines, another for dynamic end-user ranges. The TXT record usually carries the reason for the listing and a delisting link.

Types of list

• IP-based lists — target the sending server's address; the most common kind.
• Domain lists (URIBL/DBL) — judge not the IP but the domains appearing in the message body's links.
• Policy lists — based on rules rather than evidence of spam: dynamic or residential ranges, blocks that should never send mail directly.
• White and grey lists — fast-track known-good sources, or force an unknown sender to retry.

Why an IP gets listed

• A compromised account on the server, turning the machine into a spam queue
• An open relay or open proxy running without authentication
• Bulk mail to non-consenting lists with a high complaint rate
• Messages delivered to spamtrap addresses
• Neighbourhood effect: poor reputation of other addresses in the same /24
• Policy breach: direct 25/TCP traffic from a range classified as dynamic

Reading the results correctly

Appearing on a single list does not always mean delivery stops. Serious mail providers weight lists: an entry on a long-established list with a low false-positive rate usually means outright rejection, while an entry on a list known for aggressive policies only adds to a spam score. Judge an IP by the combination of lists and their stated reasons, not by one hit.

What to do if you are listed

Remove the cause first — shut down the compromised account, put your relay behind authentication, clean your sending list — and only then use each list's own delisting form. Requests filed before the cause is fixed almost always end in a re-listing. Our blacklist delisting guide covers the steps in detail.

Checking them all with IP-DB

IP-DB.com checks every lookup against a large set of DNSBLs and threat feeds at once, showing on one screen which lists carry the address, the reason recorded, and when each was last updated. Checking your mail server's egress addresses on a schedule is the cheapest way to catch a delivery problem before your customers do. For a single address use the IP blacklist check; for a fleet of servers, the bulk IP checker.