A blacklist (also called blocklist or DNSBL) is a real-time database of IP addresses or domain names that have been identified as sources of spam, phishing, malware, or other abusive behavior. Mail servers, email gateways, and browsers query these lists to make filtering decisions.
Types
| Type | What It Lists | Used By |
|---|---|---|
| IP blacklists | Spam-sending IP addresses | Mail servers (Spamhaus ZEN, Barracuda) |
| Domain blacklists | Domains in spam content | Content filters (SURBL, URIBL) |
| Browser reputation | Phishing/malware sites | Chrome, Firefox (Google Safe Browsing) |
How DNSBL Works
A DNS-based blacklist (DNSBL) is queried via DNS. To check if 1.2.3.4 is listed on zen.spamhaus.org:
dig 4.3.2.1.zen.spamhaus.org
# NXDOMAIN → not listed
# Returns 127.0.0.x → listedIP octets are reversed, then the DNSBL domain is appended. This lets mail servers check millions of IPs in milliseconds using standard DNS infrastructure.
Impact
Being listed on Spamhaus ZEN can block 80-90% of email traffic — it’s queried by Gmail, Microsoft 365, Yahoo, and most enterprise mail gateways. Being listed on Google Safe Browsing shows security warnings in Chrome, Firefox, and Safari.
Getting Delisted
Fix the root cause first (compromised server, spam trap hit, malware). Then submit a delist request to the specific list operator. Most auto-expire after 24-72 hours once the IP stops generating complaints; others require manual review.