DNSBL

A DNSBL (DNS-based Blackhole List, also called an RBL) is a blocklist of IP addresses — typically ones observed sending spam, running open relays, or otherwise associated with abuse — published in a format mail servers can query using ordinary DNS lookups for speed. A mail server checks the sending IP against one or more DNSBLs in real time before accepting a message; a listing on a widely trusted DNSBL like Spamhaus can cause legitimate mail from that IP to be rejected or sent to spam, even for senders who did nothing wrong, which is especially common behind shared or CGNAT addresses. Some receiving servers pair a DNSBL check with greylisting, temporarily deferring a sender that isn’t yet listed anywhere instead of relying only on blocklists that haven’t caught up to a new abusive source. A DNSBL listing is a reputation judgment about an IP in aggregate; an ARF report, where a receiver sends one, instead flags one specific complained-about message back to the sender. The DNSBL query format is defined in RFC 5782, whose document record is tracked at the IETF Datatracker, and Spamhaus’s own usage terms cover query-volume limits for its public DNSBL zones. On the receiving side, a mail server applies a list through configuration such as Postfix’s reject_rbl_client restriction, which rejects a request when the reversed client network address is listed with an A record under the list’s DNS zone.

A DNSBL query reshapes the sending IP into a reversed, dotted hostname under the list’s own zone — the same reversal technique a PTR record lookup uses for its in-addr.arpa name — and is answered by an ordinary recursive resolver like any other DNS query.

DNSBL is part of AdminKit’s DNS cluster; the full AdminKit glossary lists other related terms.