DNSBLDNS-based Blackhole List
A DNSBL (DNS-based Blackhole List, also called a DNS blocklist or RBL) is a blacklist published through the Domain Name System so that any mail server can check a sending IP or domain with an ordinary DNS query. Standardised in RFC 5782, it returns an answer in the 127.0.0.0/8 range to say “listed” and a normal NXDOMAIN to say “not listed.”
- A blacklist delivered over DNS, so a check costs one fast DNS lookup
- The sending IP is reversed and prepended to the list’s zone to form the query
-
A reply in the
127.0.0.0/8range means listed;NXDOMAINmeans not listed - An optional TXT record carries the listing reason, often shown in the SMTP rejection
A record (and optional TXT)
127.0.0.0/8 (e.g. 127.0.0.2)
127.0.0.2 must always list
How a DNSBL query works
The clever part of a DNSBL is that it reuses ordinary DNS infrastructure to answer a yes-or-no question fast. To check an IPv4 address, the receiver reverses the four octets, appends the list’s zone name, and issues a standard A record lookup. If the IP 192.0.2.135 is being checked against zen.spamhaus.org, the query becomes 135.2.0.192.zen.spamhaus.org.
The answer is the verdict. If the list returns an A record in the loopback range 127.0.0.0/8, the IP is listed; if DNS returns NXDOMAIN (no such name), it is not listed. The returned address is a status code, never a real IP to connect to: per RFC 5782 every IPv4 DNSBL must list 127.0.0.2 as a permanent test entry and must not list 127.0.0.1, so operators can confirm their queries are wired up correctly.
; query
135.2.0.192.zen.spamhaus.org. IN A
; listed: an answer in 127.0.0.0/8
135.2.0.192.zen.spamhaus.org. IN A 127.0.0.2
135.2.0.192.zen.spamhaus.org. IN TXT "https://check.spamhaus.org/sbl/..."
; not listed: NXDOMAINReading the 127.0.0.x return codes
Many DNSBLs pack several sub-lists into one zone and tell them apart by the last octet of the returned address. Querying Spamhaus ZEN, for example, can return different codes depending on which underlying list matched:
127.0.0.2: a generic spam-source listing (the SBL).127.0.0.3: a CSS listing (low-reputation, often snowshoe, senders).127.0.0.4: an XBL listing (an exploited or hijacked machine);127.0.0.5to127.0.0.7are currently unused.127.0.0.10/127.0.0.11: a PBL listing (an IP range that should not send mail directly).
A receiver can therefore apply different policies to different codes: reject outright on a high-confidence spam-source hit, but perhaps only defer or score a policy listing. The matching TXT record holds a human-readable reason and a link, which receivers often echo back as the SMTP error so the sender knows why they were blocked.
IP lists, domain lists, and whitelists
Most DNSBLs list IP addresses and are checked at the moment of connection, before any content is seen. A second family, domain-based lists (DNS-based blocklists of domains, sometimes called URIBLs or DBLs), are queried against the domains and links inside a message during content filtering, so they catch a bad sender even after an IP change.
The same DNS mechanism also runs in reverse as a whitelist, or DNSWL, where a listing signals a trusted sender rather than a blocked one. RFC 5782 covers both, which is why the modern, neutral term is DNSxL. In practice, “DNSBL” almost always means the blocking kind.
A DNSBL lookup, step by step
192.0.2.135135.2.0.192A record135.2.0.192.zen.spamhaus.org
127.0.0.x: listed
NXDOMAIN: not listed
DNSBL vs DNSWL
| DNSBL | DNSWL | |
|---|---|---|
| Lists | Bad senders | Trusted senders |
| A listing means | Block or penalise | Trust or whitelist |
| Listed answer | 127.0.0.x |
127.0.x.x |
| Required test entry | 127.0.0.2 listed |
127.0.0.2 listed |
| Typical use | Reject spam at connection | Skip or relax filtering |
By the numbers
Common mistakes
127.0.0.x answer is a status flag, not an address to connect to. Reading it as an IP, or ignoring which sub-list each code maps to, leads to the wrong filtering decision.127.0.0.x answer warrants a block. A PBL or DNSWL code calls for a different action than a spam-source hit; treating them all the same blocks legitimate mail.Frequently asked questions
A record in the 127.0.0.0/8 loopback range, most commonly 127.0.0.2. The exact last octet often encodes which sub-list matched. If the IP is not listed, the DNS query simply returns NXDOMAIN. An accompanying TXT record usually carries the human-readable reason for the listing.A record lookup. For example, checking 192.0.2.135 against zen.spamhaus.org queries 135.2.0.192.zen.spamhaus.org. An answer in 127.0.0.0/8 means listed.127.0.0.2 permanently listed and to never list 127.0.0.1. This gives operators a reliable way to test that their DNSBL lookups work: a query for 127.0.0.2 should always return a hit, and a query for 127.0.0.1 should never.