What Is the Spamhaus
Domain Blocklist (DBL)?

The Policy Blocklist (PBL) helps minimize the risk of spam and malware distribution, thereby protecting the integrity of email communication networks.

The Spamhaus Domain Blocklist (DBL) is a comprehensive and constantly updated list of domain names that are linked to spam, phishing, and other malicious activities. Operated by The Spamhaus Project, a non-profit organization dedicated to tracking email spammers and maintaining real-time lists to combat unwanted communications, the DBL serves as a resource for email administrators and security professionals.

By referencing the DBL, servers can block or flag messages originating from or containing malicious domains, thereby enhancing email security and reducing the risk of cyber threats.

Comprehensive Blocklist for Malicious Domains

The Domain Blocklist consolidates any domain showing signs of spam or malicious activity, including those owned by malicious actors or legitimate domains that have been hijacked. Thanks to domain structure, suspicious activities can be identified proactively, making this dataset highly effective.

Understanding the Spamhaus DBL

The Spamhaus DBL compiles domain names with poor reputations, published in a domain DNSBL format. It assesses domain reputation based on a wide array of observed behaviors, feeding into the DBL zone. The DBL includes domains used in unsolicited bulk emails like phishing, fraud, and malware distribution, determined through extensive heuristics.

Enhancing Catch Rates with Domain Blocking

Relying solely on IP-based data for email filtering means you’re missing out on a highly effective way to boost your catch rates. The Domain Blocklist (DBL) identifies, classifies, and rejects emails containing listed domains, especially those designed to bypass IP-based protection. Malicious actors who evade IP detection can be thwarted through domain-based detection.

Email administrators can deploy this real-time DNSBL to mitigate spam and other malicious emails. Enjoy industry-leading catch rates with minimal false positives, thereby reducing security risks, lowering email infrastructure costs, and minimizing human resource requirements.

How to Utilize the DBL Dataset

Maximize the potential of Spamhaus’ data by integrating blocklists at critical points in your email filtering process. Effectively use the Domain Blocklist with the following steps:

Initial Connection: Apply the DBL against the domain linked to the connecting IP via reverse DNS (rDNS).
Pre-Data Phase: During the SMTP transaction, check against the HELO string and Mail From domain.
Content Inspection: After email acceptance, inspect domains in mail headers and body, including URLs or contact email addresses.

For further information, please refer to this best practice guide: DNSBLs and Email Filtering: How to Get It Right.

DBL: Accessible and Widely Utilized

Spamhaus provides the DBL dataset free of charge to the email community, equipping email administrators and security professionals with an industry-leading blocklist. Seamlessly integrate it into your existing filtering solutions or pair it with other DNS-based blacklists for enhanced protection.

Spamhaus also offers premium services like Domain Blocklist Plus (DBL+), delivering detailed threat intelligence and zero-hour data feeds to keep organizations ahead of emerging threats.

In Summary: Domain Blocklist

The Spamhaus Domain Blocklist is a critical tool in combating spam and malicious activities. Its comprehensive coverage includes entire domains used for phishing, fraud, and malware distribution, enabling proactive threat identification.

Each blocklist targets specific behaviors, and using a single blocklist independently can limit data effectiveness. Spamhaus offers four free IP-based blocklists to eliminate the majority of spam:

Spamhaus Blocklist (SBL)
Exploits Blocklist (XBL)
Combined Spam Sources Blocklist (CSS) (included in the SBL DNSBL zone)
Policy Blocklist (PBL)

Access these IP blocklists through ZEN, which combines the above datasets for easier and faster querying.

Setting Up the DBL for Use

Leverage the data via SMTP server configuration for connection and SMTP transaction checks. Utilize open-source tools like SpamAssassin and Rspamd for content analysis. Plugins are available to minimize configuration time for users of Spamhaus Technology’s free Data Query Service. Integrate with your existing anti-spam platforms; technical support is available here. Setup takes minutes for instant real-time protection.

Accessing the DBL’s Dataset

Spamhaus DNSBLs are free for low-volume, non-commercial users. If uncertain, review our DNSBL usage criteria. Free accounts are available through our partner, Spamhaus Technology; sign up to access data via the Data Query Service.

Maintaining a Good IP Reputation

Spamhaus data protects billions of mailboxes globally. To avoid listing and service impact, follow these best practices:

Registrar Security Services – Utilize registrar services like registry lock or DNS change monitoring.
Monitor DMARC Reports – Watch for domain spoofing attempts.
Restrict Outbound SMTP Traffic – Configure your firewall to allow outbound SMTP traffic (port 25) only from your mail server’s internal IP.
Infrastructure – Check your internet infrastructure providers, e.g., ISPs. Refer to reputation statistics on ISPs/networks.
Double Opt-In – Avoid spam traps and ensure only interested recipients receive emails.
Configuration – Ensure hostname and HELO match, and that reverse DNS (PTR record) points to the same hostname.

How to Remove Your Domain from the DBL Blocklist

If your domain is on the Domain Blocklist, please visit our IP and Domain Reputation Checker at https://check.spamhaus.org. This is the platform for DBL removal requests.

Spamhaus DBL FAQ

What is the Domain Blocklist (DBL)?

The Spamhaus Domain Blocklist (DBL) is a comprehensive list of domain names published in a domain DNSBL format. This powerful tool leverages various factors to calculate and maintain domain reputations within a robust database that powers the DBL zone.

Only domain names are listed; no IP addresses are included.
A dedicated team maintains the DBL’s reputation database.
Data from diverse sources inform the established rules.
The DBL zone is continuously updated, with data served from over 80 global mirrors.
Automated systems, governed by these rules, analyze a significant portion of global email traffic and its associated domains.
While most listings are automated, Spamhaus researchers intervene when necessary.
Listings expire once a domain no longer meets the criteria.

DBL data integrates with other Spamhaus systems, potentially triggering further domain or IP address listings in other Spamhaus zones.

How do I get a domain off the Domain Blocklist (DBL)?

Does a DBL listing expire on its own?

Yes, DBL is pretty automated. Most listings will drop off automatically once there’s no activity linked to them.
Domains get listed in the DBL Zone automatically and can get re-listed if detected again after removal.

Can I remove a domain from the DBL before it expires?

Even though DBL tries not to list innocent domains, some might need to be taken off early. If you think a domain should be removed sooner, use the IP and Domain Reputation Checker on the Spamhaus homepage. Look up the domain and follow the steps provided.

This does not guarantee removal.
Too many requests or misuse may get you blocked.

How long does it take for removal?

Once approved, removal happens right away.
It usually only takes a few minutes, but it could take up to 24 hours for some local systems.
If the listing is still there after 24 hours, get in touch with us.

Is there a cost for getting off the DBL?

There’s never a charge for removing any Spamhaus listing.
Any offer to remove a Spamhaus listing for a fee is a scam.
Spamhaus has no connections with anyone offering ‘blocklist removal’ services, and no third party can influence or speed up removals from our database.

How does a domain get listed on the Domain Blocklist (DBL)?

The Spamhaus Domain Block List (DBL) evaluates many factors for including domains. Specific criteria are not disclosed.
Domains must match several criteria to be listed.
DBL listings are constantly reevaluated, and listings expire automatically when criteria are no longer met.

These are general observations to help domains build a good reputation and avoid DBL listings.

Domain reputation

Experience shows that an unknown reputation has a higher risk of emitting spam than known-good domains, so unknown reputations start as “poor” by default.

Anonymity does not help build a good reputation.
Domain and IP address reputations affect each other.
If domains are used in legitimate traffic long enough to establish a good reputation, DBL will notice and remove the listing.
The DBL will also notice if domains are used for poor-reputation activities like spam or cybercrime.

Snowshoe spamming

This technique uses many domains and IP addresses, which change frequently.
Legitimate bulk email builds a reputation over time on durable, long-term domains and IP addresses.
Reputable mailers invest time and effort, using fewer domains and IP addresses than snowshoers.
Domains that mimic snowshoeing will be treated as such.

Authentication

Robust domain authentication is essential in today’s email ecosystem. While SPF, DKIM, and DMARC can be employed by both spammers and legitimate senders, DBL listings can occur for domains with or without these records.

Bulk Email/Marketing Email

For domains used in bulk email, adhering to best practices is crucial. Ensure you send only confirmed opt-in, solicited bulk mail to maintain a positive reputation.

Role Accounts and Feedback Loops

Role accounts and feedback loops serve as a domain’s abuse detection system. Without them, visibility into abuse issues within a network is significantly diminished. They should be employed to identify and mitigate problems, including spam, before they damage a domain’s reputation.

Clean Hosting

Domains should be hosted on reputable ISPs that do not tolerate network abuse. “Clean” encompasses a domain’s NS, A, MX, and website DNS records. Hosting a domain on IPs or servers that are friendly to spam, or at ISPs that allow network abuse, adversely affects the reputation of all domains within that network. Mail server IPs should have appropriate DNS records, and mail servers should identify themselves correctly using a proper HELO value.

Do DBL listings include full URLs?

Domain Blocklist (DBL) listings cover only hostnames, not the entire directory paths of URLs/URIs. However, admins of compromised CMS sites might have deeper DBL insights.

All domains, especially redirector domains, should establish role-based accounts according to RFC guidelines (e.g., abuse@ and postmaster@). Implementing ISP feedback loops and reporting mechanisms, such as DMARC notifications, is crucial for monitoring email traffic. These measures are essential for the prompt identification and resolution of issues.

How do I remove a domain from the Domain Blacklist (DBL)?

Search, review, and request removal of “abused legit” hostnames via the IP and Domain Reputation Checker.

If your hostname/domain is listed, followthese steps:

Take the website/server offline for repairs, if feasible.
Remove all infected files.
Update your CMS, plugins, and extensions to the latest secure versions.
Ensure server security or request a system administrator to conduct a security audit.
Change all passwords. Use strong passwords and enable two-factor authentication where possible.

Maintain your digital presence with these essential actions.

What does "abused-legit" mean? in the DBL?

“Abused-legit” is a key component of the Domain blocklist (DBL) that identifies hostnames on legitimate domains being exploited for malicious purposes. Often, this results from a compromise, typically involving website software (CMS) or credentials that provide access to hosting infrastructure.

Spamhaus lists these sites after identifying legitimate websites that have been compromised. By listing specific hostnames rather than entire domains, we avoid disrupting other legitimate content on the same domain. Compromises can stem from various issues, including outdated software, poor security practices, or unauthorized access.

Stay informed and vigilant with the latest in cybersecurity trends and best practices to safeguard your online presence.

Does the DBL work to filter blog spam?

The Spamhaus DBL is a valuable tool for defending against blog spam. Many of the same actors responsible for email spam also target blog comment sections and guestbooks. While most blogging software effectively catches comment spam, the DBL can identify certain domains used by spammers, allowing it to flag or block these postings if necessary.

Trusted by Global Industry Leading Brands

Read Case Studies

IPv4 addresses ranging from a /24 up to /12s