Comparison of DNS blacklists


The following table lists technical information for a number of DNS blacklists used for blocking spam.
Blacklist operatorDNS blacklistZoneListing goalNominationListing lifetimeNotesCollateral listingsNotifies upon listing
combined.mail.abusix.zoneAggregate zoneAggregate zoneAggregate ZoneSingle lookup that contains results from black, exploit and policy lists.
black.mail.abusix.zoneLists individual IP addresses that have sent mail to spam traps. And some manual added netblocks.Mostly Automatic with some manual additions.For automated listings 5.6 days after last event, manual additions are permanent.
exploit.mail.abusix.zoneLists IP addresses behaving in a way that indicates the IP is compromised, infected, proxy, VPN, TOR, malware,Automatic5.6 days after last event
dynamic.mail.abusix.zoneLists IP addresses that should not be connecting directly to MX, such as residential IPs etc.AutomaticPermanent Lists ranges that have generic or templated rDNS. Individual IPs can be delisted immediately via web.
dblack.mail.abusix.zoneLists domains seen in spam hitting traps.Automatic5.6 days after last eventCan be used as an RHSBL and a URIBL.
nod.mail.abusix.zoneLists domains that are newly observed.
shorthash.mail.abusix.zoneLists short URLs seen in traps.Automatic5.6 days after last eventCreated to handle popular shorteners that are misused to hide domains from blacklisting.
drivehash.mail.abusix.zoneLists URLs of online drive services seen in traps.Automatic5.6 days after last eventCurrent only listing Google Drive and Yandex Disk URLs that are used to avoid domain blacklisting.
Domain expired in early 2020
Domain expired in early 2020
Domain expired in early 2020
Domain expired in early 2020
Domain expired in early 2020
ARM Research Labs, LLC truncate.gbudb.netExtremely conservative list of single IP4 addresses that produce exclusively spam/malware as indicated by the GBUdb IP Reputation system. Most systems should be able to safely reject connections based on this list.Automatic: IPs are added when the GBUdb "cloud" statistics reach a probability figure that indicates 95% of messages produce a spam/malware pattern match and a confidence figure that indicates sufficient data to trust the probability data.Automatic: Continuous while reputation statistics remain bad. Warning: Produces false positives, and has no remedy/removal process. IPs are dropped quickly if the statistics improve. IPs are dropped within 36 hours if no more messages are seen.Source data is derived from a global network of Message Sniffer filtering nodes in real-time. Truncate data is updated from statistics every 10 minutes.
Warning: Unreliable, as it produces false positives. It is impossible to find additional information or to manually troubleshoot the problem. It is based on results created by their proprietary software running a proprietary algorithm.
invaluement Single IP addresses which only send UBE. Specializing in snowshoe spam and other 'under the radar' spams which evade many other DNSBLs. Has FP-level comparable to Zen.Automatic, with extensive whitelists and filtering to prevent false positivesTypically an automatic expiration 11 days after the last abuse was seen, but with some exceptionsSpam samples are always kept on file for each listing. Removal requests are manually reviewed and processed without fees.
invaluement Lists /24 blocks of IP addresses which usually only send UBE and containing at least several addresses which are confirmed emitters of junk mail. Collateral listings are kept to a minimum because subsections are often carved from /24 listings when spammers and legit senders share the same /24 block.Automatic once at least several IP addresses from a given block are individually listed on ivmSIP, with extensive whitelists and filtering to prevent false positivesExpiration time increases to many weeks as the fraction of IP addresses in the /24 block in question sending junk mail increasesRemoval requests are quickly and manually reviewed and processed without fees.
invaluement Comparable to uribl.com and surbl.org, this is a list of IP addresses and domains which are used by spammers in the clickable links found in the body of spam messagesAutomatic, with extensive whitelists and filtering to prevent false positivesTypically an automatic expiration several weeks after the last abuse was seen.Spam samples are always kept on file for each listing. Removal requests are quickly and manually reviewed and processed without fees.
Service discontinued mid 2014
UCEPROTECT-Networkdnsbl-1.uceprotect.net
Single IP addresses that send mail to spamtrapsAutomatic by a cluster of more than 60 trapserversAutomatic expiration 7 days after the last abuse was seen, optionally express delisting for a small fee.UCEPROTECT's primary and the only independent list
UCEPROTECT-Networkdnsbl-2.uceprotect.net
Allocations with exceeded UCEPROTECT Level 1 listingsAutomatic calculated from UCEPROTECT-Level 1Automatic removal as soon as Level 1 listings decrease below Level 2 listing border, optionally express delisting Fully depending on Level 1
UCEPROTECT-Networkdnsbl-3.uceprotect.net
ASN's with excessive UCEPROTECT Level 1 listingsAutomatic calculated from UCEPROTECT-Level 1Automatic removal as soon as Level 1 listings decrease below Level 3 listing border, optionally express delisting Fully depending on Level 1
Spam and Open Relay Blocking System dnsbl.sorbs.netUnsolicited bulk/commercial email sendersN/A N/A Aggregate zone
Spam and Open Relay Blocking System safe.dnsbl.sorbs.netUnsolicited bulk/commercial email sendersN/A N/A "Safe" Aggregate zone
Spam and Open Relay Blocking System http.dnsbl.sorbs.netOpen HTTP proxy serversFeeder serversUntil delisting requested.
Spam and Open Relay Blocking System socks.dnsbl.sorbs.netOpen SOCKS proxy serversFeeder serversUntil delisting requested.
Spam and Open Relay Blocking System misc.dnsbl.sorbs.netAdditional proxy serversFeeder serversUntil delisting requested.Those not already listed in the HTTP or SOCKS databases
Spam and Open Relay Blocking System smtp.dnsbl.sorbs.netOpen SMTP relay serversFeeder serversUntil delisting requested.
Spam and Open Relay Blocking System web.dnsbl.sorbs.netIP addresses with vulnerabilities that are exploitable by spammers Feeder serversUntil delisting requested or Automated Expiry
Spam and Open Relay Blocking System new.spam.dnsbl.sorbs.netHosts that have sent spam to the admins of SORBS or SORBS Spamtraps in the last 48 hoursSORBS Admin and SpamtrapRenewed every 20 minutes based inclusion in on 'spam.dnsbl.sorbs.net'
Spam and Open Relay Blocking System recent.spam.dnsbl.sorbs.netHosts that have sent spam to the admins of SORBS or SORBS Spamtraps in the last 28 daysSORBS Admin and SpamtrapRenewed every 20 minutes based inclusion in on 'spam.dnsbl.sorbs.net'
Spam and Open Relay Blocking System old.spam.dnsbl.sorbs.netHosts that have sent spam to the admins of SORBS or SORBS Spamtraps in the last yearSORBS Admin and SpamtrapRenewed every 20 minutes based inclusion in on 'spam.dnsbl.sorbs.net'
Spam and Open Relay Blocking System spam.dnsbl.sorbs.netHosts that have allegedly sent spam to the admins of SORBS or SORBS Spamtraps at any timeSORBS Admin and Spamtrap.Until delisting requested.
Spam and Open Relay Blocking System escalations.dnsbl.sorbs.netNetblocks of service providers believed to support spammersSORBS Admin fed.Until delisting requested and matter resolved.Service providers are added on receipt of a 'third strike' spam
Spam and Open Relay Blocking System block.dnsbl.sorbs.netHosts demanding that they never be testedRequest by hostN/A
Spam and Open Relay Blocking System zombie.dnsbl.sorbs.netHijacked networksSORBS Admin Until delisting requested.
Spam and Open Relay Blocking System dul.dnsbl.sorbs.netDynamic IP address rangesSORBS Admin Until delisting requested.Not a list of dial-up IP addresses
Spam and Open Relay Blocking System noservers.dnsbl.sorbs.netNo Servers Permitted by ISP PolicyNetblock Owner AdministeredNot Applicable.No Servers Permitted by ISP Policy
Spam and Open Relay Blocking System rhsbl.sorbs.netAggregate RHS zonesN/AN/A
Spam and Open Relay Blocking System badconf.rhsbl.sorbs.netDomains with invalid A or MX records in DNSOpen submission via automated testing page.Until delisting requested.
Spam and Open Relay Blocking System nomail.rhsbl.sorbs.netDomains which the owners have confirmed will not be used for sending emailOwner submissionUntil delisting requested.
Spamhaussbl.spamhaus.orgVerified sources of spam, including spammers and their support services, per ManualFrom five minutes to a year or more, depending on issue and resolution
Spamhausxbl.spamhaus.orgIllegal third-party exploits Third-party with automated additionsVaries, under a month, self removal via Composite Blocking List lookup.Consists of the Composite Blocking List
Spamhausdbl.spamhaus.orgLow reputation domains including legitimate domains which have been hacked.Ranking of over 80 different metrics and machine learningA few days. Self-removal generally allowed.
Spamhauspbl.spamhaus.orgAddresses not meant to be initiating SMTP connections, such as residential dynamic IPsManual, by providers controlling the IPs or by Spamhaus PBL TeamSelf-removal Should not be confused with the MAPS DUL and Wirehub Dynablocker lists
Spamhaus.dbl.dq.spamhaus.netDomains registered within the last 24 hours.Automated
Spamhaussbl-xbl.spamhaus.orgA single lookup for querying the SBL and XBL databases
Spamhauszen.spamhaus.orgA single lookup for querying the SBL, XBL and PBL databases.Preferred list to check all Spamhaus listings with one query.
Their web server is down 2014-11-17 - Their RBL server is reporting all queries as SPAM.
cbl.abuseat.org
Only IP addresses exhibiting characteristics specific to open proxies, spamware, malware downloaders, botnets and the like.Automatic: large spamtraps, production mail servers and other detection methods.Less than a month after last listable event, self-removal via CBL lookup.Use Spamhaus XBL or Spamhaus Zen instead; they include CBL.
IBM DNS Blacklistdnsbl.cobion.com
This DNSBL zone is part of the default configuration for Proventia Mail Security System and Lotus Protector for Mail Security
Passive Spam Block Listpsbl.surriel.com
IP addresses used to send spam to trapspamtrapsTemporary, until spam stops
DNSRBL - DNS Real-time Blackhole Listdnsrbl.orgIP addresses used to send spam to trapspamtrapsTemporary, until spam stops
Weighted Private Block Listdb.wpbl.infoIP addresses used to send UBE to membersspamtrapsTemporary, until spam stops
SpamCop Blocking Listbl.spamcop.netIP addresses which have been used to transmit reported email to SpamCop usersUsers submitTemporary, until spam stops, has self removal
SpamRatsnoptr.spamrats.comIP addresses detected as abusive at ISP's using MagicMail Servers, with no reverse DNS serviceAutomatically SubmittedListed until removed, and reverse DNS configured
SpamRatsdyna.spamrats.comIP addresses detected as abusive at ISP's using MagicMail Servers, with non-conforming reverse DNS service indicative of compromised systemsAutomatically SubmittedListed until removed, and reverse DNS set to conform to Best Practises
SpamRatsspam.spamrats.comIP addresses detected as abusive at ISP's using MagicMail Servers, and manually confirmed as spam sourcesManually SubmittedListed until removed
SpamRatsauth.spamrats.comIP addresses detected probing passwords or authenticating without sending mailAutomatically SubmittedListed until removed
Offline since 2018-05-30.
Offline since 2010.
Junk Email Filterhostkarma.junkemailfilter.com
Detects viruses by behavior using fake high MX and tracking non-use of QUITAutomated listingBlack list Data lives for 4 days. White list data lives for 10 days.127.0.0.1=white 127.0.0.2=black 127.0.0.3=yellow
As announced, all public zones are no longer functioning
As announced, all public zones are no longer functioning
As announced, all public zones are no longer functioning
Heise Zeitschriften Verlag GmbH & Co. KG, hosted by manitu GmbHix.dnsbl.manitu.netLists single IPs that send spam to spamtraps. Lists mailhosts, rather than domains, and thus blocks entire hosting providers and ISPs.Automated listing due to spamtrap hits. Exceptions apply to bounces, NDRs and whitelisted IPs.12 hours after last listing or until self delistingTXT records provide information of listing incident - NiX Spam also provides hashes for fuzzy checksum plugin for SpamAssassin.

Site Deactivated by sponsor Christian Jung per http://inps.de/ as seen 2020-05-25
blocklist.de bl.blocklist.deIP-Addresses who Attacks other Server/Honeypots over ssh, imap, smtp, ftp, web, rfi, sqli, ddos....Automatic: over Honeypots and with over 515 Users and 630 Servers from blocklist.de via Fail2Ban or own scriptsAutomatic: 48 Hours after the last Attack. But earlier remove is available over the Delist-LinkServices are free. Source data is from Honeypot-Systems and over 515 User with 630 Servern there reports Attacks with Fail2Ban
SRN:SurGATE Reputation Networksrnblack.surgate.netSpam sources, relay abusersFeeder serversAutomatic expiry ; webpage allows delistingRemoval requests are quickly and manually reviewed and processed without fees.
s5h.net Internet Servicesall.s5h.netSpam sources from email, forums, referrer spam and dictionary attacksTrapsTwelve months unless ISPs request removal earlierBy request. ISPs can provide request exclusion.
Domain expired in November, 2019 and service is discontinued.
realtimeBLACKLIST.comrbl.realtimeblacklist.comSpam TrapList of IP addresses that sends spam or causing troubles with botnets or phishingUntil delisting requested.Removal requests will be investigated and processed within 24 hours of submission.
Previously known as IPrange.net RBL Project
James Sawyersecurity.jamessawyer.co.ukCollection of Bad Actors from various sources, Works great with PiHole for personal use.Spammers, Scammers, Malware, Cryptominers, TOR, botnets, phishing, attackers, harvesters, exfiltration etc. Basically anything and everything "bad"Until delisting requested.Removal requests will be investigated. Contact details provided.
BarracudaCentralb.barracudacentral.orgSpam TrapProvides a list of IP addresses which are sending spam. The Barracuda Reputation system uses automated collection methods to add and delete IP addresses from the BRBL.Until delisting requested.Requires registration of administrator and hosts to use. Removal requests are typically investigated and processed within 12 hours of submission if provided with a valid explanation.
SPFBL.netdnsbl.spfbl.netBad reputation, difficult to identify the responsible, dynamic IP, SLAAC flag without genuine email service and inappropriate use of the URLProvides a list of IPv4/IPv6 addresses and domains which are sending spam or phishing.Until delisting requested or seven days with good reputation.The feedback system runs at SMTP layer. See https://spfbl.net/en/feedback
Offline Since May 2016
ubl.unsubscore.comIP addresses which have sent email to addresses harvested from suppression filesTrapsFor 30 days after last offending message unless removal is requested
The NordSpam Projectbl.nordspam.comIP addresses detected as unsolicited bulk/commercial email senders, webspamManualUntil delisting requested.Removal requests are manually reviewed and processed without fees.
The NordSpam Projectdbl.nordspam.comUnsolicited bulk/commercial email senders, webspamManualUntil delisting requested.Removal requests are manually reviewed and processed without fees.
0spam.fusionzero.comSpam TrapsA single IP is listed upon sending spam to a spam trap, sending from multiple IPs within a range within a short period of time will result in a class C listing.Until an IP owner/authorized admin requests listing removal.Single IP Listed with Data result 127.0.0.#
Class C IP Block Listed with Data result 127.0.#.0
Codes are as follows:
  1. general spam, Sending spam to our spam traps.
  2. Removal request made but missing required information, please make a new request and be sure to complete the form properly.
  3. Does not follow valid can-spam rules for newsletters / lists.
  4. Not RFC compliant, server errors or improper configuration.
  5. Repeat offenders, these are IP's that have been removed and listed again or more times in a short period of time.
  6. Bouncing email to the wrong server, RFC-non-compliant configurations.
  7. Relay or Open relay with reports of spam.
  8. bouncing spoofed emails, you need to disable bounce of spoofed emails in order to get de listed.
  9. Fraud/Scam emails, malware or illegal/abusive content.
black.dnsbl.brukalai.ltIPs and domains for junk mail filtering.Mostly automatic with some manual additions.Until delisting requested.