Comparison of DNS blacklists
The following table lists technical information for a number of DNS blacklists used for blocking spam.
Blacklist operator | DNS blacklist | Zone | Listing goal | Nomination | Listing lifetime | Notes | Collateral listings | Notifies upon listing |
combined.mail.abusix.zone | Aggregate zone | Aggregate zone | Aggregate Zone | Single lookup that contains results from black, exploit and policy lists. | ||||
black.mail.abusix.zone | Lists individual IP addresses that have sent mail to spam traps. And some manual added netblocks. | Mostly Automatic with some manual additions. | For automated listings 5.6 days after last event, manual additions are permanent. | |||||
exploit.mail.abusix.zone | Lists IP addresses behaving in a way that indicates the IP is compromised, infected, proxy, VPN, TOR, malware, | Automatic | 5.6 days after last event | |||||
dynamic.mail.abusix.zone | Lists IP addresses that should not be connecting directly to MX, such as residential IPs etc. | Automatic | Permanent | Lists ranges that have generic or templated rDNS. Individual IPs can be delisted immediately via web. | ||||
dblack.mail.abusix.zone | Lists domains seen in spam hitting traps. | Automatic | 5.6 days after last event | Can be used as an RHSBL and a URIBL. | ||||
nod.mail.abusix.zone | Lists domains that are newly observed. | |||||||
shorthash.mail.abusix.zone | Lists short URLs seen in traps. | Automatic | 5.6 days after last event | Created to handle popular shorteners that are misused to hide domains from blacklisting. | ||||
drivehash.mail.abusix.zone | Lists URLs of online drive services seen in traps. | Automatic | 5.6 days after last event | Current only listing Google Drive and Yandex Disk URLs that are used to avoid domain blacklisting. | ||||
Domain expired in early 2020 | ||||||||
Domain expired in early 2020 | ||||||||
Domain expired in early 2020 | ||||||||
Domain expired in early 2020 | ||||||||
Domain expired in early 2020 | ||||||||
ARM Research Labs, LLC | truncate.gbudb.net | Extremely conservative list of single IP4 addresses that produce exclusively spam/malware as indicated by the GBUdb IP Reputation system. Most systems should be able to safely reject connections based on this list. | Automatic: IPs are added when the GBUdb "cloud" statistics reach a probability figure that indicates 95% of messages produce a spam/malware pattern match and a confidence figure that indicates sufficient data to trust the probability data. | Automatic: Continuous while reputation statistics remain bad. Warning: Produces false positives, and has no remedy/removal process. IPs are dropped quickly if the statistics improve. IPs are dropped within 36 hours if no more messages are seen. | Source data is derived from a global network of Message Sniffer filtering nodes in real-time. Truncate data is updated from statistics every 10 minutes. Warning: Unreliable, as it produces false positives. It is impossible to find additional information or to manually troubleshoot the problem. It is based on results created by their proprietary software running a proprietary algorithm. | |||
invaluement | Single IP addresses which only send UBE. Specializing in snowshoe spam and other 'under the radar' spams which evade many other DNSBLs. Has FP-level comparable to Zen. | Automatic, with extensive whitelists and filtering to prevent false positives | Typically an automatic expiration 11 days after the last abuse was seen, but with some exceptions | Spam samples are always kept on file for each listing. Removal requests are manually reviewed and processed without fees. | ||||
invaluement | Lists /24 blocks of IP addresses which usually only send UBE and containing at least several addresses which are confirmed emitters of junk mail. Collateral listings are kept to a minimum because subsections are often carved from /24 listings when spammers and legit senders share the same /24 block. | Automatic once at least several IP addresses from a given block are individually listed on ivmSIP, with extensive whitelists and filtering to prevent false positives | Expiration time increases to many weeks as the fraction of IP addresses in the /24 block in question sending junk mail increases | Removal requests are quickly and manually reviewed and processed without fees. | ||||
invaluement | Comparable to uribl.com and surbl.org, this is a list of IP addresses and domains which are used by spammers in the clickable links found in the body of spam messages | Automatic, with extensive whitelists and filtering to prevent false positives | Typically an automatic expiration several weeks after the last abuse was seen. | Spam samples are always kept on file for each listing. Removal requests are quickly and manually reviewed and processed without fees. | ||||
Service discontinued mid 2014 | ||||||||
UCEPROTECT-Network | dnsbl-1.uceprotect.net | Single IP addresses that send mail to spamtraps | Automatic by a cluster of more than 60 trapservers | Automatic expiration 7 days after the last abuse was seen, optionally express delisting for a small fee. | UCEPROTECT's primary and the only independent list | |||
UCEPROTECT-Network | dnsbl-2.uceprotect.net | Allocations with exceeded UCEPROTECT Level 1 listings | Automatic calculated from UCEPROTECT-Level 1 | Automatic removal as soon as Level 1 listings decrease below Level 2 listing border, optionally express delisting | Fully depending on Level 1 | |||
UCEPROTECT-Network | dnsbl-3.uceprotect.net | ASN's with excessive UCEPROTECT Level 1 listings | Automatic calculated from UCEPROTECT-Level 1 | Automatic removal as soon as Level 1 listings decrease below Level 3 listing border, optionally express delisting | Fully depending on Level 1 | |||
Spam and Open Relay Blocking System | dnsbl.sorbs.net | Unsolicited bulk/commercial email senders | N/A | N/A | Aggregate zone | |||
Spam and Open Relay Blocking System | safe.dnsbl.sorbs.net | Unsolicited bulk/commercial email senders | N/A | N/A | "Safe" Aggregate zone | |||
Spam and Open Relay Blocking System | http.dnsbl.sorbs.net | Open HTTP proxy servers | Feeder servers | Until delisting requested. | ||||
Spam and Open Relay Blocking System | socks.dnsbl.sorbs.net | Open SOCKS proxy servers | Feeder servers | Until delisting requested. | ||||
Spam and Open Relay Blocking System | misc.dnsbl.sorbs.net | Additional proxy servers | Feeder servers | Until delisting requested. | Those not already listed in the HTTP or SOCKS databases | |||
Spam and Open Relay Blocking System | smtp.dnsbl.sorbs.net | Open SMTP relay servers | Feeder servers | Until delisting requested. | ||||
Spam and Open Relay Blocking System | web.dnsbl.sorbs.net | IP addresses with vulnerabilities that are exploitable by spammers | Feeder servers | Until delisting requested or Automated Expiry | ||||
Spam and Open Relay Blocking System | new.spam.dnsbl.sorbs.net | Hosts that have sent spam to the admins of SORBS or SORBS Spamtraps in the last 48 hours | SORBS Admin and Spamtrap | Renewed every 20 minutes based inclusion in on 'spam.dnsbl.sorbs.net' | ||||
Spam and Open Relay Blocking System | recent.spam.dnsbl.sorbs.net | Hosts that have sent spam to the admins of SORBS or SORBS Spamtraps in the last 28 days | SORBS Admin and Spamtrap | Renewed every 20 minutes based inclusion in on 'spam.dnsbl.sorbs.net' | ||||
Spam and Open Relay Blocking System | old.spam.dnsbl.sorbs.net | Hosts that have sent spam to the admins of SORBS or SORBS Spamtraps in the last year | SORBS Admin and Spamtrap | Renewed every 20 minutes based inclusion in on 'spam.dnsbl.sorbs.net' | ||||
Spam and Open Relay Blocking System | spam.dnsbl.sorbs.net | Hosts that have allegedly sent spam to the admins of SORBS or SORBS Spamtraps at any time | SORBS Admin and Spamtrap. | Until delisting requested. | ||||
Spam and Open Relay Blocking System | escalations.dnsbl.sorbs.net | Netblocks of service providers believed to support spammers | SORBS Admin fed. | Until delisting requested and matter resolved. | Service providers are added on receipt of a 'third strike' spam | |||
Spam and Open Relay Blocking System | block.dnsbl.sorbs.net | Hosts demanding that they never be tested | Request by host | N/A | ||||
Spam and Open Relay Blocking System | zombie.dnsbl.sorbs.net | Hijacked networks | SORBS Admin | Until delisting requested. | ||||
Spam and Open Relay Blocking System | dul.dnsbl.sorbs.net | Dynamic IP address ranges | SORBS Admin | Until delisting requested. | Not a list of dial-up IP addresses | |||
Spam and Open Relay Blocking System | noservers.dnsbl.sorbs.net | No Servers Permitted by ISP Policy | Netblock Owner Administered | Not Applicable. | No Servers Permitted by ISP Policy | |||
Spam and Open Relay Blocking System | rhsbl.sorbs.net | Aggregate RHS zones | N/A | N/A | ||||
Spam and Open Relay Blocking System | badconf.rhsbl.sorbs.net | Domains with invalid A or MX records in DNS | Open submission via automated testing page. | Until delisting requested. | ||||
Spam and Open Relay Blocking System | nomail.rhsbl.sorbs.net | Domains which the owners have confirmed will not be used for sending email | Owner submission | Until delisting requested. | ||||
Spamhaus | sbl.spamhaus.org | Verified sources of spam, including spammers and their support services, per | Manual | From five minutes to a year or more, depending on issue and resolution | ||||
Spamhaus | xbl.spamhaus.org | Illegal third-party exploits | Third-party with automated additions | Varies, under a month, self removal via Composite Blocking List lookup. | Consists of the Composite Blocking List | |||
Spamhaus | dbl.spamhaus.org | Low reputation domains including legitimate domains which have been hacked. | Ranking of over 80 different metrics and machine learning | A few days. Self-removal generally allowed. | ||||
Spamhaus | pbl.spamhaus.org | Addresses not meant to be initiating SMTP connections, such as residential dynamic IPs | Manual, by providers controlling the IPs or by Spamhaus PBL Team | Self-removal | Should not be confused with the MAPS DUL and Wirehub Dynablocker lists | |||
Spamhaus | Domains registered within the last 24 hours. | Automated | ||||||
Spamhaus | sbl-xbl.spamhaus.org | A single lookup for querying the SBL and XBL databases | ||||||
Spamhaus | zen.spamhaus.org | A single lookup for querying the SBL, XBL and PBL databases. | Preferred list to check all Spamhaus listings with one query. | |||||
Their web server is down 2014-11-17 - Their RBL server is reporting all queries as SPAM. | ||||||||
cbl.abuseat.org | Only IP addresses exhibiting characteristics specific to open proxies, spamware, malware downloaders, botnets and the like. | Automatic: large spamtraps, production mail servers and other detection methods. | Less than a month after last listable event, self-removal via CBL lookup. | Use Spamhaus XBL or Spamhaus Zen instead; they include CBL. | ||||
IBM DNS Blacklist | dnsbl.cobion.com | This DNSBL zone is part of the default configuration for Proventia Mail Security System and Lotus Protector for Mail Security | ||||||
Passive Spam Block List | psbl.surriel.com | IP addresses used to send spam to trap | spamtraps | Temporary, until spam stops | ||||
DNSRBL - DNS Real-time Blackhole List | dnsrbl.org | IP addresses used to send spam to trap | spamtraps | Temporary, until spam stops | ||||
Weighted Private Block List | db.wpbl.info | IP addresses used to send UBE to members | spamtraps | Temporary, until spam stops | ||||
SpamCop Blocking List | bl.spamcop.net | IP addresses which have been used to transmit reported email to SpamCop users | Users submit | Temporary, until spam stops, has self removal | ||||
SpamRats | noptr.spamrats.com | IP addresses detected as abusive at ISP's using MagicMail Servers, with no reverse DNS service | Automatically Submitted | Listed until removed, and reverse DNS configured | ||||
SpamRats | dyna.spamrats.com | IP addresses detected as abusive at ISP's using MagicMail Servers, with non-conforming reverse DNS service indicative of compromised systems | Automatically Submitted | Listed until removed, and reverse DNS set to conform to Best Practises | ||||
SpamRats | spam.spamrats.com | IP addresses detected as abusive at ISP's using MagicMail Servers, and manually confirmed as spam sources | Manually Submitted | Listed until removed | ||||
SpamRats | auth.spamrats.com | IP addresses detected probing passwords or authenticating without sending mail | Automatically Submitted | Listed until removed | ||||
Offline since 2018-05-30. | ||||||||
Offline since 2010. | ||||||||
Junk Email Filter | hostkarma.junkemailfilter.com | Detects viruses by behavior using fake high MX and tracking non-use of QUIT | Automated listing | Black list Data lives for 4 days. White list data lives for 10 days. | 127.0.0.1=white 127.0.0.2=black 127.0.0.3=yellow | |||
As announced, all public zones are no longer functioning | ||||||||
As announced, all public zones are no longer functioning | ||||||||
As announced, all public zones are no longer functioning | ||||||||
Heise Zeitschriften Verlag GmbH & Co. KG, hosted by manitu GmbH | ix.dnsbl.manitu.net | Lists single IPs that send spam to spamtraps. Lists mailhosts, rather than domains, and thus blocks entire hosting providers and ISPs. | Automated listing due to spamtrap hits. Exceptions apply to bounces, NDRs and whitelisted IPs. | 12 hours after last listing or until self delisting | TXT records provide information of listing incident - NiX Spam also provides hashes for fuzzy checksum plugin for SpamAssassin. | |||
Site Deactivated by sponsor Christian Jung per http://inps.de/ as seen 2020-05-25 | ||||||||
blocklist.de | bl.blocklist.de | IP-Addresses who Attacks other Server/Honeypots over ssh, imap, smtp, ftp, web, rfi, sqli, ddos.... | Automatic: over Honeypots and with over 515 Users and 630 Servers from blocklist.de via Fail2Ban or own scripts | Automatic: 48 Hours after the last Attack. But earlier remove is available over the Delist-Link | Services are free. Source data is from Honeypot-Systems and over 515 User with 630 Servern there reports Attacks with Fail2Ban | |||
s5h.net Internet Services | all.s5h.net | Spam sources from email, forums, referrer spam and dictionary attacks | Traps | Twelve months unless ISPs request removal earlier | By request. ISPs can provide request exclusion. | |||
Domain expired in November, 2019 and service is discontinued. | ||||||||
realtimeBLACKLIST.com | rbl.realtimeblacklist.com | Spam Trap | List of IP addresses that sends spam or causing troubles with botnets or phishing | Until delisting requested. | Removal requests will be investigated and processed within 24 hours of submission. Previously known as IPrange.net RBL Project | |||
James Sawyer | security.jamessawyer.co.uk | Collection of Bad Actors from various sources, Works great with PiHole for personal use. | Spammers, Scammers, Malware, Cryptominers, TOR, botnets, phishing, attackers, harvesters, exfiltration etc. Basically anything and everything "bad" | Until delisting requested. | Removal requests will be investigated. Contact details provided. | |||
BarracudaCentral | b.barracudacentral.org | Spam Trap | Provides a list of IP addresses which are sending spam. The Barracuda Reputation system uses automated collection methods to add and delete IP addresses from the BRBL. | Until delisting requested. | Requires registration of administrator and hosts to use. Removal requests are typically investigated and processed within 12 hours of submission if provided with a valid explanation. | |||
SPFBL.net | dnsbl.spfbl.net | Bad reputation, difficult to identify the responsible, dynamic IP, SLAAC flag without genuine email service and inappropriate use of the URL | Provides a list of IPv4/IPv6 addresses and domains which are sending spam or phishing. | Until delisting requested or seven days with good reputation. | The feedback system runs at SMTP layer. See https://spfbl.net/en/feedback | |||
Offline Since May 2016 | ||||||||
ubl.unsubscore.com | IP addresses which have sent email to addresses harvested from suppression files | Traps | For 30 days after last offending message unless removal is requested | |||||
The NordSpam Project | bl.nordspam.com | IP addresses detected as unsolicited bulk/commercial email senders, webspam | Manual | Until delisting requested. | Removal requests are manually reviewed and processed without fees. | |||
The NordSpam Project | dbl.nordspam.com | Unsolicited bulk/commercial email senders, webspam | Manual | Until delisting requested. | Removal requests are manually reviewed and processed without fees. | |||
0spam.fusionzero.com | Spam Traps | A single IP is listed upon sending spam to a spam trap, sending from multiple IPs within a range within a short period of time will result in a class C listing. | Until an IP owner/authorized admin requests listing removal. | Single IP Listed with Data result 127.0.0.# Class C IP Block Listed with Data result 127.0.#.0 Codes are as follows:
| ||||
black.dnsbl.brukalai.lt | IPs and domains for junk mail filtering. | Mostly automatic with some manual additions. | Until delisting requested. |