When a mail server receives a message, one of the first checks it can perform is to ask one or more blocklists whether the sender's IP address, or the domains inside the message, are known for sending spam. These lists, also called blacklists, are queried via DNS: hence the name DNSBL. Being listed can get your mail rejected by many recipients at once, but not every list carries the same weight and not every listing is equally serious.
How a DNSBL works
The mechanism is simple. To check the IP 192.0.2.45, the receiving server reverses its octets and queries a name in the list's zone:
dig +short 45.2.0.192.dnsbl.example.org A
If the answer is empty, the IP is not listed. If the answer is an address in the 127.0.0.x block, the IP is listed, and the last number often indicates the reason. Many lists also provide a TXT record with a short explanation and a pointer to the removal page.
Besides IP lists there are domain lists, which check the domains found in the message's links or in the sender. A domain on one of these lists can send to spam a message sent from a flawless IP.
Not all lists are equal
There are a great many blocklists, but only a few are used by a significant number of providers and companies. The rest have marginal or no impact. Before worrying, then, you need to understand who uses the list you are on.
They can be told apart by behaviour:
| Type of list | Characteristics |
|---|---|
| widely used, well-run lists | clear criteria, automatic removal once the problem stops, high impact |
| dynamic or residential IP lists | include whole blocks of home addresses that shouldn't send mail directly |
| aggressive lists | list a provider's entire blocks because of a few customers' behaviour |
| pay-for-removal lists | often little used; paying rarely solves a real problem |
Online tools that query dozens of lists at once are useful for a first check, but the result needs judgement: a listing on a list nobody consults does not explain a drop in delivery.
Understand the reason before requesting removal
A listing is a symptom. The most common causes are:
- mail to spam traps, from bought or old lists;
- a compromised account: a mailbox with a stolen password used to send spam;
- a compromised website sending mail through a script planted by an attacker;
- a misconfigured server, for example an open relay or an unprotected web form;
- complaint spikes after a send to a poorly engaged audience;
- an inherited IP: a new address assigned by a provider, previously used by others.
The first four are security problems, not marketing problems. If a server is sending spam without your knowledge, delisting is the last thing to do: first find and close the hole, or the listing will be back within hours.
Where to look
- the mail server logs, looking for abnormal volumes, unknown recipients or accounts sending at unusual hours;
- the outbound queue, which often holds thousands of stuck messages;
- the website's files, looking for recent scripts that call mail functions;
- DMARC reports, which can show traffic from your domain leaving from IPs you don't recognise.
The removal procedure
Once the cause is fixed:
- read the list's removal page and rules: some remove entries automatically after a period without new problems;
- fill in the request briefly and concretely, explaining what happened and what was corrected;
- don't send repeated or argumentative requests;
- after removal, keep monitoring for a few weeks.
For a sending platform's shared IPs, management belongs to the platform: your job is to report the problem and make sure your own traffic isn't the cause.
Prevention
Periodic monitoring of the most important lists, for both IPs and domains, lets you notice a listing before your customers do. Add the basic measures: strong passwords and multi-factor authentication on mailboxes, website updates, per-account sending limits, bot-protected forms.
In short
- DNSBLs are queried via DNS and can cover IPs or domains found in messages.
- Only a few lists have real impact: what counts is who uses them, not how many there are.
- Many listings stem from compromised accounts or sites, in other words from security problems.
- Request removal only after eliminating the cause, with a brief, concrete request.
- Periodic monitoring and basic security measures prevent most cases.
