Spamhaus Technology and abuse.ch Logo
Solutions
Data
Email & Network
Cyber Threat Intelligence
Resources
About

Real-Time
DNS Blocklists

Query a wide range of real-time DNS Blocklists (DNSBLs) covering IPs, domains, and hashes (including malware files, cryptowallets, email addresses and URLs) to protect your email infrastructure, wider network, and users.

Effective & efficient filtering

Block more than 99% of malicious email.

Immediate & trusted protection

Real-time updates with low-false positive rates.

No additional costs

Easily integrated into your existing infrastructure.

Spamhaus’ Data Query Service

Access to query the DNSBLs in real-time is provided by Spamhaus’ Data Query Service (DQS). Easily integrate the email threat intelligence data into your email infrastructure, and immediately protect against the vast bulk of spam and other email-borne threats at the SMTP gateway.

Why are there two different names for the data?

Our datasets have been supporting users for a very long time. With new users requesting our support, the dataset names are being updated for clearer understanding. We’re documenting two names, for now, to best support all users.

Datasets Included

Bruteforce IPs

(Authentication Blocklist - AuthBL)

IP addresses known to host bots using stolen credentials or brute-forcing SMTP-AUTH (and other authentication protocols), helping detect and mitigate ongoing abuse from malicious login attempts.

Compromised IPs

(Exploits Blocklist - XBL)

Email Spam IPs

(Combined Spam Sources - CSS)

Highly Malicious Networks

(Don't Route Or Peer - DROP)

Low Reputation Domains

(Domain Blocklist - DBL)

Low Reputation Resources

(Hash Blocklist - HBL)

Malicious network ranges

(Spamhaus Blocklist - SBL)

Non-mail emitting IPs

(Policy Blocklist - PBL)

Zero reputation domains

(Zero Reputation Domains - ZRD)

transition

Use cases for Real-Time DNS Blocklists

Querying DNSBLs in real-time has many applications beyond protecting your email infrastructure, wider network, and users from email-borne threats. They can also be used to ensure compliance.

Email Protection
Email Compliance
Email Protection
Transition

For Email Protection

Spamhaus sets the gold standard in DNSBLs for email protection. Trusted by the world’s largest mailbox providers, our data protects billions of users every single day.

Access affordable, effective protection for your email infrastructure and users, utilizing real-time threat intelligence data, with industry-leading low false positive rates.

Minimize security risks

Save on associated remediation costs and protect your reputation.

Reduce email infrastructure costs

Stop a large amount of unwanted email before it hits your network, saving on processing and storage costs.

Free up internal resources

With less time focused on email management, there is more time available for other issues.

Proactive protection

Our Domain datasets and Non-mail emitting IPs (Policy Blocklist) can protect against threats before they are seen in the wild.

Getting started

  • How to start a free 30-day trial

    Simply complete the form and submit. No credit card or payment details are required for the free trial.

    What happens next?

    You’ll receive an email asking you to verify your address. If you haven’t already, you’ll be prompted to create an account.

    Once verified, log in to the Customer portal to view your API key and follow the setup instructions provided in the manual.

    Need help?

    If you have any questions, please add them to the comments box on the form. Once you gain access to the data, technical support is available via our Customer Portal.

    How can I purchase the data?

    During your free trial, you can request a quote in the Customer Portal to get the subscription cost based on your setup. You can also enable trials of additional datasets via the Customer Portal.

  • System requirements

    Set up is straightforward, using your existing email infrastructure.

    Our real-time DNSBLs via Data Query Service can be used with most open-source tools, and we have specially designed plug-ins for SpamAssassin and Rspamd. Alternatively, it can be integrated with your existing anti-spam platforms.

    Go to Integrations for Real-time DNS Blocklists for more information.

    This ease of integration keeps costs to a minimum, with no additional hardware required.

  • Technical documentation

    Full set up details to access the real-time DNS Blocklists via the Data Query Service are on our documentation page.

  • Pricing

    Pricing is based on users and query volume, with final costs provided after the trial. Alternatively, please contact our sales team.

Ready to start
your free trial?

Get a free 30-day trial to query Spamhaus’ real-time DNSBLs via the Data Query Service. No credit card details required.

Sign up
Transition

Integrations

Real-Time DNS Blocklists

Halon Protect Integration

Ready-made integration, pre-configured in the Halon interface to provide instant email protection. Available to any Halon Protect customer.

Learn More

MDaemon® integration

Enable the pre-configured settings, to gain an additional and immediate layer of security protection. Available to any MDaemon® Email Server customer.

Learn More

Messageware Integration

Ready to go integration, with simple configuration enriching the EPG product for additional Microsoft Exchange Server protection. Available to any Messageware (EPG) customer.

Learn More

Rspamd Plug-in

Purpose-built plug-in available on GitHub to classify email and block spam based on an analysis of headers and message body – compatible with several MTAs.

Learn More

SpamAssassin Plug-in

Purpose-built plug-in available on GitHub to classify email and block spam based on an analysis of headers and message body – compatible with several MTAs.

Learn More
Speechmarks
Speechmarks

DQS is so fast – it’s amazing. We get all these benefits for a great price.

Alcides Zanarotti Junior

Director of Technology, UOL

Frequently Asked Questions

  • Who can use the Data Query Service?

    Email administrators and email engineers running their own mail transfer agent (MTA) or email infrastructure.

    You may qualify for a non-commercial Data Query Service account to query the DNSBLs, free of charge – you can check if you meet the usage criteria for a free account here. To understand what’s included in the free service, see this comparison table.

  • How to use Spamhaus’ DNSBLs for filtering

    First, incoming email sent from a listed IP address can be dropped at SMTP connect, saving storage and processing costs. You have the choice to block, accept, or quarantine messages according to your company policy.

    When an email is blocked, the sender will immediately receive a notification, ensuring that emails do not lie unread in junk folders for weeks.

    After blocking unwanted emails during the SMTP transaction, the remaining traffic can then be filtered by content utilizing our low reputation domains, low reputation resources, and zero reputation domains datasets.

    This staged process is considered best practice:

    • Remove obvious spam sent from known botnets and spammers’ IP addresses and domains.
    • Detailed analysis to identify emails containing malware or links to new websites that are controlled by spammers and cybercriminals.

    Read “Where to apply blocklists for effective email filtering” for further details.

Explore more

Data Access

Rsync

Incremental synchronization of binary and contextual datasets to local servers, including access to our entire binary DNS blocklist data. Efficiently transfer data by only copying changes between the source and destination.

Learn More

Data Access

Intelligence API

Integrate context-rich metadata relating to IP and domain reputation to enhance existing data feeds, or consume as an independent data source. Gain additional intelligence to monitor, assess and remediate as required.

Learn More

Data Access

DNS Response Policy Zones

Access our wide variety of DNS Response Policy Zone files to block or redirect access based on your appetite for risk. We provide the data, you set the terms, configurable to your business’ needs and company requirements/policies.

Learn More