Frequently
Asked
Questions

FAQs | Data Query Service

• Datafeed Service: What kind of rbldnsd dataset types should I use?

  Rbldnsd defines a few different dataset types. To optimize performance and memory usage, we recommend Datafeed users to choose ip4set for SBL and SWL, ip4trie for PBL, and ip4tset for XBL.

  However, using ip4tset will result in a return code 127.0.0.4 for all XBL listings. In the majority of cases this is acceptable, but if you need to distinguish between the different XBL return codes you should use ip4set also for XBL.

  DBL and DWL must always use the dnset dataset type.

  Public mirrors are required to use ip4set for all the IP zones, and dnset for DBL and DWL.

• How can I get access to the Hash Blocklist (HBL)?

  Access to the HBL is available only through a paid subscription. You can view a comparison of the data included in our services here.

  Here’s how to get access:

  Free account holders:
  You can trial the HBL for free for 30 days. Just log in to the Customer Portal and click on “Convert to commercial trial”. If you choose not to continue after the trial, you can revert to a free account, subject to usage terms.

  Current DQS (IP-only) customers:
  Please reach out to your Spamhaus Sales contact to discuss upgrading your access.

  New to Spamhaus?
  Please complete this 30-day DQS trial form to request access.

• How do I know if I've correctly configured Spamhaus' Blocklists?

  With our free tool, the Blocklist Tester, you can check if your email servers are correctly configured to use the Spamhaus Blocklists. Simply visist: https://blt.spamhaus.com/

• How to use Spamhaus’ DNSBLs for filtering

  First, incoming email sent from a listed IP address can be dropped at SMTP connect, saving storage and processing costs. You have the choice to block, accept, or quarantine messages according to your company policy.

  When an email is blocked, the sender will immediately receive a notification, ensuring that emails do not lie unread in junk folders for weeks.

  After blocking unwanted emails during the SMTP transaction, the remaining traffic can then be filtered by content utilizing our low reputation domains, low reputation resources, and zero reputation domains datasets.

  This staged process is considered best practice:

  • Remove obvious spam sent from known botnets and spammers’ IP addresses and domains.
  • Detailed analysis to identify emails containing malware or links to new websites that are controlled by spammers and cybercriminals.

  Read “Where to apply blocklists for effective email filtering” for further details.

• I don't need this service, I am using Barracuda!

  The major part of spam filtering done by appliances such as the Barracuda is DNSBL filtering. If you are using any Spamhaus lookup in any part of a Barracuda or similar spam filter appliance you must ensure that you have a current Spamhaus Data Query Service (DQS) subscription.

  Historically, we have had cases of people using the Free Spamhaus Public Mirrors in conjunction with Barracuda appliances. This is an abuse of the Free Public Mirrors usage terms: If an organization’s email volume is big enough to require a Barracuda or similar spam filter appliance, then it almost certain that their usage will be above the limits applied to the free public DNSBL servers. Due to substained abuse of these public mirrors, and the Free low-volume DQS account, a control system has been implemented, and over-queriers will be flagged and blocked.

  Please ensure that if you are using Spamhaus DNSBLs in any part of your corporate spam filtering setup, you have a current Spamhaus DQS subscription.

• I’m using the Spamhaus Project’s free DNSBLs and experiencing issues

  If you have started to encounter issues with your mail stream because you are outside the Spamhaus Project’s Fair Use Policy e.g. querying via a public DNS service (e.g. Google Public DNS, OpenDNS, Cloudflare DNS, Quad9) or excessive query volumes, please ensure you action one of the following points BEFORE applying for a Free DQS account. Otherwise, our registration email may not reach you.

  1. Correctly configure your MTA to accept error codes with these config guides for commonly used MTAs, or
  2. Remove the existing Spamhaus Project DNSBL configuration from your MTA.

• I need to test the Datafeed service first, before ordering it

  If you’re not sure how well the Spamhaus Blocklists/DNSBLs will perform to reduce incoming spam on your network, and your email traffic is too high to test using our free public DNS mirrors, you can test the Data Query Service service offered by Spamhaus for 30 days, free of charge and with no obligations.

• What does return code 127.0.3.255 mean?

  The return code 127.0.3.255 indicates an error: IP queries are not allowed in the Hash Blocklist (HBL) zone.

  This code means your system sent an IP-based query to the HBL zone, which only accepts hash-based (e.g., SHA56 or SHA1) queries. IP lookups are not supported.

  This can happen if you’ve added the HBL zone to your MTA configuration together with IP-based zones like Spamhaus Blocklist (SBL) or Exploits Blocklist (XBL).

  To resolve this, check your configuration and ensure that IP queries are only sent to zones that support them. Refer to the technical documentation for detailed instructions on configuring your MTA correctly for the Data Query Service.

• Who can use the Data Query Service?

  Email administrators and email engineers running their own mail transfer agent (MTA) or email infrastructure.

  You may qualify for a non-commercial Data Query Service account to query the DNSBLs, free of charge – you can check if you meet the usage criteria for a free account here. To understand what’s included in the free service, see this comparison table.