Frequently
Asked
Questions

FAQs | DNS Blocklists

• Datafeed Service: What kind of rbldnsd dataset types should I use?

  Rbldnsd defines a few different dataset types. To optimize performance and memory usage, we recommend Datafeed users to choose ip4set for SBL and SWL, ip4trie for PBL, and ip4tset for XBL.

  However, using ip4tset will result in a return code 127.0.0.4 for all XBL listings. In the majority of cases this is acceptable, but if you need to distinguish between the different XBL return codes you should use ip4set also for XBL.

  DBL and DWL must always use the dnset dataset type.

  Public mirrors are required to use ip4set for all the IP zones, and dnset for DBL and DWL.

• How do I know if I've correctly configured Spamhaus' Blocklists?

  With our free tool, the Blocklist Tester, you can check if your email servers are correctly configured to use the Spamhaus Blocklists. Simply visist: https://blt.spamhaus.com/

• How to use Spamhaus’ DNSBLs for filtering

  First, incoming email sent from a listed IP address can be dropped at SMTP connect, saving storage and processing costs. You have the choice to block, accept, or quarantine messages according to your company policy.

  When an email is blocked, the sender will immediately receive a notification, ensuring that emails do not lie unread in junk folders for weeks.

  After blocking unwanted emails during the SMTP transaction, the remaining traffic can then be filtered by content utilizing our low reputation domains, low reputation resources, and zero reputation domains datasets.

  This staged process is considered best practice:

  • Remove obvious spam sent from known botnets and spammers’ IP addresses and domains.
  • Detailed analysis to identify emails containing malware or links to new websites that are controlled by spammers and cybercriminals.

  Read “Where to apply blocklists for effective email filtering” for further details.

• I don't need this service, I am using Barracuda!

  The major part of spam filtering done by appliances such as the Barracuda is DNSBL filtering. If you are using any Spamhaus lookup in any part of a Barracuda or similar spam filter appliance you must ensure that you have a current Spamhaus Data Query Service (DQS) subscription.

  Historically, we have had cases of people using the Free Spamhaus Public Mirrors in conjunction with Barracuda appliances. This is an abuse of the Free Public Mirrors usage terms: If an organization’s email volume is big enough to require a Barracuda or similar spam filter appliance, then it almost certain that their usage will be above the limits applied to the free public DNSBL servers. Due to substained abuse of these public mirrors, and the Free low-volume DQS account, a control system has been implemented, and over-queriers will be flagged and blocked.

  Please ensure that if you are using Spamhaus DNSBLs in any part of your corporate spam filtering setup, you have a current Spamhaus DQS subscription.

• I need to test the Datafeed service first, before ordering it

  If you’re not sure how well the Spamhaus Blocklists/DNSBLs will perform to reduce incoming spam on your network, and your email traffic is too high to test using our free public DNS mirrors, you can test the Data Query Service service offered by Spamhaus for 30 days, free of charge and with no obligations.

• Who can use Rsync?

  Rsync is ideal for larger networks that need to distribute data efficiently and maintain a local copy. It’s also suitable for networks where minimizing DNS latency is a concern.

• Who can use the Web Query Service?

  • Threat Intelligence Enrichment - this service is relevant for Security Engineers, Product Managers, and IR Specialists.

  • Email Protection and Compliance - Email administrators and email engineers running their own mail transfer agent (MTA) or email infrastructure.