Frequently
Asked
Questions

FAQs | DNS Blocklists

• Datafeed Service: What kind of rbldnsd dataset types should I use?

  Rbldnsd defines a few different dataset types. To optimize performance and memory usage, we recommend Datafeed users to choose ip4set for SBL and SWL, ip4trie for PBL, and ip4tset for XBL.

  However, using ip4tset will result in a return code 127.0.0.4 for all XBL listings. In the majority of cases this is acceptable, but if you need to distinguish between the different XBL return codes you should use ip4set also for XBL.

  DBL and DWL must always use the dnset dataset type.

  Public mirrors are required to use ip4set for all the IP zones, and dnset for DBL and DWL.

• How do I know if I've correctly configured Spamhaus' Blocklists?

  With our free tool, the Blocklist Tester, you can check if your email servers are correctly configured to use the Spamhaus Blocklists. Simply visist: https://blt.spamhaus.com/

• How to use Spamhaus’ DNSBLs for filtering

  First, incoming email sent from a listed IP address can be dropped at SMTP connect, saving storage and processing costs. You have the choice to block, accept, or quarantine messages according to your company policy.

  When an email is blocked, the sender will immediately receive a notification, ensuring that emails do not lie unread in junk folders for weeks.

  After blocking unwanted emails during the SMTP transaction, the remaining traffic can then be filtered by content utilizing our low reputation domains, low reputation resources, and zero reputation domains datasets.

  This staged process is considered best practice:

  • Remove obvious spam sent from known botnets and spammers’ IP addresses and domains.
  • Detailed analysis to identify emails containing malware or links to new websites that are controlled by spammers and cybercriminals.

  Read “Where to apply blocklists for effective email filtering” for further details.

• I don't need this service, I am using Barracuda!

  The major part of spam filtering done by appliances such as the Barracuda is DNSBL filtering. If you are using any Spamhaus lookup in any part of a Barracuda or similar spam filter appliance you must ensure that you have a current Spamhaus Data Query Service (DQS) subscription.

  Historically, we have had cases of people using the Free Spamhaus Public Mirrors in conjunction with Barracuda appliances. This is an abuse of the Free Public Mirrors usage terms: If an organization’s email volume is big enough to require a Barracuda or similar spam filter appliance, then it almost certain that their usage will be above the limits applied to the free public DNSBL servers. Due to substained abuse of these public mirrors, and the Free low-volume DQS account, a control system has been implemented, and over-queriers will be flagged and blocked.

  Please ensure that if you are using Spamhaus DNSBLs in any part of your corporate spam filtering setup, you have a current Spamhaus DQS subscription.

• I need to test the Datafeed service first, before ordering it

  If you’re not sure how well the Spamhaus Blocklists/DNSBLs will perform to reduce incoming spam on your network, and your email traffic is too high to test using our free public DNS mirrors, you can test the Data Query Service service offered by Spamhaus for 30 days, free of charge and with no obligations.

• What happened to Spamhaus' Web Query Service?

  The Web Query Service is now called Blocklists via HTTPS. Only the name has changed. The service, the data and how you access it are all the same. The new name makes it clearer what you get (our blocklist data) and how you get it (HTTPS).

• What has happened to the Data Query Service?

  The Data Query Service is now called Blocklists via DNS Query. Only the name has changed. The service, the data and how you access it are all the same. The new name makes it clearer what you get (our blocklist data) and how you get it (DNS queries).

• Who can use Rsync?

  Rsync is ideal for larger networks that need to distribute data efficiently and maintain a local copy. It’s also suitable for networks where minimizing DNS latency is a concern.

• Who can use the DNS Blocklists via HTTPS?

  • Threat Intelligence Enrichment - this service is relevant for Security Engineers, Product Managers, and IR Specialists.

  • Email Protection and Compliance - Email administrators and email engineers running their own mail transfer agent (MTA) or email infrastructure.

• Why have the names of the datasets and data access methods changed?

  Many of our datasets and data access methods have served users for years under technical names and acronyms. As more people start using our data, we've renamed them so it's clearer at a glance what each one is. The legacy names haven't disappeared. You'll still see them in older documentation, and we list them below so you can match old to new.

  What has changed?

  Legacy name	New name
  Data Query Service (DQS)	Blocklists via DNS Query
  Web Query Service (WQS)	Blocklists via HTTPS
  BGP Firewall	Border Gateway Protocol
  DNS Firewall	DNS Response Policy Zones
  Spamhaus Intelligence API (SIA)	Intelligence API

  Legacy name	New name
  Authentication Blocklist (AuthBL)	Bruteforce IPs
  Botnet Controller List (BCL)	Botnet C2 IPs
  Hash Blocklist (HBL)	Low Reputation Resources
  Domain Dataset	Domain Intel
  Exploits Blocklist (XBL)	Compromised IPs
  Combined Spam Sources (CSS)	Email Spam IPs
  ASN DROP	Highly Malicious ASNs
  Don't Route Or Peer (DROP)	Highly Malicious Networks
  Domain Blocklist (DBL)	Low Reputation Domains
  Spamhaus Blocklist (SBL)	Malicious Network Ranges
  Policy Blocklist (PBL)	Non-mail Emitting IPs

  Does the data or service I receive change?
  No. Only the names have changed. The data, coverage and delivery are exactly as before.

  Do I need to update my configuration?
  No action is needed.

  Have the free Spamhaus Project blocklists been renamed?
  No. The SBL, XBL, DBL, PBL, CSS and DROP keep their names on the Spamhaus Project. The new names apply only to the commercial datasets available through Spamhaus Technology.

  Have the abuse.ch platforms been renamed?
  No. MalwareBazaar, ThreatFox, URLhaus and YARAify keep their names. Commercial access to their data is described as Malware samples, Malware IOCs, Malware URLs and YARA scan results.

  Why do I still see the old names in places?
  We're updating our website, documentation and customer materials in stages, so you may come across legacy names for a while. The tables above map each one.