The legacy DNSBL service from the Spamhaus Project
The history – Researchers within the Spamhaus Project have been at the heart of IP reputation (and, latterly, domain reputation) since 1998. The wider internet community was part of the Project’s inception, i.e. like-minded individuals joined its Founder, Steve Linford, in observing, listing and sharing malicious IP addresses to help protect those using the internet. Naturally, it was an obvious choice for the Project to share its DNS Blocklists (DNSBLs) with non-commercial organizations for free.
The Project’s free DNSBLs were (and still are) shared globally via Public Mirrors, which at the time were generously donated by sponsors and partners of the organization. Email administrators must manually set up their email infrastructure to query these blocklists via a DNS zone, e.g. zen.spamhaus.org.
In-house, this service was (and is) referred to as the “Public Mirrors**“**. However, if you’re using these DNSBLs, you’ll likely think of them simply as “Spamhaus’ DNSBLs”.
This service still exists, and billions of queries are made to the Project’s Public Mirrors every day. This is the service that is listed as follows in the VB report:
BUT, many users are unaware that this is a legacy service. There is a superior service available, with access to additional blocklists to increase catch rates, real time listings, increased flexibility and improved performance (and it’s still free to non-commercial entities).
Welcome to the Real-Time DNS Blocklists
The history – Spamhaus Technology developed a service called the Data Query Service (now called the Real-Time DNS Blocklists). This service for commercial entities, takes the Project’s data, making it accessible in a way to met the demands of commercial use. As this service evolved, we started to offer the service to non-commercial users for free on behalf of the Project, so its “Public Mirror” users could also benefit from the improved service.
The differences – See here for a quick reference to understand how each of the services compares.
Getting the most from the Real-Time DNS Blocklists with plug-ins
We recognize that IT teams have increasing pressures placed on them, and as a result, they don’t always have the luxury of being able to specialize in one area. To maximize the benefits users can get from the DNSBLs, our engineers have created plug-ins for the two most popular open-source email filters; SpamAssassin & Rspamd. These free plug-ins provide configuration to immediately optimize our IP and reputation data to ensure users get the highest catch rates.
It is this set-up that is used for the VB test below:
Where is the 27% difference in VB scores?
For those wondering what the primary reasons for the noticeable difference between the two scores are, here’s our engineers’ explanation:
- Detection of abused legitimate websites hosting bad pages due to security problems.
- Additional scoring to mails injected through known password hijackers via the Bruteforce IPs Dataset (Auth Blocklist, AuthBL).
- Detection of domains that just appeared on the internet via the Zero Reputation Domains Dataset.
- Detection of bad email addresses, cryptocurrency addresses, and malware files via hashes on the Low Reputation Resources Dataset (Hash Blocklist, HBL).
- Detection of “hailstorm spam” campaigns through quickly rotating IPs and domains thanks to the real time feature.
- Detailed analysis of headers and contents done by the plugin.
Isn’t it time to maximize your catch rates?
If you’re using the legacy blocklists from the Spamhaus Project, we strongly urge you to move across to the Real-Time DNS Blocklists. Reconfiguration takes minutes, and you will be able to download a personalized manual via our Customer Portal once you sign up for the service.
*Correct at time of publication.