Resources / Blocking
What is a blocklist?
A blocklist is a list of things a system refuses. For mail and the web, the things are domains, IP addresses and web addresses that attackers and spammers use. A mail server reads a blocklist before it accepts a message. A browser reads one before it opens a page. A DNS resolver reads one before it answers. The older word is blacklist, and the opposite, a list of what is always allowed, is an allowlist.
Who reads blocklists, and which ones
| Read by | What is listed | Examples | What happens |
|---|---|---|---|
| Mail servers | IP addresses and domains that send spam or phishing | Spamhaus ZEN and DBL, SURBL, URIBL, Barracuda | The receiving server asks the list over DNS for the sending address and for every domain in the message. |
| Browsers | Web addresses that phish, or that serve malware | Google Safe Browsing (Chrome, Firefox, Safari), Microsoft SmartScreen (Edge) | The browser checks the address before the page opens and shows a red warning page when it is listed. |
| DNS resolvers and firewalls | Domains that a network refuses to look up | Quad9, Cloudflare for Families, company DNS firewalls | The resolver answers that the name does not exist, or sends the person to a page that says it is blocked. |
| Security tools | Domains, addresses and file fingerprints seen in attacks | Threat intelligence feeds read by mail gateways, endpoint software and firewalls | The tool reads the feed several times an hour and refuses or flags what is on it. |
What is a DNS blocklist?
A DNS blocklist (a DNSBL, sometimes called an RBL) is a blocklist that answers questions over DNS. That makes it fast and cheap to ask, so a mail server can ask several lists about every message. To ask whether the address 192.0.2.1 is listed, the server reverses it and looks up a name under the list's zone:
1.2.0.192.zen.spamhaus.org → 127.0.0.2 (listed) example.com.dbl.spamhaus.org → no answer (not listed)
An answer in 127.0.0.0/8 means listed, and the last number says why. No answer means not listed. Domain lists work the same way with the domain in place of the reversed address, and a mail server asks them about the domains in links inside the message as well as the sender.
How a domain gets on a list
- Spam traps. Addresses that nobody uses for real mail. A domain that mails one is sending to a list it did not get with consent, or is a spammer.
- Reports. People and companies report phishing pages and messages. The operators check the evidence and list what holds up.
- Detection. Crawlers open new and reported pages and look for copied login forms and brand marks. A domain registered yesterday that copies a bank's name is watched closely.
- Neighbors. Some lists list a whole network range when much of it sends spam. A clean server on a dirty range can be listed with it.
"Domain blocked by your network": what it means
That message comes from the DNS resolver or the firewall of the network you are on: the office, the school, the hotel, or a filter on your router. The network reads a blocklist, and the domain you asked for is on it, or is in a category the network refuses. It does not always mean the domain is dangerous. A filter may refuse a whole category, such as file sharing. If you trust the domain, ask whoever runs the network; if you do not, the block did its job.
How to check whether a domain is listed
- Ask the mail lists. Spamhaus has a lookup page for IP addresses and domains, and several free tools ask many DNSBLs at once.
- Ask Google Safe Browsing. Google's Transparency Report has a site status page for any web address.
- Ask the security vendors. VirusTotal shows what several dozen vendors say about a domain or an address.
- If your own domain is listed, find the cause first: a compromised mailbox, a form that sends spam, a shared server. Then ask each list to remove it. Most lists have a removal form and act within a day once the cause is gone.
Other things called a blocklist
- A password blocklist is a list of passwords a service refuses because they are common or already leaked. NIST's guidance for passwords asks services to keep one.
- A GPU blocklist is the list of graphics drivers a browser does not trust. On a listed driver the browser draws pages without hardware acceleration.
- A shared block list on a social network is a list of accounts that one person blocks and others subscribe to.
Blocklists and lookalike domains
A blocklist is the fastest way to stop a lookalike domain that copies your name. Taking the name away from its owner takes days or weeks. Putting it on the lists that mail filters and browsers read takes minutes to hours, and protects everybody whose tools read those lists. Why we block first explains how we do it, and the open record shows which lookalikes of well known names are on a list today.