DNS Blocklist (DNSBL).

A DNS-based mechanism described in RFC 5782 that lets mail systems query a list of IP addresses or domains known to send spam or malware and apply blocking, scoring, or routing decisions. It belongs to the Network Security category of cybersecurity.

A DNS-based mechanism described in RFC 5782 that lets mail systems query a list of IP addresses or domains known to send spam or malware and apply blocking, scoring, or routing decisions.

A DNS Blocklist (DNSBL) — also called a Realtime Blackhole List (RBL) — exposes a list of bad IPs or domains under a DNS zone such as zen.spamhaus.org or bl.spamcop.net. A receiver reverses the IPv4 address, appends the zone, and performs a DNS A query: a positive response (typically 127.0.0.x) marks the source as listed, often with a TXT record explaining the category. RFC 5782 standardizes the query format and test entries (127.0.0.2). DNSBLs are central to greylisting, spam scoring, and edge filtering, but operators must understand listing criteria, latency, false positives, and delisting procedures. URI-based variants (URIBLs) check links in message bodies. DNSWL whitelists complement DNSBLs by signaling known-good senders.

Defences for DNS Blocklist (DNSBL) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: DNSBL, RBL, Real-time Blackhole List.