Comparison of DNS blacklists
The following table lists technical information for a number of DNS blacklists.
Blacklist operator |
DNS blacklist |
Informational URL |
Zone |
Listing goal |
Nomination |
Listing lifetime |
Notes |
|---|---|---|---|---|---|---|---|
UCEPROTECT-Network |
UCEPROTECT Level 1 |
dnsbl-1.uceprotect.net |
Single IP's that send mail to ([Spamtraps]) |
Automatic by a cluster of more than 60 trapservers |
Automatic expiration 7 days after the last abuse was seen, optionally express delisting |
UCEPROTECT's primary and the only independent list |
|
UCEPROTECT Level 2 |
dnsbl-2.uceprotect.net |
Allocations with exceeded UCEPROTECT Level 1 listings |
Automatic calculated from UCEPROTECT-Level 1 |
Automatic removal as soon as Level 1 listings decrease below Level 2 listing border, optionally express delisting |
Fully depending on Level 1 |
||
UCEPROTECT Level 3 |
dnsbl-3.uceprotect.net |
ASN's with excessive UCEPROTECT Level 1 listings |
Automatic calculated from UCEPROTECT-Level 1 |
Automatic removal as soon as Level 1 listings decrease below Level 3 listing border, optionally express delisting |
Fully depending on Level 1 |
||
Spam and Open Relay Blocking System (SORBS) |
dnsbl |
dnsbl.sorbs.net |
Unsolicited bulk/commercial email senders |
N/A (See individual zones) |
N/A (See individual zones) |
Aggregate zone (all aggregates and what they include are listed on 5) |
|
safe.dnsbl |
safe.dnsbl.sorbs.net |
Unsolicited bulk/commercial email senders |
N/A (See individual zones) |
N/A (See individual zones) |
"Safe" Aggregate zone (all zones in dnsbl.sorbs.net except "recent" and "escalations") |
||
http.dnsbl |
http.dnsbl.sorbs.net |
Open HTTP proxy servers |
Feeder servers |
Until delisting requested. |
|||
socks.dnsbl |
socks.dnsbl.sorbs.net |
Open SOCKS proxy servers |
Feeder servers |
Until delisting requested. |
|||
misc.dnsbl |
misc.dnsbl.sorbs.net |
Additional proxy servers |
Feeder servers |
Until delisting requested. |
Those not already listed in the HTTP or SOCKS databases |
||
smtp.dnsbl |
smtp.dnsbl.sorbs.net |
Open SMTP relay servers |
Feeder servers |
Until delisting requested. |
|||
web.dnsbl |
web.dnsbl.sorbs.net |
IP addresses with vulnerabilities that are exploitable by spammers (e.g. FormMail scripts) |
Feeder servers |
Until delisting requested or Automated Expiry |
|||
new.spam.dnsbl |
new.spam.dnsbl.sorbs.net |
Hosts that have sent spam to the admins of SORBS in the last 48 hours |
SORBS Admin and Spamtrap |
Renewed every 20 minutes based inclusion in on 'spam.dnsbl.sorbs.net' |
|||
recent.spam.dnsbl |
recent.spam.dnsbl.sorbs.net |
Hosts that have sent spam to the admins of SORBS in the last 28 days |
SORBS Admin and Spamtrap |
Renewed every 20 minutes based inclusion in on 'spam.dnsbl.sorbs.net' |
|||
old.spam.dnsbl |
old.spam.dnsbl.sorbs.net |
Hosts that have sent spam to the admins of SORBS in the last year |
SORBS Admin and Spamtrap |
Renewed every 20 minutes based inclusion in on 'spam.dnsbl.sorbs.net' |
|||
spam.dnsbl |
spam.dnsbl.sorbs.net |
Hosts that have sent spam to the admins of SORBS at any time |
SORBS Admin and Spamtrap. |
Until delisting requested or matter resolved |
|||
escalations.dnsbl |
escalations.dnsbl.sorbs.net |
Netblocks of service providers believed to support spammers |
SORBS Admin fed. |
Until delisting requested and matter resolved. |
Service providers are added on receipt of a 'third strike' spam |
||
block.dnsbl |
block.dnsbl.sorbs.net |
Hosts demanding that they never be tested |
Request by host |
N/A |
|||
zombie.dnsbl |
zombie.dnsbl.sorbs.net |
Hijacked networks |
SORBS Admin (manual submission) |
Until delisting requested. |
|||
dul.dnsbl |
dul.dnsbl.sorbs.net |
Dynamic IP address ranges |
SORBS Admin (manual submission) |
Until delisting requested. |
Not a list of dial-up IP addresses |
||
rhsbl |
rhsbl.sorbs.net |
Aggregate RHS zones |
N/A |
N/A |
|||
badconf.rhsbl |
badconf.rhsbl.sorbs.net |
Domains with invalid A or MX records in DNS |
Open submission via automated testing page. |
Until delisting requested. |
|||
nomail.rhsbl |
nomail.rhsbl.sorbs.net |
Domains which the owners have confirmed will not be used for sending email |
Owner submission |
Until delisting requested. |
|||
Spamhaus |
SBL Advisory |
sbl.spamhaus.org |
Verified sources of spam, including spammers and their support services |
Manual |
From 30 minutes to a year or more, depending on issue and resolution |
||
XBL Advisory |
xbl.spamhaus.org |
Illegal third-party exploits (e.g. open proxies and Trojan Horses) |
Third-party (see Notes) with automated additions |
Varies, under a month. |
Includes the Composite Blocking List and parts of the Not Just Another Bogus List |
||
PBL Advisory |
pbl.spamhaus.org |
All Static, dialup & DHCP IP address space that is not meant to be initiating SMTP connections |
Manual |
Unknown |
Should not be confused with the MAPS DUL and Wirehub Dynablocker lists |
||
SBL+XBL |
sbl-xbl.spamhaus.org |
A single lookup for querying the SBL and XBL databases |
|||||
Zen |
zen.spamhaus.org |
A single lookup for querying the SBL, XBL and PBL databases. |
The one to use to get all. |
||||
ORBITrbl Aggressive RBL |
RBL |
rbl.orbitrbl.com |
Unsolicited bulk/Commercial email senders (Block Class C IP Block) |
Feeder servers |
Until delisting requested? (Only When Found to be Non Spam Source) |
Aggregate zone |
|
Composite Blocking List |
CBL |
cbl.abuseat.org |
Only IPs exhibiting characteristics specific to open proxies, spamware, etc. |
large spamtraps |
Temporary, until spam stops |
Imported by Spamhaus. Use ZEN instead, includes CBL. |
|
Passive Spam Block List |
PSBL |
psbl.surriel.com |
IP addresses which send spam to trap |
spamtraps |
Temporary, until spam stops |
||
Weighted Private Block List |
WPBL |
db.wpbl.info |
IP addresses which send UBE to members |
spamtraps |
Temporary, until spam stops |
||
SpamCop Blocking List |
SCBL |
bl.spamcop.net |
IP addresses which have transmitted reported email to SpamCop users |
users submit |
Temporary, until spam stops |
||
SpamCannibal |
spamcannibal.org |
bl.spamcannibal.org |
ip addresses and related generic netblock that have sent spam to local mail hosts |
spamtraps |
until removal requested and matter resolved |
listed=127.0.0.2 |
|
Distributed Sender Blackhole List |
list.DSBL.org |
list.dsbl.org |
all single hop relays |
tested by trusted testers |
until de-listing requested |
explanation of test methods |
|
multihop.DSBL.org |
multihop.dsbl.org |
the outputs of multihop relays |
tested by trusted testers |
until de-listing requested |
explanation of test methods |
||
unconfirmed.DSBL.org |
unconfirmed.dsbl.org |
all the output servers |
tested by Untrusted and anonymous testers |
until de-listing requested |
explanation of test methods |
||
Not Just Another Bogus List |
NJABL DNSBL |
dnsbl.njabl.org |
SMTP open relays, Multi-stage SMTP open relays, spam sources, Insecure CGI scripts that allow open relaying, open proxy servers |
spamtraps, testing, testing by trusted contributors |
Varies |
||
Bad host, no cookie |
bhnc.njabl.org |
These hosts have done things proper SMTP servers don't do. |
spamtraps |
until de-listing requested |
|||
Distributed Realtime Blocking List (DRBL) |
drand DRBL node |
spamtrap.drbl.drand.net |
IP addresses which send spam to trap, IP addresses which send UBE to members. |
Automated [de]listing. |
Varies from spam type, rate and other sophisticated factors. 30s-1w. |
Hight IP network aggregate threshold >= 254. |
|
Dynamic Realtime Blocking List |
RU RBL |
db.rurbl.ru |
IP addresses which send spam or viruses to mail server with special sensors. |
Automated [de]listing. |
Varies from spam or virus pushing characteristics. 5s - 20min. |
explanations |
|
Hostkarma |
hostkarma.junkemailfilter.com |
Detects viruses by behavior using fake high MX and tracking non-use of QUIT. |
Automated [de]listing |
Data lives for 3 days |
127.0.0.1=white 127.0.0.2=black 127.0.0.3=yellow |
||
External links
- Blacklists Compared, weekly reports since July 2001
- DNSBL Statistics - A comparison of several popular DNSBL's.
- Spam Links - DNS & RHS Blackhole Lists
- Spam Links - Dead DNS and RHS Blackhole Lists