# Blocklist (DNSBL): Definition and How It Works

Source: https://wraps.dev/glossary/blocklist

A blocklist (DNSBL) is a DNS-queryable list of IPs or domains associated with unwanted mail — checked by reversing the IP into a lookup subdomain and testing for a listing response.

## How the DNS trick actually works

A DNSBL is queried by reversing the octets of an IP address and appending the blocklist's zone — checking \`1.2.3.4\` against Spamhaus's ZEN list means querying \`4.3.2.1.zen.spamhaus.org\`. If that query returns an A record in the \`127.0.0.0/8\` range, the IP is listed; different addresses within that range often encode the listing reason. If the query returns nothing, the IP is clean on that particular list.

## A routable answer means something else entirely

A response outside \`127.0.0.0/8\` — a normal, routable IP address — does not mean you're listed. It typically means the DNSBL zone itself is misconfigured, wildcarded, or effectively dead, and a checking tool has to explicitly distinguish this case rather than treating any DNS answer as a listing, which is exactly the check Wraps' own blocklist code performs before reporting a result.

## Not every blocklist carries equal weight

Spamhaus's ZEN, SBL, XBL, and DBL lists, along with Barracuda's list, are treated as high-priority because major mailbox providers actually consult them when making delivery decisions. Smaller or more niche blocklists exist by the dozens and being listed on one of those carries far less real-world consequence — a comprehensive check still reports them, but not every listing deserves the same urgency.

## Domains get listed too, separately from IPs

IP-based blocklists (ZEN, XBL, PBL) catch a sending server's reputation; domain-based blocklists like Spamhaus's DBL catch a URL or domain that shows up inside message bodies being sent as spam, regardless of what IP sent it. A clean sending IP with a domain listed on the DBL — commonly because that domain is being abused inside someone else's spam content, not necessarily your own sends — still hurts deliverability.

## Why it matters

A listing on a major DNSBL is one of the few deliverability problems with a genuinely binary effect — mailbox providers that consult Spamhaus's lists will reject or heavily filter mail from a listed IP regardless of how clean everything else about the sender looks, which makes blocklist status worth checking on its own rather than assuming good authentication and low bounce rates are sufficient.

## How to check it

```
dig +short A 4.3.2.1.zen.spamhaus.org
```

## Common questions

### How does a DNSBL lookup actually work?

The IP's octets are reversed and appended to the blocklist's zone, then queried as a normal DNS A record — a returned address in 127.0.0.0/8 means listed, no answer means clean on that list, and an address outside that range means the zone itself is likely broken rather than an actual listing.

### Are all blocklists equally important to clear?

No. Spamhaus's ZEN, SBL, XBL, and DBL, plus Barracuda's list, matter because major mailbox providers actually consult them. Being listed on a smaller, niche DNSBL has far less real-world delivery impact even though a thorough check will still report it.

### Can my domain get blocklisted even if my sending IP is clean?

Yes. Domain-based lists like Spamhaus's DBL track domains appearing in spam content across any sender, not the reputation of a specific sending IP — your domain can be listed because it's being abused inside someone else's spam, independent of your own sending IP's status.