Most blocklists are a black box. You get listed, your mail bounces, and nobody tells you why. We think that is the wrong way to run a blocklist. This guide explains every list in Abusix Mail (formerly known as Guardian Mail): what each one contains, how it is built, why an IP address or domain might end up on it, and how mail operators can use it. 

If you run mail for an ISP, hosting provider, telecom, or business, it will help you choose the right lists and configure them well.

What is a DNSBL?

A DNSBL (DNS-based blocklist, also called an RBL) is a list of IP addresses, domains, or URLs linked to spam, phishing, malware, or abuse. Your mail server checks it with a simple DNS query, usually while the sending server is still connecting.

If the answer comes back “listed”, you can reject the message, or add a score in your spam filter, before you spend any resources on it.

How we run our lists

Every Abusix list follows the same principles:

• Evidence first. We only list an IP address or domain when we have clear evidence of spam, phishing, malware or other abuse.
• Automated. Almost all listings are fully automated, so they are consistent and fast.
• Transparent. We publish how each list is built and how long listings last, and the Lookup & Delist service shows why an item is listed. We redact anything that could expose our spam traps.
• Fix, don’t punish. Our goal is to get problems fixed quickly. We never use listings to put pressure on anyone.
• Fair delisting with limits. You can delist yourself once we stop seeing abuse. If the abuse returns, the listing returns too, and repeated delisting is capped to stop the system from being gamed.
• Low false positives. Some large services are “too big to block” by IP address or domain without hurting legitimate mail. We tackle abuse from them in other ways, such as URL-level lists.

The lists at a glance

List	What it contains	Listing lasts	Best used for
Spam blocklist	IP addresses that sent mail to our spam traps	About 5.2 days after last activity	Rejecting at connection time
Exploit blocklist	IP addresses behaving like infected or compromised hosts	About 5.2 days after last activity	Rejecting at connection time
Policy blocklist	IP addresses that should never send mail directly to mail servers	Until the IP address is fixed	Rejecting at connection time
Combined blocklist	Spam, exploit and policy lists in one query	Per list	One fast query for inbound mail
Domain blocklist	Domains found in spam	About 5.2 days after last seen	Content filtering
Short URL list	Abused short URLs	About 5.2 days after last seen	Content filtering
Drive URL list	Abused online storage links	About 5.2 days after last seen	Content filtering
Authentication blocklist (AuthBL)	IP addresses of compromised hosts and brute-force attackers	About 12 hours	Logins: SMTP AUTH, SSH, web apps
Newly observed domains	Domains seen for the first time	25 hours	Scoring
Newly observed IPs	IP addresses seen sending mail for the first time	25 hours	Rejecting or scoring
Welcome lists	Trusted senders	n/a	Reducing false positives

Source: Abusix production zones documentation.

IP blocklists for connection-time checks

Spam blocklist

What it lists: IP addresses that have sent mail to our primary spam traps. These are domains that were never used for genuine mail, or that have rejected all mail for over a year, so anything they receive is unsolicited.

Why you might be listed: compromised accounts, infected hosts, botnets, purchased address lists, poor sign-up processes, open web forms, open proxies, Tor exit nodes and VPNs.

How to avoid it: use confirmed opt-in, protect sign-up forms from bots, never buy lists, and monitor outbound mail for compromised accounts.

Exploit blocklist

What it lists: IP addresses that behave in ways a genuine mail server never would. We watch how clients behave when they connect to our traps and partner mail services. Examples include a client claiming to be a host it isn’t, trying to log in to our trap network, seriously breaking email standards, or showing the signature of known spamware.

Why you might be listed: infected or compromised devices (PCs, servers, routers, IoT devices, websites), or a shared IP address such as a NAT pool, VPN or Tor exit used by an infected device. Many infections skip your mail server and connect straight to other mail servers on port 25, which also bypasses your rate limits.

How to avoid it: keep devices, firmware and plugins patched, run antivirus, and block outbound connections on port 25 from everything except your mail servers.

Policy blocklist

What it lists: every IPv4 address that should not send mail directly to other mail servers, such as home broadband ranges. It is preventive: it stops spam from new or hijacked IP addresses before our traps have even seen them.

How it is built: we scan the IPv4 address space and list addresses whose reverse DNS (rDNS) is missing, “templated” with parts of the IP address in the hostname, or identical across a range of addresses. Addresses running mail services on ports 25, 465 or 587, and addresses on our welcome lists, are excluded.

How to avoid it: give each mail server’s IP address an rDNS name that reflects its hostname and does not contain the IP address. Then request removal through the Lookup & Delist service. If you don’t run a mail server on that address, a listing has no effect on normal email use.

Combined blocklist

The combined list bundles the spam, exploit and policy lists into a single DNS query. It is the simplest and fastest option for most inbound mail servers.

Domain and URL lists for content filtering

Domain blocklist

What it lists: domains found in messages hitting our spam traps. We extract every domain and URL, remove anything on our welcome lists, and list the rest. For short URLs, we also list the domain the link points to.

Domains are reduced to their registrable “organisational” domain using the public suffix list. That stops spammers from dodging listings by switching subdomains. For services that give out free subdomains, we list only the abused subdomain, not the whole service.

How to avoid it: make sure your domain is not used in unsolicited mail, including by affiliates, and secure your websites so they can’t be compromised and used in phishing links.

Short URL list

Spammers hide destinations behind URL shorteners. Blocking the shortener itself would cause false positives, and following every short link in real time doesn’t scale. So we list the specific short URLs we have seen in spam, as hashes your filter can check instantly, even at hundreds of messages per second.

Drive URL list

Works the same way for links to online storage and file-sharing services, which are often used to deliver malware and phishing pages. Only the abused links are listed, never the whole service.

Protecting logins with the authentication blocklist (AuthBL)

AuthBL is built from our exploit data plus IP addresses we see attacking our SSH and telnet honeypots. It is designed for logins rather than incoming mail.

Check the IP address of anyone logging in to SMTP AUTH, SSH, or a web application. A successful login with a valid password from a listed IP address strongly suggests the account is compromised. You can flag it for review or block the login outright.

Listings expire about 12 hours after we last see activity. That short window avoids blocking legitimate users who later receive the same IP address from their provider.

Newly observed domains and IP addresses

Newly observed domains are domains we have just seen for the first time. Many new domains are legitimate, so this list works best as a score in your spam filter rather than a reason to reject.

Newly observed IPs are IP addresses that we have not seen sending mail before. New sending IP addresses are much more likely to be bad, so strict operators can reject them outright with few false positives. More cautious operators can add a score in tools such as SpamAssassin or rspamd. Both lists hold entries for 25 hours.

How to combine the lists

1. At connection: query the combined blocklist (or the spam, exploit and policy lists separately) and reject listed IP addresses.
2. At login: check AuthBL for SMTP AUTH, webmail and SSH logins.
3. In your content filter: check every domain, short URL and drive URL in the message against the domain, short URL and drive URL lists.
4. For scoring: add newly observed domains and IPs as extra signals, and use the welcome lists to reduce false positives.

Rejecting at connection time stops most spam before your content filters have to process it. That saves CPU, storage, and hardware.

Listed on one of our lists?

Look up your IP address or domain, fix the cause, and request removal. Here’s our step-by-step delisting guide.

Get started with Abusix Mail

Abusix Mail works with any mail system that supports DNSBL lookups, including Postfix, Exim, Microsoft Exchange, rspamd and SpamAssassin. See how Abusix Mail works, or read the setup guides in our documentation.