DNSBL — DNS-based blocklist

What DNSBL means

A DNS-based blocklist answers reputation questions through the resolver a mail server already has. The address is reversed octet by octet and the zone appended, so 192.0.2.5 is queried as 5.2.0.192.dnsbl.example.net. An A answer in 127.0.0.0/8 means listed, and the final octet normally encodes why — one value for a spam trap hit, another for a policy listing, another for a compromised host. NXDOMAIN means not listed. A TXT query at the same name returns the reason in words and usually a delisting URL. The mechanics are documented in RFC 5782.

Domain-based zones work the same way without the reversal: the domain is prefixed to the zone, which is how URI and right-hand-side lists are queried. IPv6 listings expand the address into 32 nibbles and reverse them, in the style of ip6.arpa, before the zone is appended — enough work that many zones decline to publish them at all.

Two things matter when you query a zone yourself. Public zones rate-limit or refuse queries arriving from large shared resolvers, and a refusal can be mistaken for a listing. RFC 5782 requires every zone to list 127.0.0.2 and to leave 127.0.0.1 unlisted, which gives you a pair of queries that establish whether you are getting real answers at all before you trust any other result.