Spamhaus Explained: The SBL, XBL, and DBL

Spamhaus is a nonprofit that tracks spam and malware sources and publishes that data as blocklists. Mail providers query those lists in real time to decide whether to accept, defer, or reject a message. If your sending IP or your domain shows up on a Spamhaus list, a large share of the email world may quietly stop trusting your mail. That makes Spamhaus one of the single biggest factors in whether your messages reach an inbox, which is why it sits at the center of Domain reputation explained.

The organization started in 1998 and has grown into one of the most referenced abuse databases on the internet. Its lists are not the only ones in use, but they are arguably the most consequential, because so many receivers consult them. To understand why a listing carries weight, it helps to know what each list actually covers and how receivers query them. For the underlying query mechanism, see what is a DNSBL, and for the recovery side, see how to get delisted from a blocklist.

Who Spamhaus is and why receivers trust it

Spamhaus maintains its data through a mix of automated sensors, spam traps, malware analysis, and human research. The result is not a single list but a family of them, each scoped to a different kind of problem. Some target the IP address that connected to a mail server; others target the domain found in the message body or envelope. Receivers pick the lists that match their risk tolerance.

The reason all this matters comes down to volume. When a major provider or a corporate mail gateway rejects on a Spamhaus hit, the sender does not get a second chance for that message. Listings are reputational rather than punitive, so the path out always runs through fixing whatever triggered the entry.

The main Spamhaus lists

Each list answers a different question about a connecting host or a referenced domain. The combined zone, ZEN, bundles the IP-based lists into one query so receivers do not have to check each separately.

List	What it covers
SBL (Spamhaus Block List)	IP addresses Spamhaus verifies as sources of spam, plus known spam operations and their infrastructure.
CSS	An automated component of the SBL. Entries are added and removed algorithmically rather than by hand, which is why a CSS listing can appear without any human research step.
XBL (Exploits Block List)	Hijacked, infected, or otherwise exploited machines: open proxies, worms, and compromised hosts sending without the owner's knowledge.
PBL (Policy Block List)	Ranges of end-user and dynamic IP addresses that should not be delivering mail directly to the internet, typically home and dynamic ISP space.
DBL (Domain Block List)	Domains with poor reputation, including spam, phishing, and malware domains, regardless of which IP sends them.
ZEN	A single combined zone covering SBL, XBL, and PBL data so a receiver can query everything IP-based in one lookup.

The split is deliberate. An IP on the PBL is not accused of anything; it simply sits in a range that should route mail through a provider's relay instead of talking to receivers directly. An IP on the XBL is usually a victim, a machine taken over without its owner noticing. An entry on the SBL or DBL points to actual spam activity tied to that address or domain.

How providers use the lists

Receiving mail servers query these zones over DNS, the same protocol covered by the standard for DNS-based blocklists. When a connection arrives, the server reverses the sending IP, appends the list's zone, and looks it up. A match returns a coded answer that tells the receiver which list fired and, in some cases, why.

What happens next is the receiver's choice. Some reject outright on any hit; others raise a spam score, defer the message, or apply extra filtering. A DBL hit often weighs into content scoring rather than a flat block, since the domain might appear in otherwise legitimate mail. Because policies vary, a listing does not guarantee a bounce everywhere, but it reliably erodes deliverability across the board.

How to check a listing yourself

The query format follows the DNSBL convention: reverse the four octets of the IP, append the zone, and ask for an A record. For the address 192.0.2.10 against ZEN, that means looking up 10.2.0.192.zen.spamhaus.org.

Spamhaus keeps 127.0.0.2 permanently listed as a test entry, so you can confirm your setup works before trusting a negative result:

dig +short 2.0.0.127.zen.spamhaus.org
127.0.0.10
127.0.0.4
127.0.0.2

Three answers came back from one query, which is the point of the combined zone. That test address is listed in the PBL, the XBL, and the SBL simultaneously, and ZEN reports each hit as its own record. Real lookups behave the same way, so read every answer rather than the first one.

If you run that command and get a single 127.255.255.254 back instead, nothing is listed and nothing is broken. Your queries are reaching Spamhaus through a public resolver, which the free zones refuse to answer. The next section covers what to do about it. A domain check against the DBL drops the reversal, since you query the name directly:

dig +short example.com.dbl.spamhaus.org

No answer means no listing. That is the result you want.

What the return codes mean

A hit encodes which dataset fired. These are the codes you will meet in practice, per the Spamhaus zone documentation:

Code	Zone	Meaning
127.0.0.2	ZEN	SBL listing
127.0.0.3	ZEN	CSS, an automated SBL listing
127.0.0.4	ZEN	XBL, a compromised or exploited host
127.0.0.9	ZEN	DROP, returned alongside an SBL hit
127.0.0.10	ZEN	PBL range entered by the ISP
127.0.0.11	ZEN	PBL range entered by Spamhaus
127.0.1.2	DBL	Low-reputation domain
127.0.1.4	DBL	Phishing domain
127.0.1.5	DBL	Malware domain
127.0.1.6	DBL	Botnet command-and-control domain
127.0.1.102	DBL	Abused legitimate domain
127.0.1.103	DBL	Abused redirector

Anything in the 127.255.255.x range is an error rather than a listing, and misreading one as a block wastes a lot of debugging time:

Code	What went wrong
127.255.255.252	Typing error in the DNSBL zone name
127.255.255.254	Query arrived via a public or open resolver
127.255.255.255	Excessive query volume

That middle one catches people constantly. Spamhaus does not serve the free blocklists to queries coming through Google Public DNS, Cloudflare, Quad9, or similar, so a server configured to use one of them gets 127.255.255.254 on every lookup and either treats everything as listed or silently stops filtering. Free use also carries conditions worth knowing before you build on it: Spamhaus limits it to non-commercial querying that does not originate from a public resolver or an IP with generic reverse DNS. Run your own recursive resolver, or subscribe to the Data Query Service, and the problem disappears.

What a listing actually means

A Spamhaus entry is a statement that something looked wrong, and every entry carries a reason. The SBL records the evidence behind a listing. The PBL reflects a network policy, not abuse. The XBL signals a likely compromise that needs cleaning. Reading the listing reason is the first real step, because it tells you whether you are dealing with a hacked server, a bad neighbor on shared infrastructure, a misconfigured relay, or genuine spam coming from your systems.

Removal is never just a request. A delisting that skips the underlying fix tends to reverse itself within hours or days, because the same behavior trips the same detection again. Diagnose the cause, repair it, then ask for removal in that order.

Want to know whether a domain or its mail servers are showing up on Spamhaus or other lists? Run a free reputation check at DomainIntel and see exactly where it stands.