Popular topics: Abuse Contact Validation black

dblack

Domain blocklist (dblack.mail.abusix.zone)

Status: Production
Type: Domain, IPv4
Cloud DNS namespace: <key>.dblack.mail.abusix.zone.
Rsync File: lists/dblack.zone
Return Codes: 127.0.1.1, 127.0.1.2, 127.0.1.3
Test Points: *.test, 127.0.0.2, 127.0.1.1, 127.0.1.2, 127.0.1.3
Listing Duration: Approximately 5.2 days after last seen

Description

This list holds domains and IP addresses found in the message body of spam received to our primary traps.

Any short URL links found in spam are also followed and any intermediate or destination domains are also listed.

Info

This list should be used as a URI DNSBL (e.g. checking domain names or IP addresses found in the message body), but can also be used as an RHSBL where the rDNS, SMTP HELO, MAIL FROM domain, DKIM d= domain, Message-ID domain and List-Unsubscribe headers are checked against it.

It should not be used to check the connecting IP address though, only IP addresses found in the message body.

127.0.1.1 is returned for domains/IPs found in the message body.

127.0.1.2 is returned for domains that are newly observed (found by using other trap types).

127.0.1.3 is returned for domains found by following short URLs.

Info

To make this list as easy to implement as possible, it uses wildcard domains.  That means it lists the parent domain and any sub-domains, so you don't need to normalize the hostname or domain name before querying.

Example query:

$ host 2.0.0.127.<key>.dblack.mail.abusix.zone.
2.0.0.127.<key>.dblack.mail.abusix.zone has address 127.0.1.1
2.0.0.127.<key>.dblack.mail.abusix.zone has address 127.0.1.2
2.0.0.127.<key>.dblack.mail.abusix.zone has address 127.0.1.3


Note

When creating this list, we found that a lot of spam goes to great lengths to evade detection and uses open redirectors, short URLs and online drive services like Google Drive and Yandex Disk.   To address this we created several new types of list to combat this, see the shorthash and diskhash lists.

When dblack, shorthash and drivehash are used in combination - you will get the best possible coverage and protection available.

Was this article helpful?

Can’t find what you’re looking for?

Our award-winning customer care team is here for you.

Contact Support