What is a DNSBL?

Look up 2.0.0.127.zen.spamhaus.org and an answer of 127.0.0.2 means the SBL, 127.0.0.4 means the XBL, and 127.0.0.10 or 127.0.0.11 mean a policy listing for a residential range. One query, several verdicts.

Most operators pair the A record with a TXT record explaining the listing and linking their removal page. Your mail server can quote that TXT straight into the rejection message.

The load is the operator's problem, and it is enormous. High-volume receivers are expected to run a local mirror over rsync rather than hammering the public resolvers, and public queries from a busy server get cut off.

Whitelists use the identical mechanism with the meaning inverted. A DNSWL listing tells a receiver this sender is known good, which usually buys a lower spam score rather than automatic acceptance.

Here's a failure that catches administrators out. A small company sets up a new mail server, points it at a public DNS resolver such as 8.8.8.8, and turns on Spamhaus checks. Within the hour, legitimate mail from customers is being refused as blocklisted.

The cause is in the return code. Spamhaus doesn't answer queries that arrive through large public resolvers. It replies with 127.255.255.254, an error value meaning the query came by a route it won't serve. Software that treats any answer as a listing then rejects every sender.

There are sibling codes in that 127.255.255 range for excessive query volume and for a mistyped zone name. None of them are verdicts on the IP you asked about. The fix is to query from your own resolver, or use the operator's keyed service, and to configure the mail server to act only on the specific return values that mean listed.

Domain lists use the same trick with a different key. To ask the Spamhaus DBL about a hostname, you put the name in front of the zone as it is, with no reversing: shortlinks.example.dbl.spamhaus.org. Reversal applies only to IP addresses, because DNS names already read from specific to general.

The answers come from another range. DBL replies look like 127.0.1.2 for a spam domain, with other last digits for phishing, malware and similar categories. Mail filters run these lookups against the links inside a message and against the domains in its headers.

You can verify your tooling against test points. Querying 2.0.0.127 under an IP zone should always come back listed, and 1.0.0.127 should always come back empty, as laid out in RFC 5782. If the first returns nothing from your server, your resolver is the problem and your real lookups can't be trusted either.