What is an RBL?

The design was clever and cheap: publish the list in DNS, and every mail server on earth already has a client for it. No new protocol, no subscriptions, no software to install.

A receiving server reverses the connecting IP, appends the list's zone, and asks for an A record. An answer means listed. No answer means unlisted. The whole check costs one DNS query.

Because the lookup happens during the connection, rejection lands at the handshake. The sender gets a 5xx naming the list, which is why bounce messages so often carry a URL you can visit.

The original RBL stopped being a free public list in 2001, when its operator moved to subscriptions after a run of lawsuits, and it later became part of Trend Micro. The name outgrew it and now covers the whole family, including lists that never used the original's rules.

Walk through a hypothetical connection from 203.0.113.45 to a company's mail server. The TCP connection opens, and before replying with a banner the server reverses the address and asks DNS for 45.113.0.203.zen.spamhaus.org. An answer comes back, so the address is listed.

What the server does next is a local choice. Some drop the connection at once. Many let the sender get as far as RCPT TO and refuse there with a 554 or 550 that names the list, because a rejection at that stage gets logged with the intended recipient and is easier for both sides to trace.

Either way, no message body was transferred. That's the economic argument for this design: the receiver spent one DNS query and a few packets, where scanning the content would have meant accepting the whole message first. For a server handling millions of connections a day, most of them junk, the saving is the reason the approach has lasted since the 1990s.

If you run a mail server, you choose how much authority to hand a list. Rejecting on a hit is fast and gives the sender a clear error. It also means that a false listing on someone else's system, made by an operator you've never spoken to, stops your customer's invoice from reaching you.

The common middle path is scoring. A content filter treats each listing as points toward a spam threshold, weighted by how much you trust that operator. One hit on a cautious list tips nothing on its own. Three hits at once do.

As a sender you can't see which approach a given recipient uses, and that's worth remembering when a lookup tool shows you a listing. A listing that means instant rejection at one company might cost you a fraction of a point at the next. Judge a listing by whether your mail is bouncing, and read the bounce text to see which operator the receiving server named.