Status of ubl.unsubscore.com: OFFLINE

LashBack's unsubscribe blacklist ("UBL"), as described by its publisher "is a unique, real-time blacklist of IP addresses which have sent email to addresses harvested from suppression files." It's a neat idea, an interesting way to monitor unsusbcribe compliance. But it can be tricky when it comes to things like shared IP addresses, addresss leakage, subscription forgery or data breaches. As I haven't tested it in a while, I can't speak to its accuracy as far as a spam filtering tool. I did test it years ago but that data is so dusty as to not warrant digging it back up.

Anyway, the reason I mention this today is that I've seen a poster on the Mailop list indicate that the Lashback UBL DNSBL is currently unavailable. If you use this DNSBL (ubl.unsubscore.com) in any of your spam filtering tools, you'll want to remove it.

Status of dnsbl.inps.de: DEAD

Christian Jung launched the inps.de DNSBL way back on December 29th, 2007.

Christian described the listing criteria as follows: "Every day thousands of spam e-mails arrive on our e-mail servers, which have to be processed by our anti-spam system. If an email is recognized as spam, the IP address of the sender is recorded in a blacklist for a certain period of time in order to enable faster email processing and reduce the system load."

Today, May 25, 2020, he has announced that it is shutting down, due to concerns around GDPR and personal challenges brought on by the coronavirus pandemic.

He appears to be shutting it down in a graceful manner -- not "listing the world" as so many lists do as they wind down. This is good to see.

Note that in addition to the DNSBL dnsbl.inps.de, this also affects the DNSWL (whitelist) found at dnswl.inps.de. Both are ceasing.

If you use either the whitelist or blocklist in your email server config, you'll want to disable those checks as soon as possible. 

Status of all.rbl.webiron.net and bsb.spamlookup.net: DEAD or BROKEN

Two anti-spam blocking lists appear to have died or malfunctioned recently.

Users on the Mailop mailing list are reporting that Webiron (all.rbl.webiron.net) blocklist appears to be malfunctioning. Its domain has expired and the temporary holding pattern pending payment or termination has resulted in the Webiron DNSBL effectively "listing the world" because of wildcard DNS entries.

Another list, BSB (bsb.spamlookup.net), a DNSBL focusing on "comment spam," also recently appears to have died, as reported by MX Toolbox back on April 17th.

When most lists "die" or malfunction, they often end up with wildcard DNS entries in place, as this is a common domain DNS setting implemented by registrars, domain speculators, or domain parkers. What this means is that every single DNSBL query made to the DNSBL's domain is falsely returns with "yes, block that IP address." Meaning your spam filter suddenly blocks 100% of your inbound mail. This is bad news, if you like to actually receive inbound mail.

If you're using either of these lists, you should cease doing so immediately, as their use may impede your ability to receive inbound mail successfully. As always, it's important to pay attention what DNSBLs you use for spam filtering, and periodically review and ensure that they still exist and that they're working properly.

And if you run a DNSBL, see RFC 6471 for best practices around DNSBL management, including how to appropriately shut one down.

Status of bl.emailbasura.org: DEAD

The DNSBL Email Basura is no more. Email Basura ("Trash" in Spanish) appears to have been online since at least 2004, according to the Internet Archive. This anti-spam blocklist's DNSBL zone was "bl.emailbasura.org."

The domain emailbasura.org seems to have expired and been purchased by a domain speculator. The domain has wildcard DNS entries, meaning that any use of the old DNSBL zone in your email server may result in your server blocking all inbound mail. You don't want that! Remove the DNSBL zone "bl.emailbasura.org" from your mail server configuration as soon as possible.

Status of exitnodes.tor.dnsbl.sectoor.de: DEAD

As reported by Word to the Wise, the DNSBL at exitnodes.tor.dnsbl.sectoor.de seems to have gone extinct. Like has happened with other lists in the past, the domain now contains a wildcard DNS entry which is bad news for DNSBLs. This means that those folks who use this DNSBL to filter mail are going to get a match on every possible IP address in the world. Every possible IP address will show up as listed, even though it's not actually listed by the blocklist.

As a result, I strongly suggest that mail administrators stop using the exitnodes.tor.dnsbl.sectoor.de DNSBL immediately.

DNSBL lookup sites should stop including exitnodes.tor.dnsbl.sectoor.de in blocklist results; the information they display would be incorrect and would scare people into thinking that they are listed, when they are not.

I don't know much about this DNSBL. Based on its name, it seems to exist to allow people to block mail from servers that host TOR Exit Nodes. If you're receiving anonymized harassing mail, that might be something you'd want to block.

DNSBL.info has more information.

The Internet Archive suggests that this list has been around since at least February 7, 2005.

June 6, 2018 Update: The DNS "wildcard" entry has been removed. This should stop any false positive issues, and means that the list is no longer "listing the world." However, the blocklist is still offline, seemingly for good, and I still strongly suggest that mail admins cease use of this list immediately.

Status of bad.psky.me: QUESTIONABLE

Noted and respected spam filterer Spamhaus is indicating that they believe the the Protected Sky (bad.psky.me) blocklist is "fraudulent." They report that Protected Sky is "an anonymously-run DNSBL service which was pirating [Spamhaus] data and republishing it as its own work." Spamhaus further indicates that Protected Sky doesn't follow DNSBL best practices as indicated in RFC6471.

Status of anonwhois.org: DEAD

I first blogged about the ANONWHOIS blocking list back in 2010. It was very useful to identify domains were ownership information was cloaked from the public. Why? Because many of us in the anti-spam and security community think that for a domain being used for commercial purposes, it isn't right to hide who the owner is. And this obstruction to transparency is often exploited by bad guys who send spam and malware, to try to make it harder to identify them.

Status of bl.spamcannibal.org: DEAD

Back in 2016, I used this page to report on a temporary system issue with the Spam Cannibal DNSBL.

Today (May 30, 2018) I'm updating this page to let folks know that they should immediately cease using the Spam Cannibal blocking list. The domain spamcannibal.org seems to have expired and been taken over by somebody else. If you decide to visit the website, be careful! It tried to get me to install what I assume to be malware.

If you use this DNSBL in your mail server configuration, you're probably now rejecting all mail, as the domain has a wildcard DNS entry. This kind of thing makes a blocklist look like it has listed the whole world. Every IP address checked usually shows up as listed.

The Spam Cannibal DNSBL has been around since at least 2003. It was started by a gentleman that I think prefers to be anonymous, so I'm choosing not to name him. It was basically spamtrap-driven, though I believe it would sometimes list /24 blocks of IP addresses in response to some spamtrap hits. It wasn't that widely used, but back in the old days, it often put the fear of god into marketing senders when seeing a hit against this list on their favorite DNSBL checking tool. This was also good in that it helped to drive marketer understanding of how sending to bad addresses can cause bad things to happen. As the list was primarily spamtrap-driven, it was mostly safe for hobbyist mail server use (in my opinion, anyway).

I reached out to the publisher of the Spam Cannibal DNSBL He let me know that the DNSBL is dead and gone. It is no longer an ongoing concern.

Fifteen years is a pretty good run, if you ask me. I wish him best of luck on any future projects.

May 31, 2018 update: The operator of Spam Cannibal is working with some smart folks to shut down the list in a graceful fashion. While there is no longer a "wildcard DNS" issue, the list is no longer being updated and is retired; you should still remove it from your mail server configuration.

Status of truncate.gbudb.net: ALIVE

The "Truncate" DNSBL (zone truncate.gbudb.net) lists IPv4 addresses that have been observed transmitting "email containing spam, scams, viruses, or other malware based on statistics in the global GBUdb network." This "Good, Bad, Ugly database (GBUdb)" is a "real-time collaborative IP reputation system," based on statistics collected by email threat protection software Message Sniffer.

If you're listed on the Truncate DNSBL, can you request removal? No, explains the website. IP addresses are removed automatically, usually within a couple of days of the bad activity having ceased. They warn, however, that in some instances, if enough bad activity was denoted, it may take longer for an IP address to automatically disappear from their list.

Have any more information you'd like to share about this blocking list? Please feel free to contact me and I'll be happy to update this page with your additional information.

Status of dnsbl.ahbl.org: SHUTTING DOWN

On March 26, 2014, DNSBL administrator Brielle Bruns announced that the Abusive Hosts Blocking List DNSBLs are to be shut down.

In email to me, she explained:

"After quite a bit of thought and consideration, I've decided that it is time to wind down some of the AHBL's public DNSbl services - specifically the dnsbl, ircbl, and rhsbl. 

We've had a good 11 year run with the lists.  Times have changed -- with the deployment of IPv6 moving full speed ahead, I don't feel that the current implementation of our DNSbl services are suited to the task. 

This doesn't mean that the AHBL is going away - we'll still be around, just focusing our efforts on a mix of other anti-abuse related things and a relaunch of the RHSbl (likely in 2-3 months, possibly sooner). 

I look forward to continuing to work with the community, and appreciate and value the feedback I've received over the years."

As a result, the lists dnsbl.ahbl.org, ircbl.ahbl.org and rhsbl.ahbl.org, and associated public look up tools are being retired.

I've known Brielle for many years and my interactions with her have been universally positive. Congratulations on a long eleven year run with AHBL, and I hope whatever she works on next is something she finds fun and fulfilling.

Status of dnsblchile.org: ALIVE

DNSBL Chile, created in 2011, appears to be a Chilean homegrown effort to tackle spamblocking from a local perspective. As they explain on their website: "Existing DNSBL services aim to block spam based on the type and origin affecting certain types of user. Chilean spam is generally ignored by these DNSBLs, mainly because of the language barrier. This raises the need for a specific DNSBL for Chile, which is able to investigate cases of spam in South-American Spanish."

The DNSBL zone is just "dnsblchile.org" and they report a few different types of responses: 127.0.0.2 and 127.0.0.3 for "verified spam sources," 127.0.0.5 for "verified scam sources," and 127.0.0.10 and 127.0.0.11 for DUL/PBL-like dynamic/"should not be running an MTA" entries.

I don't know much about this list in particular but it's always nice to see somebody attempt to address a previously segment or region's spam problem.  If you have any thoughts or details around this list, don't hesitate to drop me a line.

(Crappy translation above courtesy of my high school Spanish + a little help from Google Translate.)

Status of APEWS: ????

Long-standing (though not very accurate) blocking list APEWS seemed to be down for the count. Their website at www.apews.org has been down since March 15th, according to David Ritz.

My recommendation to mail administrators is to stop using APEWS. But then again, was anybody using APEWS recently, anyway?

For history's sake, here's a link to the article I published long ago, explaining what to do if you find yourself listed by APEWS.

APEWS was previously down for three weeks in August, 2010.

Update: APEWS appears to have returned somewhere around May 1st, 2013.

It goes down, it comes back up, it goes down again, it comes back up again. At this point I think we'll just call it a status of "?????"

Status of spamtrap.trblspam.com: DEAD

The DNSBL spamtrap.trblspam.com appears to have gone offline as of April 2, 2013. It appears to have been created in early 2011 by somebody known as "Tom from TRBL," whom I observed participating in various email discussion lists. I've emailed Tom and will update this page if I receive any further details.

I recommend removing spamtrap.trblspam.com from any blocklist checking you're doing. Any time a list is shut down, there's a chance that they will end up putting in a wildcard DNS record, which ends up effectively "listing the world" and causing problems for any receiving sites who still have that DNSBL configured in their mail server configuration.

(Thanks to Martijn Grooten for the heads up.)

Status of dnsbl.njabl.org: DEAD

It is with sadness that I report  on the closure of Jon Lewis's NJABL blocking list.  From the NJABL website: "March 1, 2013: NJABL is in the process of being shut down. The DNSBL zones have been emptied. After "the Internet" has had some time to remove NJABL from server configs, the NS's will be pointed off into unallocated space (192.0.2.0/24 TEST-NET-1) to hopefully make the shutdown obvious to those who were slower to notice."

NJABL (Not Just Another Bogus List) had been in existence from at least January 2002. Congrats to Jon and team for a pretty good run of eleven years.

Update: I received this in email: "Today, April 29, 2013, NS for the NJABL DNSBL zones is being pointed into 192.0.2.0/24 (TEST-NET-1) which is unrouted IP space.  This will likely cause any systems using the NJABL DNSBL zones to experience long delays in DNS resolution of NJABL DNSBL lookups.  This is being done both to sink the DNS query traffic and to hopefully be noticed by the owners/managers of those systems."

(H/T: Laura Atkins and others.)

Status of bl.csma.biz: DEAD

An entity called McFadden Associates had been publishing two different, spamtrap-driven DNSBL zones starting from October 2003. Almost ten years later, it appears that these blocklist zones are no more.

The McFadden CSMA blocking list encompassed two different DNSBL zones. The primary zone, bl.csma.biz, contained only "aggressive" hosts that have spammed repeatedly during a short (recent) timeframe. An additional zone, sbl.csma.biz, had a broader listing criteria, noted by the publisher as more suitable for scoring in a filtering system than outright blocking.

As of January 2013, querying either zone will result in a false positive response, showing that an IP address is blocked, due to a wildcard DNS entry. This means that you should immediately stop using either DNSBL in your spam blocking configuration, otherwise you will reject all inbound mail, legitimate or not.

It's fairly common for a list, when dying, to intentionally or un-intentionally "list the world," answering any DNS lookup request with what amounts to a "yep, that's blocked" response. This regularly causes problems for unsuspecting email system administrators who may still be querying blocking lists that are now out of commission. That's why it's important to periodically review your inbound mail server's configuration to revisit what DNSBL lists you might be using and whether or not it makes sense to continue to use them.

In this case, these lists are no more, and should be removed from any mail server configurations where they may still linger.

I've reached out to the one-time publisher of these lists, and I will follow up with more information if he's able to provide more details.

Status of rfc-ignorant.org: SHUTTING DOWN

One-time Yahoo administrator Derek Balling has announced that the RFC Ignorant blocking list is being shut down. This blocking list had existed since at least late 2001. Its listing criteria including things like not having an "abuse" or "postmaster"address that accepted mail. Listing criteria didn't necessarily overlap with the generally accepted criteria for fighting spam, so my guess is that this blocking list's lack of usefulness as a spam fighting tool had finally diminished past the point of no useful return. As Derek himself says, "the usefulness of a DNSBL is greatly diminished," and of the old hardware running the service, "the value proposition just isn't there."

I blogged about the RFC Ignorant blocking list back in 2006.

Beware: "Fake" Blocking list at nszones.com

Spamhaus reports that they have "uncovered a fake spam filter company which was pirating and selling DNSBL data stolen from major anti-spam systems including Spamhaus, CBL and SURBL, republishing the stolen data under the name 'nszones.com.'"

Ouch. I guess if you publish a free or easily accessed spam filtering tool, it is inevitable that at some point somebody would try to take the data and repackage it against copyright and against the data owner's wishes.

If you find yourself listed on this blocking list; don't fret. If what Spamhaus says is true (and I have little reason to doubt them), then this list is not really being used to block email. (And should not be used to block email.) Ignore it, stay listed, and eventually they'll move on to easier targets.

If you're a system administrator, DO NOT use any of the DNSBL zones at nszones.com for spam filtering purposes. As its intent may not be above-board, I would have strong concerns about the possibility of listing things only to engender a payment for delisting -- for reasons having nothing to do with spam fighting.

TQMCUBE Status Updated

Here's a quick note to let you know that I've updated my page of information on the long-dead TQMCUBE blocking list. Click here for more information.

Status of dnsbl.net.au: DEAD

The blocking list at dnsbl.net.au has announced it is winding down. As noted in a February 25, 2009 posting on its website, "Please note that as of Wednesday, April 1, 2009 the DNSBL.NET.AU blacklist will cease to exist."

As of this writing on April 29th, 2009, I do still see active entries when querying via DNS, but I assume that these are likely to go away soon. If you utilize this list, I'd recommend removing it from your MTA or spam filter configuration.

Status of DSBL: DEAD

The DNSBL called "DSBL" is no more. As of March 11, 2009, their website reports: "DSBL is GONE and highly unlikely to return. Please remove it from your mail server configuration."