GlossarySecurity and reputation
Blacklist
Definition
A blacklist is a directory of IP addresses or domain names flagged for sending unsolicited mail or hosting malicious content. Mail servers and browsers check it before accepting a message or displaying a page.
Two worlds, one effect
Mail lists are queried over DNS: you reverse the IP address, append the list's name, and any answer means “listed”. It is fast and free, which is why everyone does it, including on your client's messages.
On the browser side the mechanism differs and the effect is worse: a domain flagged for phishing or malware triggers a full warning screen before the page even renders. In both worlds you often get listed through no fault of your own — a compromised site, a hijacked form, an IP address shared with an inconsiderate neighbour.
How a mail list is queried
The address you are checking, written backwards and followed by the list's name.
Address checked 198.51.100.25
Name queried 25.100.51.198.zen.spamhaus.org
“Listed” answer 127.0.0.2
“Not listed” the name does not exist (NXDOMAIN)No answer is the good news: a name that does not exist means the address is not listed. And the value returned is not decoration — each list assigns it a meaning that tells you why the address was flagged.
The usual mistake
Finding out about a listing from a client whose mail has stopped going out. In the meantime, every refused send has been counted by the list, and getting off takes correspondingly longer.
How to avoid it: Check the lists that matter regularly, on the domain and on the sending server's address. Then, if you are listed, fix the cause before requesting removal: a delisting obtained without a fix is followed by a relisting.
Where the sources disagree: There is no “official” blacklist. Each one has its own listing and delisting criteria, and an address can be flagged by one and ignored by all the others. How many lists a domain appears on says more than appearing on one.
Source: The way DNS-queryable lists work is described in RFC 5782, which sets the convention of answers in the 127.0.0.0/8 range.
Related terms
Where to go next
Knowing the words is half the job
The other half is knowing which of your domains is about to become a problem. DomainVigil watches expiry, DNS, certificates and reputation, and tells you before your client does.
Start for freeFive domains free, forever. No card required.