DNSBL return codes

I’m a big fan of using DNSBLs in front of a mailserver to reject egregious spam. A surprising number of DNSBLs return multiple different IPs indicating different things, beyond the standard 127.0.0.2 listing. As I spent a bit looking into this for my postscreen configuration, I figured I’d write up what I’ve found here.

It should go without saying, but I’m some random dude on the Internet, not an authoritative source on these. Where I can, I link to official docs.

At this time I am only listing IP-based lists, not URIBLs or RHSBLs.

See https://www.intra2net.com/en/support/antispam/index.php_sort=inaccuracy_order=asc.html for comparisons of accuracy.

zen.spamhaus.org

https://docs.spamhaus.com/datasets/docs/source/10-data-type-documentation/datasets/030-datasets.html documents these.

IP Address	Meaning
127.0.0.2	SBL: Spamhaus’s manually-managed list of spam operation IPs
127.0.0.3	CSS: Automated spam listings
127.0.0.4	XBL: Exploit Blocklist
127.0.0.5	XBL: unused?
127.0.0.6	XBL: unused?
127.0.0.7	XBL: unused?
127.0.0.9	DROP: “Don’t Route or Peer,” known spam operations
127.0.0.10	PBL: IP is in a policy blocklist, with data provided by the ISP.
127.0.0.11	PBL: IP is in a policy blocklist, as determined by Spamhaus.
127.0.0.20	AuthBL: Brute force / credential hijacking
127.0.0.30	BCL: Botnet Controller List, perhaps less relevant to SMTP

ip.v4bl.org

https://v4bl.org for docs

IP Address	Meaning
127.0.0.2	Spam source
127.0.0.3	Reverse DNS / FCRDNS issues
127.0.0.4	“Hacking”
127.0.0.5	Auth abuse
127.0.0.6	Scanners

dnsbl.dronebl.org

Docs: https://dronebl.org/docs/howtouse

IP Address	Meaning
127.0.0.2	Sample (?)
127.0.0.3	IRC Drone
127.0.0.5	“Bottler” (?)
127.0.0.6	Spambot/drone
127.0.0.7	DDoS
127.0.0.8	SOCKS proxy
127.0.0.9	HTTP proxy
127.0.0.10	ProxyChain
127.0.0.11	Webpage proxy
127.0.0.12	Open DNS resolver
127.0.0.13	Brute force attacks
127.0.0.14	Wingate proxy
127.0.0.15	Compromised router
127.0.0.16	Worms
127.0.0.17	Botnet IP
127.0.0.18	“DNS/MX type hostname detected on IRC”

(I don’t understand the implications of using some of these on a mailserver.)

I have seen 127.0.0.6 and 127.0.0.13 on my mailserver.

bl.fmb.la

https://web.archive.org/web/20250617081306/https://fmb.la/pages/about

IP Address	Meaning
127.0.0.2	Standard Level 1 listing
127.0.1.24	Spammy /24 (77+ IPs in /24 sending spam)
127.0.1.25	Spammy /25 (38+ IPs in /25 sending spam)
127.0.1.26	Spammy /26 (19+ IPs in /26 sending spam)
127.0.1.27	Spammy /27 (10+ IPs in /27 sending spam)
127.0.1.28	Spammy /28 (5+ IPs in /28 sending spam)
127.255.255.255	Too many queries

hostkarma.junkemailfilter.com

https://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists#How_to_use_the_Lists

IP Address	Meaning
127.0.0.1	Allowlist: “trusted nonspam”
127.0.0.2	Blocklist: “block spam”
127.0.0.3	Yellowlist: “mix of spam and nonspam”
127.0.0.4	Brownlist: “all spam – but not yet enough to blacklist”
127.0.0.5	NOBL: “This IP is not a spam only source and no blacklists need to be tested”
127.0.1.1	QUIT is used
127.0.1.2	QUIT is not used
127.0.1.3	QUIT is sometimes used