{"id":1441,"date":"2017-07-25T04:29:16","date_gmt":"2017-07-25T04:29:16","guid":{"rendered":"https:\/\/www.gmass.co\/blog\/?p=1441"},"modified":"2022-10-11T22:37:15","modified_gmt":"2022-10-11T22:37:15","slug":"domain-blacklists-comprehensive-guide","status":"publish","type":"post","link":"https:\/\/www.gmass.co\/blog\/domain-blacklists-comprehensive-guide\/","title":{"rendered":"Domain Blacklists – The comprehensive guide"},"content":{"rendered":"

Domain blacklists have been used to filter email for years, and in this comprehensive guide, I’ll cover:<\/p>\n

    \n
  1. The most popular\u00a0public domain blacklists<\/strong> and lesser known, but equally\u00a0important, private domain blacklists<\/strong><\/li>\n
  2. How to determine if a domain is on<\/strong>\u00a0a blacklist<\/li>\n
  3. How to get off each blacklist<\/strong><\/li>\n
  4. Tips and tricks<\/strong>, gleaned from my own research and experience, about each blacklist<\/li>\n<\/ol>\n

    Given that GMass<\/a> is an email marketing service used by over 200,000 people, we’ve seen our fair share of deliverability and spam issues.<\/strong>\u00a0Because GMass works on top of Gmail and G Suite, we don’t maintain our own sending IP addresses. Instead, all email is sent from users’ Gmail accounts, meaning email originates from Gmail’s IP addresses.<\/p>\n

    Therefore\u00a0GMass users almost never have to worry about an IP block. The one exception to this rule is if you’re sending from an alias\u00a0From Address in Gmail<\/a> and were required to input\u00a0your own SMTP server credentials<\/strong>. In that case, Gmail routes your email through the\u00a0external SMTP server, which makes the\u00a0IP reputation\u00a0of your SMTP server relevant. Far more common for GMass users, however, is the issue of\u00a0domain-based blocking<\/strong>, since with the standard G Suite setup, your emails are sent from Gmail’s IP addresses<\/strong>.<\/p>\n

    Are domain blacklists the same as DNSBLs?<\/h3>\n

    The term DNSBL<\/a> is used often in the email deliverability industry. It stands for Domain Name Server Block List<\/strong>\u00a0and refers only to the mechanism by which the block list is published\u00a0(the Domain Name Server<\/strong> system). DNSBLs<\/strong> can be either lists of IP addresses or lists of domain names. Most DNSBLs<\/strong> are listings of IP addresses<\/strong>, and include popular blacklists like the Spamhaus Block List (SBL) and Spamcop. The blacklists\u00a0that most concern GMass users are those that list domain names<\/strong>. This is because\u00a0GMass sends emails from Gmail’s IPs, which are arguably the highest deliverability IP addresses in the world and aren’t blocked by anybody. Therefore it’s rare that an IP address will ever be the source of an email deliverability issue<\/strong>, except in the scenario mentioned above. A domain<\/strong>, however, can be the source of a deliverability\u00a0issue.<\/p>\n

    This is a current and\u00a0comprehensive guide to public and private domain-based email blacklists.<\/strong><\/p>\n

    Overview<\/h3>\n

    While IP-based email blocking is far more common, domain-based email blocking has gained popularity in recent years, and consumer email providers like Gmail<\/strong> and AOL<\/strong> and even corporate\u00a0email filters\u00a0like Barracuda<\/strong>, Symantec\/MessageLabs<\/strong>, and\u00a0Mimecast<\/strong>\u00a0scan incoming email for the presence of domains on domain blacklists. If found, the email is rejected or sent to the Spam<\/strong> folder. This is why I’ve encouraged each GMass user to set up a dedicated tracking domain<\/a>.<\/p>\n

    Domain-based DNSBLs fall into two categories: those that are publicly usable\u00a0and searchable<\/strong>, meaning any email server administrator can use<\/strong> the list to filter email, and those that are private<\/strong> and used for an organization’s internal purposes<\/strong> only, like AOL’s. Plenty of email companies have written about domain blacklists previously, including\u00a0Return Path<\/a> and Sendgrid<\/a>, but in this comprehensive guide, I’ll dig\u00a0deeper\u00a0into\u00a0the nuances of both public and private blacklists.<\/p>\n

    Public Domain Blacklists<\/h3>\n

    There are three main public domain blacklists: Spamhaus<\/strong>, SURBL<\/strong>, and URIBL<\/strong>.<\/p>\n

    Spamhaus DBL<\/span><\/h5>\n

    Web lookup form:<\/strong>\u00a0https:\/\/www.spamhaus.org\/lookup\/<\/a>
    \nQuery via DNS:<\/strong> Query [domain].dbl.spamhaus.org and look for a response of 127.0.0.2
    \n<\/strong>Tips and tricks: <\/strong>Spamhaus is the 300-pound gorilla of blacklists and publishes both an IP list and a domain list.\u00a0Spamhaus will sometimes list domains that have never appeared in email flow before. It\u00a0has an algorithm that detects newly registered domains, and if these domains meet a particular criteria, they are listed on the Spamhaus DBL without ever being included in a single email message. These domains are also the easiest to get delisted using the     Blocklist Removal Form<\/a>. Additionally,\u00a0the email address that you enter to receive\u00a0the confirmation removal link can determine whether your request is accepted and the link is sent, or your removal request is denied<\/strong>\u00a0and you’re told to get in touch with Spamhaus staff. If your domain is ineligible for self-removal, you’ll have to contact Spamhaus and ask them to remove the domain, and that can be difficult.<\/p>\n

    \"Spamhaus<\/a>
    You can attempt to remove a domain yourself from the Spamhaus DBL, but if a domain is ineligible for self removal, you’ll have to contact Spamhaus.<\/figcaption><\/figure>\n

    You’ll typically get a response within 24 hours. In my case with this domain, I\u00a0didn’t get any explanation about the listing, even though it’s been used in very minimal email flow.<\/p>\n

    \"Spamhaus<\/a>
    In this case, my Spamhaus delisting request has been denied.<\/figcaption><\/figure>\n
    SURBL<\/span><\/h5>\n

    Web lookup form:<\/strong>\u00a0http:\/\/www.surbl.org\/surbl-analysis<\/a>
    \nQuery via DNS:<\/strong> Query [domain].multi.surbl.com and look for a response of 127.0.0.2
    \n<\/strong>Tips and tricks:<\/strong>\u00a0It’s relatively easy to get a domain off of SURBL, as long as you’re not a systemic spammer and have a reasonable explanation. In my experience, if you explain why your domain was used in spam and can\u00a0show that you’re generally a responsible mailer, a few hours later, you’ll get a response accepting your request. I’ve never been turned down when asking for a domain to be delisted.<\/p>\n

    \"SURBL<\/a>
    SURBL administrators are helpful in providing info and reasonable in delisting domains.<\/figcaption><\/figure>\n
    URIBL<\/span><\/h5>\n

    Web lookup form:<\/strong> https:\/\/admin.uribl.com\/<\/a>
    \nQuery via DNS:<\/strong> Query [root domain].multi.uribl.com and look for a response\u00a0of 127.0.0.2<\/strong>
    \nTips and tricks:<\/strong>\u00a0The URIBL list is\u00a0very difficult to get off. You can     create a URIBL\u00a0account<\/a> and submit a delisting request, but in my experience, most delisting requests are denied. It also seems that whether a delisting request is accepted or not is at the whim of the person who is currently reviewing requests, given that only one out of all of my requests were accepted (for gmass.co), and the request was made just one day after the previous request was denied. Here’s my own history of delisting requests:<\/p>\n

    \"URIBL<\/a>
    Most of my URIBL delisting requests were rejected.<\/figcaption><\/figure>\n

    Tips and tricks:<\/strong> The URIBL blacklist will be the subject of a future blog post, because it exhibits some rare and often quirky attributes. In our research though, it’s the least used of the three public blacklists. My own domain, wordzen.com<\/strong>, has been listed for a long time, and I’ve seen virtually no blocking of any email that includes the wordzen.com domain. Even MailChimp’s default tracking domain, list-manage.com, is grey-listed on URIBL.<\/p>\n

    Private Domain Blacklists<\/h3>\n

    You might think that a private blacklist like the ones maintained by AOL<\/strong>, Barracuda<\/strong>, and Google<\/strong> are just that…private and un-searchable. While that may be true, it’s still possible to determine if your domain is on it. If you send an email with a listed domain to an address that uses a particular filter, the SMTP bounce response will indicate if the domain is on that private blacklist.<\/p>\n

    Barracuda’s Intent List<\/span><\/h5>\n

    How to query:<\/strong> Use their web lookup form<\/a>.
    \nDNS Lookup:<\/strong> There is no DNS-based method to look up a domain on Barracuda’s Intent List. Barracuda does provide a     DNS method for querying their IP list<\/a>, but not their domain list. It is possible, however, to examine SMTP responses to determine listings.<\/p>\n

    For example, if a domain is on Barracuda’s Intent List<\/a>, you’ll get a bounce with an SMTP code\u00a0from Barracuda that looks like:<\/p>\n

    Remote-MTA: dns; d124601a.ess.barracudanetworks.com. (64.235.154.140, the server for the domain d211.org.)\r\nDiagnostic-Code: smtp; 550 permanent failure for one or more recipients (henderson@d211.org:blocked)<\/pre>\n
    Note that the specific domain that is on the list is not mentioned, so it will take some further analysis to determine the actual domain. How do we know that this response code is likely a domain-based block<\/strong> rather than an IP-based block<\/strong>? Because Barracuda’s response code for an IP-based block<\/strong> is specific to that IP address:<\/p>\n
    Remote-MTA: dns; fw2.dgcuda.com\r\nDiagnostic-Code: smtp; 554-Service unavailable; Client host [actuarialoutpost.com] blocked using 554-Barracuda Reputation; 554 http:\/\/www.barracudanetworks.com\/reputation\/?r=1&ip=204.232.242.165<\/pre>\n
    You might have noticed\u00a0the difference between the two remote MTAs in these examples.<\/strong> In the first, the remote MTA is clearly a Barracuda-hosted server<\/strong>, because it ends with “barracudanetworks.com”. The second, dgcuda.com, appears to be an on-premise appliance<\/strong> running the Barracuda mail filtering software. Note the reference to “cuda”, which is likely short for Barracuda. Customers who install the Barracuda appliance can name the appliance whatever they like. Still though, the SMTP response codes will be equivalent regardless of whether the email server is hosted by Barracuda or hosted on-premise by an organization.<\/p>\n
    Here is a full list of Barracuda’s SMTP response codes.<\/a><\/p>\n
    AOL’s Domain Blacklist<\/span><\/h5>\n
    How to query:<\/strong>\u00a0The only way to know you’re on AOL’s domain blacklist is if you receive an SMTP response code containing “HVU”, which stands for High Volume URL. Like Barracuda, the SMTP response won’t indicate which domain is blacklisted; it will only tell you that one or more domains present in the email are\u00a0on the blacklist.<\/p>\n
    If\u00a0a domain is on AOL’s private domain blacklist<\/strong>, the SMTP\u00a0response from AOL will look like:<\/p>\n
    Diagnostic-Code: smtp; 521 5.2.1 :  (HVU:B2) https:\/\/postmaster.aol.com\/error-codes#554hvub2\r\nLast-Attempt-Date: Sun, 09 Jul 2017 03:26:51 -0700 (PDT)<\/pre>\n
    The HVU:B2 reference is specific to a blacklisted domain, as is explained on AOL’s page about their HVU\u00a0response codes<\/a>. You can contact AOL and ask which domain is blocked<\/a>, or if you can determine that on your own, you can ask for delisting, but in my experience, AOL is fairly stringent about their domain blacklist:<\/p>\n
    \"AOL<\/a>
    AOL denied my request to remove my domain from their domain blacklist.<\/figcaption><\/figure>\n
    Google’s Domain Blacklist<\/strong><\/span><\/h4>\n
    Google maintains a blacklist of domains, but the only way to tell if you’re on it, is to send an email to a Gmail or G Suite-hosted domain, and look at the reason you ended up in the Spam<\/strong> folder.<\/p>\n
    \"Gmail<\/a>
    An example of Gmail-based domain blocking<\/figcaption><\/figure>\n
    SpamRL<\/span><\/h4>\n
    How to query:\u00a0<\/strong>The only way to know you’re on the spamrl.com’s blacklist<\/a> is if you receive an SMTP response indicating that the URL is on the list.<\/p>\n
    \"SpamRL<\/a>
    This is what the bounce response from a spamrl.com block looks like<\/figcaption><\/figure>\n
    There is no web lookup form or DNS method to query the list.<\/p>\n
    \"SpamRL<\/a>
    SpamRL.com is a domain blacklist cloaked in secrecy.<\/figcaption><\/figure>\n
    You are able to self de-list your domain on SpamRL.com<\/a> for up to 7 days though.<\/p>\n
    Not all lookup tools are created equal<\/h3>\n
    When determining whether a domain is on one of the publicly searchable\u00a0blacklists, I like to automate the process by programmatically doing the DNS lookup. As a secondary means, I’ll go to the website directly and use their lookup forms. An even easier way is to use a third party lookup tool that searches many blacklists at once.<\/strong><\/p>\n
    Avoid\u00a0Googling “DNSBL check”<\/strong>, and using one of the many forms in the search results\u00a0that claim to check your domain or IP against a plethora of blacklists. This is because most lookup forms don’t properly perform the lookup against domain blacklists and instead do it against IP blacklists. An example is this lookup tool from MX Toolbox,\u00a0https:\/\/mxtoolbox.com\/blacklists.aspx<\/a>.\u00a0The prompt asks you to enter a domain or an IP address, but in reality, this check has nothing to do with domain-based blacklists.<\/em><\/strong> If you enter a domain, it simply converts your domain to an IP and then checks the IP against IP-based blacklists<\/strong>, which is entirely different<\/strong>\u00a0from checking the domain-based blacklists that I’ve referenced above. Here’s another popular tool that does the same, converting your domain to an IP and only searching\u00a0IP blacklists:\u00a0https:\/\/www.ultratools.com\/tools\/spamDBLookup<\/a><\/p>\n
    An example of a lookup tool\u00a0(that is buried deep in the search results) that does perform\u00a0the correct kind of lookup\u00a0is<\/strong>:<\/p>\n
    http:\/\/www.blacklistalert.org\/<\/a><\/p>\n
    This intelligent tool, while prompting you for an IP or a domain, will determine WHETHER you entered an IP or a domain and tailor its search accordingly.<\/strong> If you enter a domain, the first set of results will be searching that domain properly against domain-based blacklists, however the domain blacklists it searches is limited to the publicly available blacklists that I’ve mentioned above. Here’s another tool that also performs the lookup correctly and also offers a proactive monitoring service:<\/p>\n
    https:\/\/www.blacklistmaster.com\/<\/a><\/p>\n
    Which ISPs use which domain blacklists?<\/h3>\n
    Now that you have an overview of what the main public and private blacklists are, you are likely wondering which blacklists are relevant to your mailings. Does Gmail use these domain blacklists to filter their email? Does Outlook.com use them? Do corporate email filters like Barracuda, Mimecast, and Symantec\/MessageLabs use them?<\/p>\n
    My research shows the following:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n
    <\/td>\nSpamhaus<\/strong><\/td>\nSURBL<\/strong><\/td>\nURIBL<\/strong><\/td>\n<\/tr>\n
    AOL<\/strong><\/td>\nDelivered<\/span><\/td>\nDelivered<\/span><\/td>\nDelivered<\/span><\/td>\n<\/tr>\n
    Gmail<\/strong><\/td>\nDelivered<\/span><\/td>\nUncertain<\/span><\/td>\nDelivered<\/span><\/td>\n<\/tr>\n
    Outlook.com<\/strong><\/td>\nDelivered<\/span><\/td>\nUncertain<\/span><\/td>\nDelivered<\/span><\/td>\n<\/tr>\n
    Yahoo<\/strong><\/td>\nDelivered<\/span><\/td>\nDelivered<\/span><\/td>\nDelivered<\/span><\/td>\n<\/tr>\n
    Comcast<\/strong><\/td>\nUncertain<\/span><\/td>\nUncertain<\/span><\/td>\nUncertain<\/span><\/td>\n<\/tr>\n
    Barracuda<\/strong><\/td>\nDelivered<\/span><\/td>\nUncertain<\/span><\/td>\nDelivered<\/span><\/td>\n<\/tr>\n
    Mimecast<\/strong><\/td>\nBlocked<\/span><\/td>\nUncertain<\/span><\/td>\nUncertain<\/span><\/td>\n<\/tr>\n
    Symantec\/MessageLabs<\/strong><\/td>\nBlocked<\/span><\/td>\nDelivered<\/span><\/td>\nDelivered<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
    Testing methodology<\/strong><\/p>\n