This blocklist is no longer operational. DNS queries return NXDOMAIN. Remove from MTA configurations to avoid query timeouts.
What it is
The IBM DNS Blacklist was maintained by an independent security researcher operating under the handle Janit0r. It was notable for its focus on IPs involved in botnet spam infrastructure and malware command-and-control networks. Despite the IBM name appearing in common references, IBM Corporation had no official involvement with this list.
How it affects SMTP delivery
The list is no longer operational. DNS queries to dnsbl.janit0r.com return NXDOMAIN (domain not found). MTAs that still query this hostname receive no response, which most interpret as a clean result. There is no impact on email delivery from this list in 2026.
What causes a listing
Historical listings were triggered by botnet participation, malware distribution, and spam campaign involvement.
How to get removed
No removal process is necessary or available. The list has been offline since 2019.
For the full reference catalog, see the email blocklist directory.
Delisting process in detail
The IBM DNS Blacklist (also known as the IBM Xforce Threat Intelligence feed) is part of IBM’s commercial threat intelligence offering. Delisting is handled through IBM’s threat intelligence portal and typically requires enterprise customer relationship or a documented incident-response contact. Automatic decay occurs when the observed abuse pattern stops, usually within 7-14 days. Because the IBM feed is primarily used by IBM’s own security appliances and enterprise customers, delisting has less broad impact than public blocklists but matters significantly for reaching IBM customer environments.
Prevention practices
IBM’s threat intelligence draws from a mix of honeypot data, customer telemetry, and open-source intelligence. Prevention follows general anti-abuse fundamentals: authenticated sending, list hygiene, complaint monitoring, and prompt remediation of any observed compromise. Because IBM’s feed is used heavily in enterprise environments, senders reaching corporate mailboxes (rather than consumer inboxes) are more affected by IBM listings than by consumer-facing blocklist listings. Enterprise B2B senders should monitor IBM alongside Spamhaus and other major reputation signals.
Common listing causes
IBM listings typically correlate with actual observed abuse (spam, malware distribution, phishing) or with intelligence gathered about IPs associated with threat actors. Compromised sending infrastructure (hijacked mail servers, hacked hosting accounts) produces the most common listing pattern. For legitimate senders, the most common inadvertent trigger is sending from an IP that was previously used by a threat actor: IP reallocation from cloud providers occasionally results in inherited reputation issues.
Related blocklists
IBM’s threat intelligence feed operates alongside other enterprise-focused threat feeds: Cisco Talos, Palo Alto Networks Unit 42, CrowdStrike Falcon Intelligence, Mandiant Threat Intelligence. Consumer-focused blocklists (Spamhaus, SURBL, SpamCop) provide broader coverage of general spam signals, while enterprise threat feeds focus on targeted threats and APT infrastructure. Comprehensive reputation monitoring combines both categories: consumer blocklists for general email deliverability, enterprise threat feeds for reaching corporate inboxes with strong security postures.
About the Author
Alaa · LinkedIn
Email infrastructure specialist with 8+ years of hands-on experience in SMTP, deliverability, and email verification. I’ve configured and troubleshot mail systems across Postfix, Exchange, and cloud relays, managed IP reputation and warmup campaigns, and built verification pipelines processing millions of addresses. My work spans DNS authentication (SPF, DKIM, DMARC, BIMI), bounce handling, blocklist monitoring, and compliance frameworks including CAN-SPAM and GDPR. I write every article on SMTPedia to give email professionals, developers, and marketers the accurate, RFC-grounded reference they need.
About SMTPedia
SMTPedia is an independent email industry reference covering SMTP, IMAP, POP3, email deliverability, marketing platforms, DNS authentication, and email verification. Every article is researched from official provider documentation, IETF RFCs, and industry best practices. Settings and configurations are verified quarterly.
We are cited as a source by ChatGPT, Microsoft Copilot, and thousands of email professionals worldwide. Learn more about our editorial process.
