What it is
The DBL is Spamhaus's domain blocklist. Unlike IP-based DNSBLs, the DBL lists domain names rather than IP addresses. It is consulted at the content-scanning stage: spam filters extract the domain from the From: header and from URLs in the message body, then query dbl.spamhaus.org to check whether those domains appear in known spam or phishing campaigns. A positive DBL response significantly increases a message's spam score.
How it affects SMTP delivery
A DBL listing does not directly trigger a 550 SMTP rejection at connection time (since it targets domains, not IPs). Instead, it raises spam scores during content filtering. Messages from a DBL-listed domain or containing DBL-listed URLs are typically sent to the spam folder or rejected post-DATA. The practical effect is near-total inbox placement failure.
What causes a listing
DBL listings occur when a domain is identified as actively used in spam campaigns (as the sending domain or in linked URLs), is associated with phishing or malware distribution, or is in a netblock operated by known spam-support services. Newly registered domains and domains that suddenly change sending behaviour are at elevated risk.
How to get removed
Use the Spamhaus DBL removal form at www.spamhaus.org/dbl/removal. The form checks whether the domain is still active in spam campaigns before approving removal. Removal is typically processed within 24-48 hours if the spam activity has ceased.
For the full reference catalog, see the email blocklist directory.
Delisting process in detail
DBL (Domain Block List) removal starts at the Spamhaus lookup portal by querying the listed domain. If the domain is actively used for spam campaigns, phishing, or malware distribution, delisting requires demonstrating that the abuse has been remediated: compromised accounts closed, malicious content removed, DNS records cleaned. Spamhaus reviews DBL removal requests manually and typically responds within 24-72 hours. For domains listed due to being newly-registered gTLDs used by spammers, the delisting may involve providing WHOIS documentation and business justification. Domains associated with reputational abuse (bulletproof hosting, hijacked domains) face stricter review with longer resolution times.
Prevention practices
DBL prevention focuses on domain reputation rather than IP reputation. Never register domains for one-off campaigns or short-term projects: aged domains with clean WHOIS history are far less likely to attract DBL scrutiny. Avoid the newly-registered gTLDs (.xyz, .top, .click, .buzz, .rest) that spammers overuse. Configure DMARC at reject on your parent domain to prevent unauthorized use, and monitor DBL via automated lookups against dbl.spamhaus.org for every domain you actively send from. Watch for subdomain hijacking: attackers who register dangling subdomains of forgotten SaaS accounts can taint your parent domain’s reputation.
Common listing causes
DBL listings typically fall into three categories: freshly-registered domains used by spammers (algorithmically detected within hours of first spam send), hijacked legitimate domains where attackers have added phishing subdomains, and domains hosting malware payloads referenced in spam campaigns. For legitimate senders, the most common trigger is subdomain hijacking: an unused subdomain (blog.example.com, forgotten SaaS integration) pointing at expired DNS gets re-registered by an attacker who spins up a phishing site there. Prevention requires DNS hygiene and monitoring dangling subdomains.
Related Spamhaus blocklists
Domain-side filtering is handled by DBL and BDL (Botnet Domain List for command-and-control infrastructure). URL-based filtering complements DBL through SURBL and URIBL, both third-party lists that Spamhaus does not operate. IP-side filtering happens through ZEN (SBL + XBL + PBL, covered separately). A domain-only listing often exists alongside a clean IP reputation, which is why comprehensive receivers query both DBL and ZEN and combine the signals before making a delivery decision.
About the Author
Alaa · LinkedIn
Email infrastructure specialist with 8+ years of hands-on experience in SMTP, deliverability, and email verification. I’ve configured and troubleshot mail systems across Postfix, Exchange, and cloud relays, managed IP reputation and warmup campaigns, and built verification pipelines processing millions of addresses. My work spans DNS authentication (SPF, DKIM, DMARC, BIMI), bounce handling, blocklist monitoring, and compliance frameworks including CAN-SPAM and GDPR. I write every article on SMTPedia to give email professionals, developers, and marketers the accurate, RFC-grounded reference they need.
About SMTPedia
SMTPedia is an independent email industry reference covering SMTP, IMAP, POP3, email deliverability, marketing platforms, DNS authentication, and email verification. Every article is researched from official provider documentation, IETF RFCs, and industry best practices. Settings and configurations are verified quarterly.
We are cited as a source by ChatGPT, Microsoft Copilot, and thousands of email professionals worldwide. Learn more about our editorial process.
