Spamhaus

The Spamhaus Project is a not-for-profit organisation that tracks spam, phishing, malware and botnet infrastructure and publishes the results as reputation data for domain names and IP addresses. Its best-known products are DNS-based blocklists (DNSBLs): lists that a mail server can consult with an ordinary DNS lookup to decide whether to accept a message. It was started in London in 1998 and is now based in Andorra; large-volume and commercial access to its data is sold by a separate company, Spamhaus Technology.^[1][2]

For domain owners, Spamhaus matters for one practical reason: if a domain appears on its Domain Blocklist (DBL), messages that mention or come from that domain are likely to be rejected or filtered by a large share of the world's mail systems, and some network security tools will block access to it. WikiForDomains is not connected with Spamhaus; this article summarises its public documentation.

Spamhaus was founded in 1998 to track IP addresses sending unsolicited bulk email and to publish them in a blocklist that email administrators could use for filtering. The name is a mock-German coinage for a provider that sends spam or knowingly hosts spammers.^[1][2] Over time its research widened from spam to phishing, malware, ransomware and botnet command-and-control (C&C) servers, and from IP addresses to domains and autonomous systems. It added the Domain Blocklist in March 2010.^[2]

Real-time delivery of the data at high volume is handled by Spamhaus Technology, which also runs the free key-based query service on the Project's behalf. In recent years the organisation has published research jointly with the Swiss malware-tracking project abuse.ch under the name Spamhaus-abuse.ch Alliance.^[1][7] Spamhaus has received awards including the FBI-linked National Cyber-Forensics and Training Alliance's Cyber Crime Fighter Award and the UK ISPA's Internet Hero award (2003).^[1]

Each list targets a different kind of identifier or behaviour. Mail software usually queries more than one.

Spamhaus notes that ZEN contains only IP-based lists and gives no protection against bad domains, so the DBL must be queried separately by software that extracts domains from message headers and bodies.^[4][5] The ZRD reflects an observation that new domains are rarely used for legitimate mail in their first day.^[6]

A DNSBL is published as a DNS zone, a convention later documented in RFC 5782.^[8] To test an IPv4 address, the receiving server reverses its four octets and appends the zone name: a message from 192.0.2.25 becomes a lookup for 25.2.0.192.zen.spamhaus.org. To test a domain, the name is prefixed to the domain zone, as in example.com.dbl.spamhaus.org. If the name does not exist (NXDOMAIN), the item is not listed. If the lookup returns an address in the 127.0.0.0/8 range, the item is listed and the final octet says why.^[4]

Because the DBL supports wildcard lookups, querying any hostname under a listed domain returns the domain's code. Spamhaus provides dbltest.com as a permanently listed test domain and recommends checking that answers fall within 127.0.1.0/24 before treating them as listings.^[4]

Spamhaus publishes data; it does not block anything itself. Each receiving network decides how to act on a listing. Common policies are to refuse the message during the SMTP conversation (the sender sees a bounce that names the list), to accept it into a spam folder, or to add the listing to a spam score alongside other signals. Because Spamhaus says its data protects billions of mailboxes, a DBL or SBL listing tends to cause bounces at many unrelated providers at once.^[1]

A domain does not need to send mail to be affected. The DBL is checked against links in message bodies, so a listed domain can cause newsletters, invoices or forum notifications that merely link to it to be filtered. Correct SPF, DKIM and DMARC records do not prevent a listing: Spamhaus points out that spammers can publish those records too, and that domains are listed with and without them.^[4] The practical steps for a listed domain are covered in How to check if your domain is on a blocklist and get it delisted.

• DNS firewalls. Domain data can be loaded into a Response Policy Zone (RPZ) so that a network's resolvers refuse to resolve known phishing, malware and C&C domains for users.^[4]
• URL shorteners and comment systems. Spamhaus recommends that shorteners check every target domain against the DBL, and the list can flag spam links in blog comments and guestbooks.^[4]
• Security products and threat intelligence. Commercial feeds and the Spamhaus Intelligence API supply domain and IP reputation to security platforms.^[10] Web browsers generally rely on their own warning lists rather than querying Spamhaus directly, but a domain abused for phishing often ends up on several independent lists.

The public mirrors (for example zen.spamhaus.org) may be used free of charge only for low-volume, non-commercial use, and not through public DNS resolvers or from IPs with generic reverse DNS; such queries receive the 127.255.255.254 error instead of real data.^[5] Users who query through a shared resolver can apply for a free key-based account, now called Blocklists via DNS Query (formerly the Data Query Service, DQS), whose terms limit it to non-commercial small organisations and individuals making no more than about 100,000 queries a day. ISPs, commercial spam-filter services and larger users need a paid subscription.^[9] A six-month Intelligence API developer licence (5,000 queries a month) is offered for evaluation, not production.^[10]

Twice a year Spamhaus publishes a Domain Reputation Update ranking top-level domains (TLDs) by the number of domains it listed as malicious or suspicious. The edition covering April to September 2026, published on 15 October 2026, counted 3.37 million such domains, up 56.6% on the previous six months, with September 2026 the highest month in its records at 1.15 million. Spamhaus attributed much of the rise to about one million cold-email domains listed after a data-sharing exercise with a deliverability firm, and repeated its view that cheap domains enable abuse at scale.^[3]

Raw counts favour large zones: .com has by far the most registrations, so its share of abusive names is small. Spamhaus therefore also ranks TLDs by the percentage of their zone it lists, treating 5% as a red flag and anything above 10% as a clearly problematic TLD. In April–September 2026 three gTLDs exceeded 10%: .help (26.5%, largely cold email), .qpon (15.1%) and .study (12.4%); .vip was at 7.4%, .cfd at 7.0% and .top at 5.0%.^[3]

Live, continuously updated TLD reputation scores are published on Spamhaus's reputation statistics pages.^[11]

Blocklist operators are periodically challenged by the senders they list. In 2006 the US bulk mailer e360 Insight sued Spamhaus in Illinois; Spamhaus disputed the court's jurisdiction, withdrew, and a default judgement of about US$11.7 million was entered, which Spamhaus said it would not recognise.^[2] In March 2013 Spamhaus was the target of a large distributed denial-of-service (DDoS) attack that its DDoS-mitigation provider described as one of the largest publicly reported at the time.^[12]

• How to check if your domain is on a blocklist and get it delisted
• Top 25 domain extensions
• Cheap domains
• History of the Domain Name System
• Domain name lifecycle
• WHOIS lookup

1. Spamhaus Project — Who is Spamhaus Project? (founding in London in 1998, now based in Andorra, free datasets, awards; retrieved 11 November 2026).
2. Wikipedia — The Spamhaus Project (name origin, DBL launch in 2010, company structure, e360 case; retrieved 11 November 2026).
3. Spamhaus — Domain Reputation Update, April–September 2026 (published 15 October 2026; PDF report).
4. Spamhaus — FAQs: Domain Blocklist (DBL) (return codes, wildcards, test points, removal, RPZ, URL shorteners).
5. Spamhaus — FAQs: How you can use the free Spamhaus blocklists.
6. Spamhaus Technology — Blocklists via DNS Query, free account (datasets included, ZRD 24-hour window).
7. Spamhaus Technology — About us (Spamhaus-abuse.ch Alliance).
8. RFC 5782 — DNS Blacklists and Whitelists (IETF, February 2010).
9. Spamhaus Technology — Terms of Use (Fair Use Policy) for Blocklists via DNS Query, free account (retrieved 11 November 2026).
10. Spamhaus Technology — Intelligence API Developer License.
11. Spamhaus — Reputation statistics (live TLD scores).
12. Cloudflare blog — The DDoS that almost broke the Internet (March 2013).