Spamhaus Lists Explained: SBL, CSS, XBL, PBL, DBL and ZEN

Spamhaus is not one blocklist but a family of datasets. The SBL, CSS, XBL and PBL list IP addresses for different reasons, and ZEN combines all four into one DNS query. The DBL and ZRD list domains, and the HBL lists hashes of content such as email addresses. The return code a query gives back tells you which dataset matched, and that decides what the listing means.

This post is the reference: what each list contains, how to read the answers, and who is allowed to query them for free. If you are already listed and need to get off, the step-by-step process is in how to get removed from an email blacklist. We won't repeat it here.

The IP lists, one by one

Each Spamhaus IP list describes a different problem, so "listed on Spamhaus" means nothing until you know which one. Spamhaus's dataset documentation describes them in a sentence each:

Dataset	Spamhaus's description	In plain terms
SBL	"Manually maintained list of abuse-related resources, not necessarily of exclusively SMTP emitters"	People at Spamhaus listed this range on purpose
CSS	"Completely automated sublist, listing SMTP emitters associated with a low reputation or confirmed abuse"	An algorithm saw bad mail from this IP
XBL	"List of IPs that have recently been observed hosting compromised hosts"	Something on this IP is infected or hijacked
PBL	"List of dynamic and low-security IP space... address space that should never host an SMTP server"	This IP shouldn't be sending mail directly at all
DROP	"Flag added to SBL listings, indicating that the resource is known to be controlled by a bad actor"	The worst SBL entries
AuthBL	"Collection of bots known to use stolen credentials or authentication bruteforce"	IPs trying to log in to other people's accounts

CSS is part of the SBL zone. Spamhaus's return code FAQ lists CSS under the SBL zone with its own code, 127.0.0.3. A legitimate sender with a misconfigured server is far more likely to see .3 than .2, and the two need completely different handling.

The PBL is about the address range, not your behaviour. A home broadband or dynamic IP is on the PBL because of what kind of address it is. The fix is to send through an authenticated relay, not to delist.

How ZEN combines them

ZEN is a single zone that answers for SBL, CSS, XBL and PBL at once, with one record per matching dataset. Spamhaus's ZEN page calls it "the combination of all Spamhaus' free IP-based DNSBLs into one single powerful and comprehensive blocklist", and says a query "generally results in several distinct answers within the same DNS response packet, one for each dataset where the IP is listed."

You can see this with the permanent test address 127.0.0.2, which every Spamhaus IP zone lists. On 7 October 2026 (UTC) we queried it through OpenDNS (208.67.222.222):

$ dig +short 2.0.0.127.zen.spamhaus.org
127.0.0.2
127.0.0.4
127.0.0.10

$ dig +short 2.0.0.127.sbl.spamhaus.org
127.0.0.2
$ dig +short 2.0.0.127.xbl.spamhaus.org
127.0.0.4
$ dig +short 2.0.0.127.pbl.spamhaus.org
127.0.0.10
$ dig +short 2.0.0.127.sbl-xbl.spamhaus.org
127.0.0.2
127.0.0.4

ZEN returned three records, the same three the individual zones return one at a time. 127.0.0.1, which is never listed, returned nothing. That matches Spamhaus's DQS documentation, which says the ZEN test query returns 127.0.0.2 for the SBL, 127.0.0.4 for the XBL and 127.0.0.10 for the PBL.

Reading the return codes

The last octet of the answer is the diagnosis. These are the codes Spamhaus publishes in its DNSBL usage FAQ:

Answer	Dataset	What it means
127.0.0.2	SBL	Manual Spamhaus listing
127.0.0.3	CSS	Automated low-reputation listing
127.0.0.4	XBL	Compromised host (Spamhaus labels it "CBL Data")
127.0.0.9	DROP	Bad-actor network, returned "in addition to 127.0.0.2, since 01-Jun-2016"
127.0.0.10	PBL	"ISP Maintained": the network's owner flagged the range
127.0.0.11	PBL	"Spamhaus Maintained"
127.0.1.0/24	DBL	Domain listing (detail below)
127.0.2.0/24	ZRD	Newly observed domain
127.255.255.252	Error	"Typing error in DNSBL name"
127.255.255.254	Error	"Query via public/open resolver"
127.255.255.255	Error	"Excessive number of queries"
No answer (NXDOMAIN)	—	Not listed, or your resolver is hiding the answer

That last row matters. On the same day, the same query for 127.0.0.2 through the home router on our test machine came back NXDOMAIN, the answer that normally means "clean", for an address that is always listed. Our earlier post shows the same effect on Google, Cloudflare and Quad9 resolvers. Always check 127.0.0.2 first. If it doesn't come back listed, the resolver can't be trusted for Spamhaus lookups. Our blacklist check is an alternative to running dig yourself.

The domain and content lists

DBL, ZRD and HBL look at what is in the message rather than where it came from.

DBL. The DBL FAQ describes it as "a list of domain names with poor reputation" and says it "ONLY lists domains. No IP addresses are listed in the DBL." Its codes separate domains Spamhaus considers malicious from legitimate domains being abused:

DBL code	Meaning
127.0.1.2	Spam domain
127.0.1.4 / .5 / .6	Phish / malware / botnet C&C domain
127.0.1.102	Abused legit spam
127.0.1.103	Abused spammed redirector domain
127.0.1.104 / .105 / .106	Abused legit phish / malware / botnet C&C

The 1xx codes are the ones a legitimate business is most likely to meet. A link shortener or a hacked WordPress site that turns up in spam can be listed as "abused legit". If your own domain gets a 1xx code, look for a compromised page or an open redirect before you assume your mail is the problem.

The DBL FAQ also warns that "The DBL cannot be used to look IP addresses" and that an IP query "always returns a positive (listed) return code". When we queried 2.0.0.127.dbl.spamhaus.org it returned 127.0.1.255. A checker that shows a "DBL listing" for an IP address has made this mistake.

ZRD. Spamhaus describes the Zero Reputation Domain list as a "Database of domains that have been observed for the first time in the last 24 hours", and lists for 24 hours. According to Spamhaus's zones documentation, the last octet of a 127.0.2.x answer gives the number of hours since the domain was first seen. For anyone launching a new cold email domain, that is one more reason to register it well before it sends.

HBL. The Hash Blocklist FAQ says it covers "cryptowallet (Bitcoin etc.), malware, email addresses and URLs", published as hashes, and that it is "a commercial product available for use by authorised clients only." One listed reason is that "your email account has been compromised and your email address is being used to send spam". So the HBL is the one Spamhaus list that can list a single email address.

Who queries Spamhaus, and on what terms

Receiving mail servers and filtering services query Spamhaus. Free use is allowed only for low-volume, non-commercial users. The ZEN page says use "is free of charge for low-volume, non-commercial users" under the fair use policy, and that "where data is being used for commercial purposes, an annual subscription-based service is required."

The fair use policy does not give a number. It says the public mirror is for "non-commercial use by small and medium sized organisations", that volume "must not exceed volumes reasonably expected in circumstances of non-commercial use", that queries must come from "a recursive resolver run on your own network or from a public resolver which supports ECS", and that queries from "large shared hosting environments are not accepted". ISPs and commercial spam filter services are named as commercial use.

There are now two ways in:

• Legacy public mirrors (zen.spamhaus.org and friends): no key. These are the queries shown above, and they are the ones that fail through big public resolvers.
• Data Query Service (DQS): you query <key>.zen.dq.spamhaus.net with a 26-character key, per the DQS docs. Spamhaus offers a free DQS account to "a non-commercial entity or individual with low query volumes". That account includes AuthBL, XBL, CSS, DROP, DBL, SBL, PBL and ZRD. HBL is paid only.

What this means if you send email

You don't query Spamhaus to send mail, but your recipients' servers do, so read a listing the way they would. The codes map to different causes:

• .3 (CSS) means something about your mail stream looked bad. Spamhaus's CSS listing criteria include missing or mismatched reverse DNS.
• .4 (XBL) means a machine or account is compromised.
• .10/.11 (PBL) means you are sending from the wrong kind of IP.
• .2 (SBL) means a human at Spamhaus listed your range, and only your provider can resolve it.
• A DBL code means a domain in your message is the problem, and that may be a link rather than your sending domain.

Mail rejected because of a listing usually arrives as a permanent policy rejection such as 554 5.7.1, with the list named in the text. Once you know the code, go to the delisting steps in how to get off a blacklist.