Tornevall Networks DNS-based Blackhole List (DNSBL)
The Tornevall Networks DNS-based Blackhole List (DNSBL) is a blacklist (or blocklist) that identifies and lists IP addresses involved in various abusive activities, including proxies, phishing, and both email and web-based spam.
Check if you are listed on Tornevall Networks DNS-based Blackhole List (DNSBL)
What is Tornevall Networks DNS-based Blackhole List (DNSBL)?
The Tornevall Networks DNS-based Blackhole List (DNSBL) is a type of blacklist that identifies IP addresses associated with spam and other malicious activities. It is built on the Domain Name System (DNS) and allows mail servers to query it in real-time to check if an incoming connection is from a listed IP. Its policy focuses heavily on identifying open and anonymous proxies, including nodes on the Tor network, which are used to obscure the origin of abusive traffic. This blocklist is also used to identify sources of phishing and email spam.
Technically, the blacklist uses bitmasking to provide specific reasons for a listing. When a mail server queries the DNSBL about an IP address, the response indicates the type of activity detected. The main zones are dnsbl.tornevall.org and bl.fraudbl.org. The return codes (bitmasks) include:
Confirmed Proxy (2): The IP has been confirmed to be a working proxy.
Phishing (4): The IP is linked to phishing or fraudulent activities.
Email Spam (16): The IP has been identified as a source of email spam.
Second Entry (32): Indicates the IP is a Tor exit node or has another entry point.
Abuse (64): The IP is marked for general abuse, such as spam or attacks via web forms.
Anonymous (128): The IP is associated with a web-based anonymity service.
Who runs Tornevall Networks DNS-based Blackhole List (DNSBL)?
The DNSBL is operated by Tornevall Networks, a private, non-profit service provider and open-source developer. The organization was founded on principles of independence and self-sufficiency, initially creating applications for private use that were later released as open-source projects for public benefit. The DNSBL is one of its longest-running projects, originally designed to combat web-based spam but later expanded to include email spam. The project is split into multiple parts, including a standard blacklist for proxies and mail spam, and a separate blacklist, FraudBL, which has a higher spam score.
How do I get removed and delisted from Tornevall Networks DNS-based Blackhole List (DNSBL)?
To get delisted from this blacklist, you must first resolve the underlying issue that caused the listing. This involves securing a compromised machine or closing an open proxy. Once you have fixed the problem, you request removal using the official delisting form.
Keep the following points in mind during the removal process:
After you submit a delisting request, the database is updated, but it takes some time for the changes to propagate across the DNS system.
A penalty time is added to your IP address if you make a large number of delisting requests in a short period. This delays the removal.
If the primary delisting form does not work, a non-ajax version is available, or you contact their support team directly through channels like Slack or Twitter.
What's the impact of being listed on Tornevall Networks DNS-based Blackhole List (DNSBL)?
The impact of being listed on the Tornevall Networks blacklist is low. This blocklist (or blacklist) is not as widely adopted by major mailbox providers compared to some other more influential lists. However, its primary focus is on stopping web-based spam and abuse from proxies, which means it is used by a variety of system administrators to protect web applications and other online services. While it also lists email spam sources, a listing does not cause widespread email delivery failures but results in your emails being blocked by organizations that do use this specific DNSBL. Therefore, it is still important to seek removal to ensure maximum reach and protect your sender reputation.