SURBL
Domain reputation list focused on URLs found in unsolicited mail. SURBL is one of the most widely deployed domain blocklists at receivers.
- DNS zone
multi.surbl.org- Published by
- SURBL.org
- Established
- 2004
- Scope
- Domain
What it detects
Domains hosting spam landing pages, phishing kits, malware payloads, or scam content. SURBL ingests data from multiple feeds — SpamCop URL reports, AbuseButler, jwSpamSpy — and combines them into a multi-list response.
Listing categories
127.0.1.2 (SpamCop URL spam), 127.0.1.4 (website spam — primarily ads), 127.0.1.8 (AbuseButler abuse), 127.0.1.16 (phishing), 127.0.1.32 (malware), 127.0.1.64 (jwSpamSpy spam). Multiple categories may apply to a single domain; the response is bitwise OR of all matching codes.
How to check a listing yourself
Query the A record of `<domain>.multi.surbl.org`. A 127.0.1.x response indicates a listing. SURBL also publishes a public lookup form on their website.
How to get delisted
Most SURBL feeds expire listings automatically as evidence ages. For active listings, submit a removal request via the operator's contact form with proof that the abuse has been fixed (e.g., spam URLs removed, phishing kit deleted, compromised hosting cleaned). Expect 24–72 hour turnaround.
Other blacklists DomainCare monitors
- URIBL — Real-time domain blacklist focused on URIs that appear in spam. Common at receivers using SpamAssassin and similar filters.
- SpamCop SCBL — SpamCop Blocking List — IP blacklist driven by reports submitted by mail recipients.
- DroneBL — IP blacklist focused on compromised hosts — drones, open proxies, brute-force attackers — rather than spam senders.
- Blocklist.de — Community-driven IP blacklist aggregating fail2ban-style attack reports from operators worldwide.