Blocklists

Besides Spamhaus, the gateway checks each message against other public blocklists. A hit adds points to that one message's score; it never rejects mail on its own and never becomes part of your own reputation data. Set them up on Protect › Blocklists (MSP superadmin).

The lists

Each provider has its own terms. The Blocklists page shows one line beside each list; whoever operates the gateway is responsible for meeting them. The points each answer is worth are in the rule reference.

How lookups behave

• All lookups of a message run at the same time, Spamhaus included, through the gateway's own resolver (public resolvers are refused by most lists). One that takes longer than dnsbl.timeout_ms (1.5 s) counts as not listed.
• Answers are read per list: a provider's refusal or quota answer (for example SURBL or URIBL 127.0.0.1) is shown on the Blocklists page as an access problem and never scored.
• Answers carry meaning: an end-user address on Abusix's policy list scores far less than a spam-trap hit, and SURBL and URIBL bit masks are decoded (phishing and malware score more than spam).
• Lists that share data sources are capped together, with Spamhaus: see dnsbl.group_caps in Settings.
• Outbound mail and mail from your internal networks only gets the downloaded feeds, so it costs no lookups.
• The downloaded feeds are fetched by the worker and checked on the gateway itself. If a download fails, the last good copy stays in use.

The Blocklists page

Status and test

The test asks a list its documented test entries: the listed one must answer and a never-listed one must not. A missing or wrong key, a refused resolver or a list that answers everything shows here.

Lookups today

Lookups that left the gateway, against the daily limit you enter for the provider's plan. The resolver's cache answers repeats, so the provider sees at most this many.

Hits, unique, still clean

Messages with a hit from the list, messages where it was the only blocklist that hit, and hits on messages that still ended up clean. A list with many "still clean" hits and few unique ones adds little: lower its weight (dnsbl.weights) or switch it off.

The AI review

When a message goes to AI review, its blocklist hits are listed in the prompt as context. Your own reputation scores are not, so the model's verdicts can feed reputation without echoing it.