Here are some of our most frequently answered questions:

The choice of which service to apply for, Datafeed Query Service or Datafeed Rsync Service, depends on how big your network is and how high your email traffic is.

If you have 1,000’s of users and very high email traffic or you want to serve our DNSBL data locally to multiple mail servers on your network, we recommend you use the Rsync Service. The Rsync Service requires some setup on your end (requires you also set up Rbldnsd) and usually a dedicated server (although you can also run Rbldnsd on the same machine as your DNS server). So only take the Rsync Service if you understand why you want Rsync/Rbldnsd.

If your network is medium-sized, small, or you want a non-complicated solution with no software to install, the best choice is the Datafeed Query Service. With this service the Datafeed Service Group assigns you a unique account ID and access to a set of private Datafeed Query Service servers. The Query Service is very simple to install (it should take you literally one minute to set up on most moderns mail servers). It requires no extra software or servers.

Both services perform the same. You can switch from Query Service to Rsync Service later on if you find reason to need Rsync Service.

We received reports from users that the Datafeed Query Service is not working behind some Cisco ASA appliances configured with DNS inspection turned on. Since DNSBL A queries are rather similar to PTR queries (reverse DNS), it may be possible that this issue is related with the CSCue87407 bug reported by Cisco and affecting ASA 9.0(2), 9.1(1) and 9.1(2). See also this discussion.

When using the Datafeed Query Service in a Kerio Connect installation, it is crucial that the “Ask the blacklist DNS server directly” option is NOT selected, otherwise Kerio Connect will not be able to do lookups.

See also this Kerio forum topic.

The Datafeed Rsync Service can be installed on nearly any Unix-based machine (Linux, FreeBSD, OpenBSD, NetBSD, Mac OS X, Solaris, Tru64, HPUX, AIX, Irix, etc.). The memory and CPU requirements are usually modest, so that old PCs are typically up to the task. An Internet bandwidth of at least 512 kbps is required.

Datafeed Rsync Service utilizes 2 free programs, Rsync and Rbldnsd. Both of them are usually also available as packages for the various operating systems. Nowadays, rsync is often part of the base distribution.

Spamhaus supplies an Installation Manual with the Datafeed Rsync service, giving instructions for how to install and set the Datafeed up. The manual covers:

  1. installing rsync
  2. installing rbldnsd and prepare it for running
  3. configuring your local DNS resolver
  4. configuring your mail servers

The manual is supplied only after you apply for the Datafeed service, or a free trial of the datafeed service, and it is linked from the account page on the SpamTeq.com web site.

While it is technically possible (by using forwarding in your DNS resolver) to run the sbl, pbl, xbl, zen, dbl local zones under the spamhaus.org domain, we recommend to use a different domain for your local zones. By doing so, you will be sure that queries really stay local rather than being sent to the Spamhaus public servers as a consequence of a configuration error.

The preferred solution is that of running the Spamhaus zones under a local domain unreachable from the rest of the Internet. For instance, you can use a local domain called “dnsbl”, referring to the zones as “sbl.dnsbl”, “pbl.dnsbl”, “xbl.dnsbl”, “zen.dnsbl”, “dbl.dnsbl” in your mail servers. With a Bind DNS resolver, this can be done be defining in named.conf

zone "dnsbl" {
        type forward;
        forward only;
        forwarders {

where is the IP address of the rbldnsd server (on the same or on another host).

You can run rbldnsd on the same system/IP as an existing BIND 9.x DNS server acting as resolver in your network. For instance, the rbldnsd option “-b” tells rbldnsd to listen on the IP address, UDP port 54.

You then configure the BIND server your mail server(s) use, to forward queries for the Spamhaus DNSBLs to rbldnsd by adding the following to named.conf:

zone "dnsbl" {
        type forward;
        forward only;
        forwarders {
       port 54;

This port forwarding option is not supported in BIND 8.x. (For BIND 8.x, you need to dedicate an IP address to rbldnsd and configure BIND to not listen on that IP – by telling it which IPs to listen on).

Rbldnsd defines a few different dataset types. To optimize performance and memory usage, we recommend Datafeed users to choose ip4set for SBL and SWL, ip4trie for PBL, and ip4tset for XBL.

However, using ip4tset will result in a return code for all XBL listings. In the majority of cases this is acceptable, but if you need to distinguish between the different XBL return codes you should use ip4set also for XBL.

DBL and DWL must always use the dnset dataset type.

Public mirrors are required to use ip4set for all the IP zones, and dnset for DBL and DWL.

The combined ‘zen’ zone (which we publish to reduce the global DNS traffic on our public nameservers) does not exist as a file. The sbl, pbl and xbl files can be combined into a single “zen” zone by running rbldnsd in this way:

rbldnsd (options) \
	zen.dnsbl:ip4set:sbl \
	zen.dnsbl:ip4trie:pbl \
	zen.dnsbl:ip4tset:xbl \

That is, the combined zone is built ‘on the fly’ by rbldnsd from the three files. Datafeed users may choose to run the individual zones, the combined zone, or both. Since all queries are local, the performance advantage of the combined zone is usually negligible unless your mail traffic is really massive.

The dbl zonefile must not be included in zen: it is a domain zone, not an IP zone, and should never receive queries relative to IP addresses. The two whitelists swl and dwl must also, of course, be individual zones.

Spamhaus Technology and its Authorised Datafeed vendors manage the datafeed services and associated infrastructure for the threat intelligence listings developed by The Spamhaus Project. The content & policy of listings, for both IP addresses and domains, are maintained & controlled exclusively by The Spamhaus Project which has clear procedures for dealing with list removals. As a starting point go to www.spamhaus.org/lookup/.

If your email management system indicates that your emails are not being delivered, then a first check is to look up the IP addresses/domains that you use at www.spamhaus.org/lookup/

The listings for both IP addresses and domains are maintained & controlled exclusively by The Spamhaus Project which has clear procedures for dealing with list removals. Spamhaus Technology and its Authorised Datafeed vendors manage the datafeed services and associated infrastructure for the threat intelligence listings developed by The Spamhaus Project. The content & policy of listings are exclusively maintained & controlled by The Spamhaus Project.

If you’re not sure how well the Spamhaus DNSBLs will perform to reduce incoming spam on your network, and your email traffic is too high to test using our free public DNS mirrors, you can test the Datafeed service offered by Spamhaus Technology for 30 days, free of charge and with no obligations.

Details are available on the Spamhaus Technology web site.

The application process is designed to allow organizations to initiate an application without committing to taking the service or making a payment until they are first satisfied with the service and have agreed to the service terms. The process is:

  1. Use the Free Trial form on the Spamhaus Technology web site to request a 30 day trial of one or more of our services.
  2. Fill out the Datafeed Application Form.

Your application is then submitted to Spamhaus for approval (Spamhaus wants to ensure it does not grant access to its data to organizations involved in spamming). This can take a few hours. Once approved, your Application is handled by an Authorized Datafeed Vendor who will create a Datafeed account for you and email the account information to you. In your Datafeed account area you will then find installation instructions, a Service Agreement (for you to agree), payment options, and technical support contacts.

(Note that you contract the Datafeed Service directly with the Authorized Datafeed Vendor, not with Spamhaus Project, as Spamhaus Project does not have any commercial activities.)

Spamhaus wants to ensure that its data is only given to reputable qualified organizations, we therefore need to know who you are before offering you access to Spamhaus data.

The Datafeed Service Agreement is between you and a 3rd party contractor (Authorized Datafeed Vendor) authorized by Spamhaus to sell and manage the Datafeed service. The Authorized Datafeed Vendor’s Agreement therefore is only made available to you once you first complete the Datafeed Application Form which is first vetted by Spamhaus to ensure the application for access to its data is acceptable to Spamhaus.

Completing the Datafeed Application Form does not commit you to anything.

The Datafeed service is sold, supplied and managed by Authorized Datafeed Vendors, independent resellers of Spamhaus Technology (UK), licensed by The Spamhaus Project to include realtime Spamhaus data in a Datafeed service format.

You therefore contract the Datafeed Service directly with an Authorized Datafeed Vendor and not with Spamhaus Project (as Spamhaus Project does not have any commercial activities). The Authorized Datafeed Vendor is also responsible for first-line technical support.

The Spamhaus Project retains responsibility for initial vetting of your Datafeed application (to weed out any suspect applications by spam firms attempting to gain access to the data and to disallow supply of the service to networks engaged in spam service or support activities).

In 2004 Spamhaus introduced the Datafeed service to replace the former free but simple Rsync service. The change from free to subscription-based became necessary in 2004 in order to handle the exponential growth of the service. Thousands of networks take synchronized transfers of Spamhaus DNSBL data, it is therefore a resource-intensive service that demanded its own separate and independent management, servers and support infrastructure.

To guarantee the availability of the service, provide support and maintain the equipment and redundency behind it, Spamhaus decided in 2004 to move the provision of the service to authorized Datafeed contractors who manage, sell and support the Datafeed service.

The announcement of the service change, and reasons for moving it to a charged annual subscription, was made in Spamhaus’s 2004 “A Blueprint for the future” document outlining the future of Spamhaus: Futureproofing Spamhaus.

Yes, approximately every two years the service price may be adjusted in line with inflation and market value.

The major part of spam filtering done by appliances such as the Barracuda is in fact DNSBL filtering using among other things the Spamhaus DNSBLs and other data from Spamhaus. If you are using any Spamhaus lookup in any part of a Barracuda or similar spam filter appliance you must ensure you have a current Spamhaus Datafeed subscription from a Spamhaus Authorized Datafeed Vendor.

If you do not have a current Spamhaus Datafeed subscription, then you are abusing Spamhaus’s public DNSBL servers. If your email volume is big enough that you need a Barracuda or similar spam filter appliance, then you certainly CAN NOT use Spamhaus’s free public DNSBL servers.

Because Spamhaus’s public DNSBL servers get heavily abused by companies with spam filter appliances, mostly Barracuda appliances, Spamhaus has implemented a control system on the public DNSBL servers to flag and firewall such users and Barracuda appliances in particular.

Please ensure that if you are using Spamhaus DNSBLs in any part of your corporate spam filtering setup, you have a Spamhaus Datafeed subscription in place first.

Spamhaus evaluates every Datafeed service application to ensure the applicant is bona fide and is not involved in the provision or support of spam services.

The Datafeed service is refused to any ISP with excessive SBL listings, bad enough to be listed in the Spamhaus ‘TOP 10 Worst Spam ISPs‘ chart. Spamhaus considers an ISP whose spam control practices are so bad that the ISP is listed in our “TOP 10” to be “knowingly facilitating spam operations (for profit)”. The consensus is that such ISPs should be putting far greater efforts into reducing the spam problems they cause and that it is hypocritical to attempt to reduce incoming spam to their own customers much of which is caused by them in the first place.

Engage with us on

It’s time to protect your organization

Start my free trial