Usage

The NordSpam Project reputation database consist of bl.nordspam.com (blacklisted IPs) and dbl.nordspam.com (blacklisted domains). You may use the NordSpam DNSBL service free of charge for both commercial and non-commercial purposes. If you are going to be doing more than 10,000 queries a day, please contact us before using these.

IP address blacklist (bl.nordspam.com)

Name NordSpam IP Blacklist
Description IP address based data
Status Active
Type DNSBL (IPv4 and IPv6)
Query zone bl.nordspam.com
Query records Zone supports two types of queries, A and TXT. A query will provide the information whether an IP address is listed by returning 127.0.0.2 while a TXT query will show extra information.
Positive response 127.0.0.2
Testpoints List is invalid if any of the following test points fail:
  • 127.0.0.1 — Must never exist
  • 127.0.0.2 — Must always exist
Recommended action Block at MTA level

Example, Linux dig for IPv4:

To query an IPv4 address, you must first reverse the IP address. This is called inverse addressing. Example if you query IP address 127.0.0.2 you must reverse it to 2.0.0.127.

When listed, the example IP 127.0.0.2 will return an A record with "127.0.0.2" and a TXT record like this:

$ dig +short A 2.0.0.127.bl.nordspam.com
127.0.0.2
$ dig +short TXT 2.0.0.127.bl.nordspam.com
"RFC5782 TEST-record."

Example, Linux dig for IPv6:

To query an IPv6 address, you must first expand it, and then reverse it. Example if you query IP address ::FFFF:7F00:2 you must expand it to 0000:0000:0000:0000:0000:FFFF:7F00:0002 and then you must reverse it to 2.0.0.0.0.0.f.7.f.f.f.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.

When listed, the example IP ::FFFF:7F00:2 will return an A record with "127.0.0.2" and a TXT record like this:

$ dig +short A 2.0.0.0.0.0.f.7.f.f.f.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.bl.nordspam.com
127.0.0.2
$ dig +short TXT 2.0.0.0.0.0.f.7.f.f.f.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.bl.nordspam.com
"RFC5782 TEST-record."

Domain name blacklist (dbl.nordspam.com)

Name NordSpam Domain Blacklist
Description Domain name based data
Status Active
Type URIBL (Domain/URI only)
Query zone dbl.nordspam.com
Query records Zone supports two types of queries, A and TXT. A query will provide the information whether an IP address is listed by returning 127.0.0.2 while a TXT query will show extra information.
Positive response 127.0.0.2
Testpoints List is invalid if any of the following test points fail:
  • invalid — Must never exist
  • test — Must always exist
Recommended action Block at MTA level

Example, Linux dig:

When listed, the test domain test will return an A record with "127.0.0.2" and a TXT record like this:

$ dig +short A test.dbl.nordspam.com
127.0.0.2
$ dig +short TXT test.dbl.nordspam.com
"RFC5782 TEST-record."

Zone transfers

If you believe you will be making thousands of queries per hour, we may let you transfer the zone files for a locally cached version of these DNSBLs. We will review these on a case-by-case basis, just contact us via contact page.