DNS RBL Zone: Live Blocklist for Mail Servers

The ReportedIP community blacklist can be queried as a DNS blocklist. Since 29 May 2026 mail servers and firewalls check any IPv4 or IPv6 address against a private RBL zone at bl.reportedip.de, with no file downloads and no import jobs.

The DNS / RBL Zone is a recurring add-on for the PRO, Business and Enterprise plans at 7.90 € a month or 79 € a year. Each subscription comes with its own token and 100,000 lookups per day.

What is a DNS RBL zone?

A DNSBL (DNS-based blocklist, also called an RBL) answers one question over DNS: is this IP address known to attack? The mail server reverses the connecting address, appends the zone name and runs an ordinary DNS lookup. A listed address returns an A record in the 127.0.0.0/8 range, a clean one returns NXDOMAIN.

Before the zone existed, the blacklist was only available as a downloadable file and through the REST API. That works for firewalls that import lists, but mail servers expect a live DNSBL. The zone serves the same community blacklist over DNS and refreshes it from the source every few minutes.

At launch on 29 May 2026 the zone held 11,134 addresses. On 29 September 2026 it held 6,885, because addresses that stop attacking now lose confidence and leave the list on their own, as described in the self-cleaning blacklist post.

How does the zone answer a lookup?

Your private zone string

Every subscription provisions one token of 48 hexadecimal characters. Your zone string is <your-token>.bl.reportedip.de. To check 1.2.3.4, the server looks up 4.3.2.1.<your-token>.bl.reportedip.de. IPv6 addresses are queried as 32 reversed nibbles, the same form used under ip6.arpa.

Return codes map to confidence

The confidence score is already encoded in the answer, so the mail server needs no extra mapping:

A record	Meaning	Suggested action
`127.0.0.2`	Listed, high confidence (90 or higher)	Reject
`127.0.0.3`	Listed, medium confidence (75 to 89)	Reject or score
`NXDOMAIN`	Clean, or not in the requested category	Accept
`127.255.255.251`	Daily query quota reached	Add another token
`127.255.255.252`	Token invalid or subscription inactive	Check the token

A query above the per-token rate limit is answered with REFUSED instead of an address. The test IP 127.0.0.2, queried as 2.0.0.127.<your-token>.bl.reportedip.de, always returns 127.0.0.2, so you can verify the setup without a real listed address. The test point does not count against the daily quota.

Sub-zones filter by threat category

Insert a category slug between token and zone to match only one threat type: <reversed-ip>.<your-token>.<slug>.bl.reportedip.de. Nine sub-zones are available: spam, brute-force, cms-login, web-attacks, malware, ddos, fraud, infrastructure and apt. A hit is returned only if the address is listed in that category.

How do I add the zone to Postfix or Rspamd?

Your token is a private credential. By default Postfix writes the full zone name, token included, into the 554 rejection that every blocked sender receives and into your mail log. The Postfix example below therefore replaces the reply text.

Postfix

# main.cf
smtpd_recipient_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_rbl_client <your-token>.bl.reportedip.de=127.0.0.[2..3],
    ...
rbl_reply_maps = texthash:/etc/postfix/rbl_reply

# /etc/postfix/rbl_reply
<your-token>.bl.reportedip.de 554 5.7.1 Blocked - your IP is listed at reportedip.de

A texthash: map needs no postmap run, a postfix reload is enough. The single reject_rbl_client line covers IPv4 and IPv6 senders, and other blocklists you query keep their own reply text.

Rspamd

# local.d/rbl.conf
rbls {
  reportedip {
    rbl = "<your-token>.bl.reportedip.de";
    ipv4 = true;
    ipv6 = true;
    returncodes {
      REPORTEDIP_HIGH   = "127.0.0.2";
      REPORTEDIP_MEDIUM = "127.0.0.3";
    }
  }
}

Rspamd adds a symbol to the spam score and sends no zone name to the sender, so the token stays on your server.

Other mail servers and BIND RPZ

Any software that queries a DNSBL by name, such as Exim with its dnslists condition, works with the same zone string. BIND RPZ is not supported: a response policy zone is loaded by zone transfer, and the zone only answers single lookups. The DNSBL setup docs cover every option, including category sub-zones.

What does the zone cost and what are the limits?

7.90 € a month or 79 € a year, incl. VAT. PRO, Business and Enterprise can book it as a separate subscription next to their plan and cancel it in the billing portal.
100,000 DNS queries per day per token, reset at 00:00 UTC. Above the limit that token alone returns 127.255.255.251 until the reset.
As many tokens as you need. Quota, rate limit and rotation apply per token, so one token per mail server keeps a busy relay from using up the budget of the others.
Resolver caching keeps the volume low. A listed answer is cached for 30 minutes and a clean answer for 5 minutes, so most repeat lookups never leave your network.
Privacy. Queried addresses are not written to any database. The DNS servers keep a short rotating operational log without query content and a daily query count per token, and they run in the EU.

Why query a blocklist over DNS instead of a file?

DNS fits this job. Your resolver caches answers, so repeat checks are answered locally. There is nothing to import and nothing to keep in sync, the zone follows the same data that powers our community threat intelligence. The addresses you block are the ones hammering WordPress sites, as documented in the weekend attack report.

For several mail relays, the server cluster guide shows how the zone fits next to firewall blocking on every node.

Which standards does the zone follow?

The zone follows RFC 5782: reversed octets for IPv4, reversed nibbles for IPv6, the 127.0.0.2 test point and the reserved 127.255.255.0/24 range for error codes. The token-in-query layout matches the keyed-DNSBL convention of Spamhaus’ Data Query Service. Unlike most free blocklists, which are IPv4-only, the zone covers IPv4 and IPv6 equally.

Frequently asked questions

Which plans can book the DNS / RBL Zone?

PRO, Business and Enterprise can book the DNS / RBL Zone as a recurring add-on for 7.90 € a month or 79 € a year, incl. VAT. It is not included in any plan and runs as its own subscription, so cancelling it leaves your plan untouched. Free and Contributor accounts see the offer but cannot subscribe.

How is the zone different from the blacklist file?

The zone and the file carry the same community blacklist, only the transport differs. The file is a download you import on a schedule, typically into a firewall. The zone answers each lookup live over DNS, so a mail server always checks against the current list without an import job or a local copy.

Can one token serve several mail servers?

One token can serve several servers, but the 100,000 daily lookups are then shared between them. A separate token per mail server gives each one its own quota and rate limit, and a leaked token can be rotated without touching the others. Additional tokens are booked from the dashboard.

Does the zone work with BIND RPZ?

The zone does not work as a BIND response policy zone. RPZ needs the complete zone by transfer, while the ReportedIP zone only answers single lookups for a valid token. Use it through the DNSBL support of your mail server or spam filter instead, for example Postfix, Rspamd or Exim.

Read on

DNS / RBL Zone: features, price and booking
DNSBL setup docs: every option in detail
DNSBL Blacklist Check: test an address against the zone and twelve other lists
View pricing

DNS RBL Zone: Query Our Community Blocklist From Your Mail Server