Status of ix.dnsbl.manitu.net: DEAD

The maintainers of the "NixSPAM" blocklist (with a DNSBL zone of ix.dnsbl.manitu.net) have decided to shut down. As of January 16, 2025, their website at nixspam.net states that, "With a heavy heart, we have decided to discontinue the project ix.dnsbl.manitu.net." This matches a statement posted by the blocklist's maintainer on X.

No further information is available at this time. The website indicates that further information may be coming. In the mean time, I suggest that you remove this DNSBL from any spam filtering or IP reputation checks as soon as possible, as when blocklists shut down, they often can end up with "wildcard DNS" that can cause unexpected and unwanted inbound email delivery impediments. 

Jan-Piet Mens previously described the NixSPAM thusly: "The NixSPAM black-list is a DNS block-list created by Bert Ungerer of ix. It contains automatically generated entries from open proxies, relays, dialup gateways, etc., and [...] Black-listed entries are automatically removed after 12 hours if no further spam from that particular source is detected within that time frame."

The NiXSPAM blocklist appears to have launched in 2003. Congrats to iX for a nearly 22 year long run.

Status of dnsbl.sorbs.net: DEAD

Multiple sources are reporting (and Proofpoint has confirmed -- see below) that the SORBS blocklist is shutting down.

According to SORBS website, they published the following DNS zones:

• badconf.rhsbl.sorbs.net
• block.dnsbl.sorbs.net
• dnsbl.sorbs.net
• dul.dnsbl.sorbs.net
• escalations.dnsbl.sorbs.net
• http.dnsbl.sorbs.net
• misc.dnsbl.sorbs.net
• new.spam.dnsbl.sorbs.net
• nomail.rhsbl.sorbs.net
• noserver.dnsbl.sorbs.net
• old.spam.dnsbl.sorbs.net
• recent.spam.dnsbl.sorbs.net
• rhsbl.sorbs.net
• smtp.dnsbl.sorbs.net
• socks.dnsbl.sorbs.net
• spam.dnsbl.sorbs.net
• web.dnsbl.sorbs.net
• zombie.dnsbl.sorbs.net

I would recommend removing any and all of these from any spam filter or mail server configuration ASAP.

You can find analysis on SORBS and this shutdown over on Mickey Chandler's Spamtacular blog. Word to the Wise had previously published a lengthy series of issues and concerns surrounding SORBS going all the way back to 2010.

Proofpoint confirmed SORBS closing to the Register, providing the following statement:

"The decision to sunset a product is never an easy one and was made after thorough consideration of various factors impacting the service's sustainability. We can confirm that SORBS was decommissioned on June 5, 2024, and the service no longer contains reputation data. Given the wide range of potential replacement solutions in the market, Proofpoint cannot make recommendations nor endorse any specific replacement product; this is dependent on an organization's needs."

As of the publishing of this note, the SORBS website itself does not seem to indicate that things are shutting down; but note the confirmation of shutdown by Proofpoint, as quoted in various press linked above.

Status of ubl.unsubscore.com: OFFLINE

LashBack's unsubscribe blacklist ("UBL"), as described by its publisher "is a unique, real-time blacklist of IP addresses which have sent email to addresses harvested from suppression files." It's a neat idea, an interesting way to monitor unsusbcribe compliance. But it can be tricky when it comes to things like shared IP addresses, addresss leakage, subscription forgery or data breaches. As I haven't tested it in a while, I can't speak to its accuracy as far as a spam filtering tool. I did test it years ago but that data is so dusty as to not warrant digging it back up.

Anyway, the reason I mention this today is that I've seen a poster on the Mailop list indicate that the Lashback UBL DNSBL is currently unavailable. If you use this DNSBL (ubl.unsubscore.com) in any of your spam filtering tools, you'll want to remove it.

Status of dnsbl.inps.de: DEAD

Christian Jung launched the inps.de DNSBL way back on December 29th, 2007.

Christian described the listing criteria as follows: "Every day thousands of spam e-mails arrive on our e-mail servers, which have to be processed by our anti-spam system. If an email is recognized as spam, the IP address of the sender is recorded in a blacklist for a certain period of time in order to enable faster email processing and reduce the system load."

Today, May 25, 2020, he has announced that it is shutting down, due to concerns around GDPR and personal challenges brought on by the coronavirus pandemic.

He appears to be shutting it down in a graceful manner -- not "listing the world" as so many lists do as they wind down. This is good to see.

Note that in addition to the DNSBL dnsbl.inps.de, this also affects the DNSWL (whitelist) found at dnswl.inps.de. Both are ceasing.

If you use either the whitelist or blocklist in your email server config, you'll want to disable those checks as soon as possible. 

Status of all.rbl.webiron.net and bsb.spamlookup.net: DEAD or BROKEN

Two anti-spam blocking lists appear to have died or malfunctioned recently.

Users on the Mailop mailing list are reporting that Webiron (all.rbl.webiron.net) blocklist appears to be malfunctioning. Its domain has expired and the temporary holding pattern pending payment or termination has resulted in the Webiron DNSBL effectively "listing the world" because of wildcard DNS entries.

Another list, BSB (bsb.spamlookup.net), a DNSBL focusing on "comment spam," also recently appears to have died, as reported by MX Toolbox back on April 17th.

When most lists "die" or malfunction, they often end up with wildcard DNS entries in place, as this is a common domain DNS setting implemented by registrars, domain speculators, or domain parkers. What this means is that every single DNSBL query made to the DNSBL's domain is falsely returns with "yes, block that IP address." Meaning your spam filter suddenly blocks 100% of your inbound mail. This is bad news, if you like to actually receive inbound mail.

If you're using either of these lists, you should cease doing so immediately, as their use may impede your ability to receive inbound mail successfully. As always, it's important to pay attention what DNSBLs you use for spam filtering, and periodically review and ensure that they still exist and that they're working properly.

And if you run a DNSBL, see RFC 6471 for best practices around DNSBL management, including how to appropriately shut one down.