Usage
The NordSpam Project reputation database consist of bl.nordspam.com (blacklisted IPs) and dbl.nordspam.com (blacklisted domains). You may use the NordSpam DNSBL service free of charge for both commercial and non-commercial purposes. If you are going to be doing more than 10,000 queries a day, please contact us before using these.
IP address blacklist (bl.nordspam.com)
| Name | NordSpam IP Blacklist |
| Description | IP address based data |
| Status | Active |
| Type | DNSBL (IPv4 and IPv6) |
| Query zone | bl.nordspam.com |
| Query records | Zone supports two types of queries, A and TXT. A query will provide the information whether an IP address is listed by returning 127.0.0.2 while a TXT query will show extra information. |
| Positive response | 127.0.0.2 |
| Testpoints | List is invalid if any of the following test points fail:
|
| Recommended action | Block at MTA level |
Example, Linux dig for IPv4:
To query an IPv4 address, you must first reverse the IP address. This is called inverse addressing. Example if you query IP address 127.0.0.2 you must reverse it to 2.0.0.127.
When listed, the example IP 127.0.0.2 will return an A record with "127.0.0.2" and a TXT record like this:
$ dig +short A 2.0.0.127.bl.nordspam.com 127.0.0.2 $ dig +short TXT 2.0.0.127.bl.nordspam.com "RFC5782 TEST-record."
Example, Linux dig for IPv6:
To query an IPv6 address, you must first expand it, and then reverse it. Example if you query IP address ::FFFF:7F00:2 you must expand it to 0000:0000:0000:0000:0000:FFFF:7F00:0002 and then you must reverse it to 2.0.0.0.0.0.f.7.f.f.f.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
When listed, the example IP ::FFFF:7F00:2 will return an A record with "127.0.0.2" and a TXT record like this:
$ dig +short A 2.0.0.0.0.0.f.7.f.f.f.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.bl.nordspam.com 127.0.0.2 $ dig +short TXT 2.0.0.0.0.0.f.7.f.f.f.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.bl.nordspam.com "RFC5782 TEST-record."
Domain name blacklist (dbl.nordspam.com)
| Name | NordSpam Domain Blacklist |
| Description | Domain name based data |
| Status | Active |
| Type | URIBL (Domain/URI only) |
| Query zone | dbl.nordspam.com |
| Query records | Zone supports two types of queries, A and TXT. A query will provide the information whether an IP address is listed by returning 127.0.0.2 while a TXT query will show extra information. |
| Positive response | 127.0.0.2 |
| Testpoints | List is invalid if any of the following test points fail:
|
| Recommended action | Block at MTA level |
Example, Linux dig:
When listed, the test domain test will return an A record with "127.0.0.2" and a TXT record like this:
$ dig +short A test.dbl.nordspam.com 127.0.0.2 $ dig +short TXT test.dbl.nordspam.com "RFC5782 TEST-record."
Zone transfers and API
If you believe you will be making thousands of queries per hour, we may let you use our API or transfer the zone files for a locally cached version of these DNSBLs. We will review these on a case-by-case basis, just contact us via contact page.