Identify the object before the list

For an SMTP rejection or received message, record the connecting IP seen by the deciding receiver. Do not substitute the website host, a recipient’s client IP from a lower Received field, or every relay in the path. For a domain investigation, specify whether you mean the visible From, DKIM signing domain, SMTP MailFrom, HELO/rDNS, or a link/redirect domain.

Different lists expect different query forms. Spamhaus’s DBL is domain-only; querying an IP against it is explicitly wrong and can return an error/listed-looking code. Its IP datasets cover distinct purposes such as observed abuse, compromised hosts, or address space that should not send direct-to-MX.

Read the dataset’s policy

Create one row per source:

Dataset Identifier Intended use Observation Time Limits
Domain list exact domain documented message/content stage listed/not listed/unavailable UTC coverage and license
IP abuse list connecting IP SMTP connection filtering result code UTC source-specific reason
IP policy list connecting IP direct-to-MX policy policy result UTC not proof of abuse

Never merge results into “listed on 3 blacklists” without preserving which lists, categories, response codes, and query times produced the count.

Separate evidence from effect

A listing says the operator’s current criteria matched the identifier. It does not prove that every receiver uses the list, that the affected message was blocked because of it, or that every message from the domain/IP is malicious. Conversely, “not listed” means only that the queried dataset returned no listing at that time; it is not a clean reputation certificate.

Look for the receiver’s SMTP response or official dashboard evidence tying its action to a named source. Then investigate the behavior behind the listing: compromised account, unwanted list acquisition, shared-pool abuse, misrouted direct mail, or malicious links.

Record a reproducible result

Store normalized identifier, dataset/version or zone, exact response, resolver/provider, UTC time, and source link. Keep timeout, blocked query, unsupported identifier, and license error as unavailable—not not-listed. The investigation is useful when each result names the right object and the next owner, rather than producing a universal score from incompatible datasets.