Blocklist

A blocklist is a maintained list of domains, IP addresses, or other identifiers that a particular service uses to restrict activity or examine it more closely. Different lists track different things: one may identify email spam sources, while another may contain domains linked to phishing or malware. Being listed can affect a particular check or service, but it is not a universal ruling that a domain is dangerous everywhere.

What can a blocklist contain?

The list's purpose determines what it records and how a system uses it. For example, Spamhaus operates both IP-address lists and a separate domain list. A mail filter can consult a list while deciding whether to accept a message; a security product may use a different dataset to warn about a link. The data and meaning should be checked with the organization that maintains that list.

If example.com appears in one domain list, one provider may use that result to send mail to spam, while another provider may ignore that list or use different evidence. A listing does not necessarily mean the domain owner caused the activity: an attacker can take control of or misuse a legitimate website. Likewise, a clean result from one list does not prove that the domain is safe or absent from every other list.

Is a blocklist the same as a blacklist?

“Blocklist” is a common name for this kind of data. Services often call their data a blocklist, reputation list, DNS-based blocklist, or security feed. The name alone does not explain what identifiers it covers, how entries are added, or what a matching result means. Check the list's documentation and the actual effect on the service you are investigating.

Related terms

• Domain reputation — a broader assessment based on signals
• False positive — a mistaken match or one that includes more than the intended threat
• Spam — one reason mail systems consult lists
• Malware — a separate threat category