Blacklists and Sender Reputation

Everything covered so far answers "is this message allowed to claim this identity." Blacklists answer a completely separate question receiving mail servers ask first: "does this sender have a history of sending abuse?" – and a bad answer can get mail silently dropped or heavily spam-filtered regardless of how clean the authentication is.

What a DNSBL actually is

A DNS-based blacklist (DNSBL) is a shared, queryable list of IP addresses and domains reported for sending spam, hosting malware, or other abuse. Many receiving mail servers check a sending domain or IP against several DNSBLs as one of the first steps in deciding how to treat an incoming message – before authentication is even evaluated in some pipelines.

How a domain actually ends up listed

• A compromised account starts sending spam through otherwise-legitimate infrastructure.
• Shared IP reputation bleed – on shared hosting or a shared email-sending platform, a neighbor's bad behavior can affect a domain's own deliverability, even though nothing was done wrong locally.
• Poor list hygiene – sending to purchased or stale contact lists produces high bounce and spam-complaint rates, which is exactly the signal DNSBL operators look for.

Why this needs its own ongoing check

Reputation is dynamic, not a one-time state – a domain can be clean today and listed next week from any of the causes above, often from something outside the domain owner's own direct control (like shared infrastructure). That's why this belongs alongside SPF/DKIM/DMARC in a monitoring routine, not treated as a one-time setup step. ActiScan's blacklist checker checks a domain against 7 real DNSBLs in one pass, the same set used in ActiScan's own scheduled tenant scans.