Spamhaus SBL vs DBL: which list is which and what they each block

Spamhaus runs several blacklists and most cold-email operators conflate them. The SBL (Spamhaus Block List) and DBL (Domain Block List) are the two that matter most for cold email, and they block very different things. Understanding which list you are on changes how you respond.

The SBL - Spamhaus Block List

The SBL blocks IP addresses. When a sending IP gets listed on the SBL, mail providers that consult Spamhaus reject (or aggressively spam-filter) every message from that IP, regardless of which domain it claims to send from. SBL listings are typically triggered by sustained complaint rates, abuse reports, or operator-pattern matching (botnet activity, snowshoe spamming).

Why SBL matters less for shared SaaS senders

Cold-email senders on Google Workspace or Microsoft 365 use shared SMTP IPs across thousands of tenants. Those IPs are owned and managed by Google and Microsoft, who actively defend them against SBL listings (Spamhaus rarely lists Workspace or M365 send-IPs because of the abuse-response infrastructure both vendors run). Shared-IP cold senders almost never see their IP on the SBL. Dedicated-IP cold senders absolutely can.

The DBL - Domain Block List

The DBL blocks domains, not IPs. When a domain gets listed on the DBL, mail providers reject or spam-filter messages where that domain appears in the From line, in URLs in the body, or as part of the authenticated sender identity. DBL listings hit cold-email senders much harder than SBL because the cold-email reputation lives at the domain layer.

How a cold-email domain ends up on the DBL

• Sustained complaint rate from recipients flagging messages from that domain as spam
• Abuse reports from organizations that received cold mail from the domain without consent
• Burst sending from a brand-new domain (the classic 50K-in-a-weekend pattern)
• Hosting URLs in body copy that point to spam-flagged destinations
• Inheriting reputation from a domain previously used by spammers (rare but happens with secondhand domain purchases)

Other Spamhaus lists

• XBL - exploited and botnet IPs, mostly automated detection
• PBL - "policy block list", IPs that should not be sending direct mail (residential IPs, etc.)
• CSS - composite snowshoe spam, mostly for newer spam-pattern detection

Operational response by list type

SBL: contact your sending-IP owner (Google, Microsoft, or your dedicated-IP provider) and let them handle delisting through their direct Spamhaus relationship. You typically cannot delist their IP yourself. DBL: submit a delisting request via spamhaus.org/lookup, audit the trigger (list quality, volume pattern, content), and remediate before submitting. DBL delisting requires you to attest to the remediation.

How to check

Run a lookup at mxtoolbox.com/blacklists or dnsbl.info with both your sending domain and your sending IP. If you are on shared Workspace/M365 IPs, the IP check is informational only (you cannot do much about it). The domain check is the actionable one for cold-email senders.

“Shared-IP cold senders rarely see SBL listings. DBL listings are what cold-email operators actually need to monitor - and the DBL delisting process is owned by the sender, not by an upstream IP provider.”

Prevention

Three things to keep cold-email domains off the DBL. (1) Validate every list before sending - hard bounces above 4 percent for sustained periods trigger DBL detection. (2) Cap sending volume per mailbox (10-20/day) and per domain (2-3 mailboxes × 10-20 = 20-60/day max). (3) Never burst-send from a fresh domain. Most DBL listings we see in customer remediation come from violating one of these three.