DNSBL

A DNS blocklist is queried by encoding the address into a hostname and doing a normal DNS lookup. An answer means listed, no answer means not listed. Because it rides on DNS it is fast enough to run inside a mail transaction.

Lists differ enormously in what they record and how quickly they remove entries. Some track compromised machines, others open relays, others policy blocks on entire ranges. Treating them as interchangeable produces false positives.

We query several independent lists and report which ones matched, rather than collapsing everything into a single yes or no, because the identity of the list is what tells you what the listing means.