How Blacklists Work
A blacklist is a database of IP addresses, mail servers, email addresses, etc. that are known to be used by spammers[1]. Internet Service Providers and email services maintain memberships with the companies that manage these lists in order to prevent as mush spam as possible from reaching their subscribers’ inboxes. Yet blacklists do more than decrease email users’ annoyance; they also prevent virus-bearing spam emails from getting through. As such blacklists are a vital online security tool. When used in concert with spam filters they can greatly reduce the amount of wasted time and risk that junk mail creates.
Here’s a simple glossary of blacklist-related terms that might be helpful to the everyday email user:
Whitelist - Just as a blacklist makes it harder for identified spammers to operate online a whitelist makes it easier for vetted and reputable email senders to get their messages through. When an IP address, email sender, etc. has been vetted as being spam-free it can be added to a whitelist that allows unrestricted access to areas of the Internet it monitors. One type, called a Bonded Sender Whitelist, forces mass email senders to come up with a large cash bond prior to being allowed to send to any inboxes. Any subsequent spam complaints beyond a small amount will then trigger fines levied against the bond.
Greylist - A greylist might be thought of as a sort of email purgatory. When an email is sent from a new and unrecognized sender it will automatically be bounced back. If the communication is legitimate then the sender may try to send again at a later time, in which case the email will be accepted. Most spam won’t be resent after a greylist bounce back. This is commonly because the spam was generated autonomously in the first place by a zombie or botnet. Greylists usually have a waiting period that must expire before the email can be resent. During this time suspicious emails can be examined and labeled as likely being spam.
Yellow list - Senders that find themselves on a yellow list send legitimate email most of the time, but occasionally some spam slips through. These are usually reputable sites/ sources that recipients will most likely never want blacklisted. Thus the minimal risk posed by emails from these places is acceptable. Occupying a spot on a yellow list prevents the necessity of being checked against a blacklist.
DNS Blacklists - A Domain Name Server Blacklist maintains a database of IP addresses that are confirmed sources of spam.
IP Blockers - Also known as “Blackholes” IP Blockers are a vault of previously identified sources of spam that can be queried by mail providers to permanently block specific senders.
References