# `mx_blocklisted`: the domain's mail is served from a network on the threat blocklists

At least one of the domain's MX hosts resolves into a netblock or an autonomous system that the Spamhaus DROP lists or the abuse.ch botnet list name. Mail served from there is a burner-domain signal the disposable list has not caught yet.

- Appears in: `reason`
- Verdict: risky
- Risk weight: +60
- Billing: 1 credit, like every deliverable or risky answer. Repeats of the same address are free for 7 days.

The same blocklist feeds the IP product installs — Spamhaus DROP and ASN-DROP, which name hijacked and criminal netblocks and operators, and the abuse.ch botnet list — are read for the addresses the domain's mail hosts resolve to. No new licence and no new download: it is the is_blocklisted answer of the IP endpoint, asked about the mail servers. A domain whose mail lives on such a network is almost never a company somebody works at.

mx_blocklisted is true, the verdict is risky, and the weight of 60 puts the address in the high band by itself. false is a checked negative; null means the domain has no usable mail servers, the hosts could not be resolved, or no blocklist feed is installed on this server. The mailbox handshake still runs, so mailbox_exists can be true.

**What to do.** Refuse the address on a signup form and ask for another; on a list, drop it. A confirmed mailbox on such a network is not reassurance — it is what a spam operation looks like.

```json
{
    "email": "promo@bulk-sender.example",
    "deliverable": "risky",
    "reason": "mx_blocklisted",
    "mx_blocklisted": true,
    "mx_network_type": "hosting",
    "risk_score": 60
}
```

Reference: https://spaw.co/docs/reasons/mx_blocklisted