mx_blocklisted

The domain's mail is served from a blocklisted network

At least one MX host resolves into a network on the threat blocklists the IP product installs — Spamhaus DROP and ASN-DROP, abuse.ch Feodo Tracker — a burner signal no domain list has caught yet.

risk weight: +60
dataset: threat-blocklists
reads from: mx_blocklisted
verdict reason: mx_blocklisted

What it means

The MX hosts' addresses run through the same feeds that flag an IP address. False is a checked negative; null means no host resolved or no blocklist feed is installed. The network class of the first host is reported beside it as mx_network_type.

It reads from the mx_blocklisted field and comes with the mx_blocklisted verdict reason, placed after disposable.

What to do

Do not send. An organisation does not route its mail through a hijacked netblock by accident; the default sending policy blocks on it.

Example response

{
    "email": "[email protected]",
    "deliverable": "risky",
    "reason": "mx_blocklisted",
    "mx_blocklisted": true,
    "mx_network_type": "hosting",
    "risk_signals": [
        {
            "signal": "mx_blocklisted",
            "weight": 60,
            "dataset": "threat-blocklists"
        }
    ]
}

Abbreviated: a real answer carries all 46 fields, listed in the verify-email reference. The risk_signals entry shown is the one this signal adds; the weights of every entry in the list sum to risk_score.

markdown version: /docs/signals/mx_blocklisted.md

mx_blocklisted

What it means

What to do

Example response

Related