# `mx_blocklisted`: the domain's mail is served from a blocklisted network

At least one MX host resolves into a network on the threat blocklists the IP product installs — Spamhaus DROP and ASN-DROP, abuse.ch Feodo Tracker — a burner signal no domain list has caught yet.

- Weight: +60
- Dataset: threat-blocklists
- Read from: `mx_blocklisted`
- Verdict reasons it comes with: `mx_blocklisted`

The MX hosts' addresses run through the same feeds that flag an IP address. False is a checked negative; null means no host resolved or no blocklist feed is installed. The network class of the first host is reported beside it as mx_network_type.

It reads from the mx_blocklisted field and comes with the mx_blocklisted verdict reason, placed after disposable.

**What to do.** Do not send. An organisation does not route its mail through a hijacked netblock by accident; the default sending policy blocks on it.

```json
{
    "email": "mia@shady.example",
    "deliverable": "risky",
    "reason": "mx_blocklisted",
    "mx_blocklisted": true,
    "mx_network_type": "hosting",
    "risk_signals": [
        {
            "signal": "mx_blocklisted",
            "weight": 60,
            "dataset": "threat-blocklists"
        }
    ]
}
```

Reference: https://spaw.co/docs/signals/mx_blocklisted