blocklists

Blocklists are curated collections of items identified as undesirable that are blocked or filtered by computer systems. They typically include IP addresses, domains, URLs, or email addresses and are used to prevent access to or interaction with those items. The primary purpose is to reduce abuse, protect users, and enforce access controls across networks, services, and applications.

Common types of blocklists include IP blocklists (often distributed as DNS-based blacklists for known abusive hosts), domain blocklists, URL blocklists, and email blocklists used by mail servers to reject or quarantine spam and malware. These lists can be maintained by organizations, security vendors, or community contributors and are distributed through various mechanisms such as DNS, software filters, or gateway appliances.

Blocklists are deployed in a range of environments, including mail servers to block spam origins, firewalls and intrusion prevention systems to deny traffic from malicious sources, web gateways and parental controls to restrict access to harmful sites, and content management systems to enforce security policies. They are also used in consumer and enterprise security products to provide real-time protection.

Governance, transparency, and maintenance are key considerations. Inclusions are typically governed by published criteria, with update schedules and notices to affected parties. Some lists are public and open to suggestion or appeal, while others are commercial. Debates around blocklists focus on accuracy, privacy, and the risk of over-blocking or false positives.

Limitations include the potential for false positives, evasion by attackers, reliance on timely updates, and the need for whitelisting and review processes to ensure legitimate traffic is not blocked.