Your question
I am trying to understand the spam filtering, especially regarding DNS blocklists.
Having a hard time to understand the scoring/rule feedback in the headers for spam.
Especially the following
DNSWL_BLOCKED (0.00),
RBL_SENDERSCORE_REPUT_BLOCKED (0.00),
URIBL_BLOCKED (0.00),
I am assuming, that this is feedback from the black-/whitelist check. However is this the feedback the IP is blocked, or am I blocked from making requests to the list? Both could be possible? I assume, that it is the latter, as there is no weight on it, so this is just FYI?
Is there any documentation, that I haven’t found?
I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.
on
Your reading is correct: _BLOCKED means the list is refusing queries from the resolver Stalwart is using, not that the sender IP or URL is listed. The (0.00) weight is deliberate: those tags are informational and don’t affect the spam score, precisely because the lookup returned no usable data. When a list doesn’t want to answer you, it returns a special “you’re blocked” sentinel response instead of a real listing code, and Stalwart’s default rules map that to the _BLOCKED tag at zero weight.
Seeing three different lists all report _BLOCKED at once is the classic sign of a resolver problem rather than three coincidences. The usual cause is that Stalwart’s DNS queries are going out through a big public resolver (8.8.8.8, 1.1.1.1, Quad9), which Spamhaus, URIBL and SenderScore all block, or that you’ve exceeded a free query allowance. The fix is to run a local recursive resolver (unbound, say) on the mail host and have Stalwart query the lists through it, or subscribe to the providers’ authenticated feeds (Spamhaus DQS with your own key, URIBL paid). Once queries come from an accepted resolver the _BLOCKED tags go away.