# Spamhaus refuses public resolvers: why we don't ask it > Spamhaus refuses queries that arrive through public resolvers, so asking it from an ordinary computer returns a confident wrong answer. We left it out instead. Source: https://mosaicbrowser.com/blog/spamhaus-public-resolver ## Why our reputation check doesn't ask Spamhaus Spamhaus refuses queries that arrive through public resolvers, so asking it from an ordinary computer returns a confident wrong answer. We left it out instead. ![A check that lies is worse than one that is missing](https://mosaicbrowser.com/covers/spamhaus-public-resolver.webp) Spamhaus refuses queries that reach it through a public resolver. Ask its blocklist about an address from a laptop whose DNS goes through Cloudflare's 1.1.1.1 or Google's 8.8.8.8, and the answer you get back describes your resolver, not the address. Depending on the resolver it comes as an error code shaped exactly like a listing or as silence that looks like a clean bill. Neither is about the IP you asked for. So Mosaic's reputation check does not ask Spamhaus at all, and the reason is written above the list of blocklists it does ask: a check that lies is worse than one that is missing. ## How a DNS blocklist answers A DNS blocklist, or DNSBL, is queried with an ordinary DNS lookup. To ask whether `203.0.113.7` is listed in a zone, you reverse its four numbers and put the zone name after them: ``` 7.113.0.203.zen.spamhaus.org ``` If the name does not exist, the address is not listed. If it resolves, the address it resolves to is not somewhere to connect. It is a reason code, and every list publishes its own table of them. Listings live in `127.0.0.x`, where each last number means something different: a spam source, an open proxy, a hijacked range. That design is cheap and fast, and it has one weakness. The blocklist never sees you. It sees the recursive resolver that forwarded your lookup, and a large public resolver forwards lookups for millions of people at once. Mosaic is a desktop app Email yourself the link and open it on your computer. [How it works: Provider minting](https://mosaicbrowser.com/features/proxy-providers) ## Why "spamhaus query refused public resolver" happens Spamhaus's free mirrors are meant for low-volume use, and the operator cannot tell how much one user is asking if every query arrives from the same public resolver. So it does not answer queries arriving that way. Instead it sends an answer from a separate range, `127.255.255.x`, which it uses for errors: a mistyped zone, too many queries, and, at `127.255.255.254`, a query that came through a public or open resolver. Some public resolvers do not even pass that code along and answer as if nothing were listed. Mail servers meet this first. A server whose resolver forwards to a public one gets the error code on every lookup. If its software treats any answer as a listing, it rejects every incoming message, and the log line says "blocked using zen.spamhaus.org". The other failure is quieter and worse. A resolver that turns the refusal into "not listed" lets everything through, and nothing errors, so nobody notices. ## Why we left it out instead of handling it Our reputation check is part of the same proxy check that tests whether an exit [answers and tunnels](https://mosaicbrowser.com/blog/proxy-checker-says-working). It runs on the computer Mosaic is installed on, and it sends its blocklist lookups to 1.1.1.1 and 8.8.8.8 on purpose. Some home and office ISP resolvers filter blocklist zones entirely, and we did not want the answer to depend on whichever network the laptop happened to be on that day. Pinning the resolvers makes the result repeatable. It also puts every query on exactly the route Spamhaus refuses. We could have kept Spamhaus and read its error codes properly. That would have left a row in the report that never produces an answer on an ordinary machine. On a Cloudflare route it would show a refusal on every address, and on a route that swallows the code it would show "not listed" on every address, which is the worse of the two because it looks like information. A blocklist the check cannot read honestly is better gone than present and wrong, so the code comment says it plainly: Spamhaus is deliberately absent. ## What the check asks instead The check asks a handful of other lists instead, SpamCop among them. Each has its own table of codes, so a hit is printed as its meaning, "Reported as a spam source" rather than `127.0.0.2`. An answer that is not in a list's table is printed as the raw address rather than translated, so an unexpected code shows up as something odd to look at rather than as a clean result. A missing name and a timeout are both treated as silence: neither is evidence the address is bad. That cuts both ways, and we know it. A list that stops answering looks, from here, like a list that has nothing on you, so a clean row means "nothing checked said otherwise", not proof. A listing is only one input. The check also looks at whether the exit sits in a datacentre range, using the network classification from the geo lookup and words like `hosting` or `vps` in the reverse DNS name or the ISP, and whether there is any reverse DNS at all. Those add up to a risk from 0 to 100: 25 for each listing up to 60, 20 more if a listing names an open proxy or relay, 25 for a datacentre range and 5 for no reverse DNS. Under 25 is clean, from 25 to 59 is caution and 60 or more is risky. Only IPv4 addresses can be scored this way, and the report says so instead of pretending. There is one more line the check adds when it applies. If the proxy endpoint rotates, the address it scored is one draw from a pool, not the exit a profile will browse from, and the report says to pin a sticky session to score the real one. Reputation is part of [checking a proxy before you use it](https://mosaicbrowser.com/guides/how-to-check-a-proxy-before-you-use-it), and what a clean residential address can still trip over is in [a residential IP detected as a proxy](https://mosaicbrowser.com/blog/residential-ip-detected-as-proxy). If you need Spamhaus's verdict on one exit, look the address up on Spamhaus's own website. It answers a person directly, with nothing in between to change the meaning. ## Questions ### Why does Spamhaus say my query was refused or blocked? Because it reached Spamhaus through a public or open resolver such as 1.1.1.1 or 8.8.8.8. Spamhaus does not answer those for its free mirrors, so the reply describes the route your query took, not the address you looked up. ### Does a 127.255.255.x answer from Spamhaus mean the IP is listed? No. Spamhaus uses answers in 127.255.255.x as error codes, and one of them means the query came through a public resolver. A listing is an answer in 127.0.0.x. Software that treats every answer as a listing will call every address bad. ### How do I query Spamhaus properly? From your own recursive resolver that does not forward to a public one, or through the access Spamhaus offers for registered users. For a one-off look at a single address, its website lookup is simpler than DNS. ### Does Mosaic check proxies against blocklists? Yes. The proxy check scores the exit address against several public DNS blocklists, along with whether it sits in a datacentre range and whether it has reverse DNS. Spamhaus is not among them, for the reason in this post. ## Related [How to check a proxy before you use it](https://mosaicbrowser.com/guides/how-to-check-a-proxy-before-you-use-it): Check that a proxy answers and tunnels, where its exit really is, whether the address is residential or blocklisted, and that the browser stays behind it. [The residential IP several detectors already knew](https://mosaicbrowser.com/blog/residential-ip-detected-as-proxy): A residential proxy can be detected as a proxy because it is one. On one Wichita exit, FingerprintJS and incolumitas never loaded in three rounds. [A green tick that means the socket opened is worthless](https://mosaicbrowser.com/blog/proxy-checker-says-working): A proxy checker can pass while sites fail, because most test plain HTTP and the browser needs a CONNECT tunnel. Exit and stability are separate answers too. [Provider accounts: one gateway line, one exit per profile](https://mosaicbrowser.com/features/proxy-providers): Paste your proxy seller's gateway line once and Mosaic mints a separate session for every profile, so each one browses from its own exit address.     ## Mosaic, on your own computer The browser this blog is about: its own Chromium, fingerprints from real machines and a proxy exit per profile. Free holds 3 profiles. Pro is $49 a month for any number. Mosaic is a desktop app Email yourself the link and open it on your computer.