Things I learned wiring up dozens of public IP blocklists: frozen mirrors, duplicate zones, and Google DNS on a spam list

I've spent the last few months aggregating public blocklists and DNSBLs for a reputation lookup tool. A few things surprised me, and they matter if you run your own blocklist checks:

1. A frozen mirror can look fresh. One well-known traplist has a mirror whose own header says it was generated in September 2025, yet its HTTP Last-Modified header moves every hour. Judge freshness by the timestamp inside the file, not the HTTP headers.
2. Several "different" lists are the same data. One provider's main DNSBL zone is exactly the union of its "netscan" and "spam" zones. Another's Tor zone is just the Tor category of its main RBL. A third publishes the same Tor exit list over DNS and over HTTP. Count them separately and one Tor exit collects about six detections from two or three real sources.
3. "Tor" lists aren't all exit lists. One popular zone lists every Tor relay, including non-exit relays. Those never send user traffic to the internet, so treating them as Tor exits is a false positive.
4. Public resolvers end up on spam lists. A commercial anti-spam list carries 8.8.8.8, with a spam rate of zero. Resolver addresses turn up in form-spam data from everyone's traffic. Exclude the well-known resolvers before trusting a hit.
5. Dead lists read as clean forever. Plenty of lists that tools still show have name servers that never answer, or feeds that return 404. They report "not listed" on every lookup.
6. Some zones are wildcarded. A zone that answers 127.0.0.2 for every query flags the whole internet. Test each zone with the RFC 5782 test entries first: 127.0.0.2 should be listed and 127.0.0.1 should not.
7. Check the licence before you ship a list. Several "free" lists forbid commercial use or redistribution, and one explicitly bans reselling its data "as part of a larger package".

Disclosure: I build Senapati (senapati.io), an IP, domain, URL and email reputation API, which is where I ran into all of this. Happy to go into detail on any of these.