Incident

Spamhaus Sunsetting Public DNS Mirrors: What to Do Before April 8, 2026

Spamhaus is sunsetting its public DNS mirrors on April 8, 2026. Mail servers using public DNS resolvers (8.8.8.8, 1.1.1.1) to query Spamhaus blocklists will stop getting valid responses. The fix is to register for a free Spamhaus DQS key.

Published

On April 8, 2026, Spamhaus flips off public DNS mirror answers — queries that used to return blocklist data via resolvers like 8.8.8.8 will come back as NXDOMAIN. If your Postfix or RBL still points at zen.spamhaus.org without DQS, your spam filter quietly stops working.

What is changing

Spamhaus has always provided blocklist queries via DNS. Anyone could query zen.spamhaus.org using public resolvers. From April 8, 2026: queries via public resolvers return NXDOMAIN instead of blocklist results. Only queries from registered DQS (Data Query Service) accounts will continue to work.

Who is affected

DomainPreflight uses Spamhaus DQS — the IP blocklist check on the Email Deliverability tool is not affected.

The fix

Register for a free Spamhaus DQS account at spamhaus.org/dqs. Free tier covers self-hosted mail servers.

Update your mail server config:

Before April 8: reject_rbl_client zen.spamhaus.org After April 8 (with DQS key): reject_rbl_client [key].zen.dq.spamhaus.net

Migration steps

Step 1 Go to spamhaus.org/dqs and register for a free account
Step 2 Get your DQS API key from the dashboard
Step 3 Update your mail server config to use the DQS hostname format: [key].zen.dq.spamhaus.net
Step 4 Test the new config before April 8 — don't wait
Step 5 Run DomainPreflight Email Deliverability to verify blocklist checks still work

Email Deliverability (blocklists)

Open Email tool →
Related: Blacklist · Blacklisted IP

FAQ

What is Spamhaus sunsetting?

Spamhaus is ending public DNS mirror access on April 8, 2026. Queries via public resolvers (8.8.8.8, 1.1.1.1) will return NXDOMAIN instead of blocklist results.

How do I fix this before April 8?

Register for a free Spamhaus DQS account at spamhaus.org/dqs, get your API key, and update your mail server to use the DQS hostname format.

Is DomainPreflight affected?

No — DomainPreflight already uses Spamhaus DQS. The Email Deliverability blocklist checks continue working.

What happens if I do nothing by April 8?

Your mail server's Spamhaus blocklist checks will stop working — returning NXDOMAIN for all queries. This effectively disables that spam check.

Is the Spamhaus DQS free?

Yes for self-hosted mail servers with low query volume. Commercial use requires a paid plan.

← All incidents

Open DomainPreflight →