---
title: SH
url: 'https://docs.danami.com/warden/user-guide/antispam-plugins/sh'
markdown: 'https://docs.danami.com/warden/user-guide/antispam-plugins/sh.md'
date: '2026-10-02'
description: 'The Spamhaus data query service (DQS) — now known as Blocklists via DNS Query — is a set of DNSBLs with real time updates operated by Spamhaus Technology. How it works Unlike the public mirrors and the RSYNC feed, which use one-minute-delayed updates, the DQS plugin queries Spamhaus directly, so ne…'
taxonomy:
  category:
    - docs
  tag:
    - spamhaus
---

[](#)  [ Basics ](https://docs.danami.com/warden/)     [ User Guide ](https://docs.danami.com/warden/user-guide)     [ Anti-spam Plugins ](https://docs.danami.com/warden/user-guide/antispam-plugins)      SH    

# SH

The Spamhaus data query service (DQS) — now known as Blocklists via DNS Query — is a set of DNSBLs with real time updates operated by Spamhaus Technology.

## How it works

Unlike the public mirrors and the RSYNC feed, which use one-minute-delayed updates, the DQS plugin queries Spamhaus directly, so new block entries are applied in real time. The increase in catch rate between the public mirrors and the DQS is mostly due to these real time updates, which are crucial when dealing with hailstormers.

The plugin queries the following DQS zones:

- **ZEN** - a combination of all Spamhaus IP-based DNSBLs (SBL, XBL, PBL and CSS) into a single zone to make querying faster and simpler.
- **DBL** (Domain Block List) - domains associated with spam or malicious activity.
- **ZRD** (Zero Reputation Domains) - automatically adds newly-registered as well as previously-dormant domains to a block list for 24 hours. The return codes indicate the age of the domain (in hours) since first detection.
- **AuthBL** - primarily designed for use by anyone operating a submission SMTP server. It is a list of IPs that are known to host bots that use stolen credentials to spam. If one of your customers gets their credentials stolen, AuthBL greatly mitigates the ability of botnets to abuse the account, and keeps your MTAs safe from collateral damage.
- **HBL** (Hash Blocklist) - a zone dedicated to dealing with sextortions/scam cryptowallets, dropbox emails, malicious files and malicious URLs.

The plugin is based on the upstream [spamassassin-dqs](https://github.com/spamhaus/spamassassin-dqs/) project from Spamhaus. All zones, their definitions, and all possible return codes are documented in the [Spamhaus data documentation](https://docs.spamhaus.com/10-data-type-documentation/datasets/030-datasets.html).

Besides the standard DNSBL lookups, the plugin adds the following checks:

- **HELO/EHLO domain** - The domain used in the HELO/EHLO greeting is checked against the DBL and ZRD.
- **Header domains** - The domains found in the *From*, *Reply-to*, *Envelope From* and *Return-Path* header lines are checked against the DBL and ZRD.
- **Body email addresses** - The email addresses in the body of the message are extracted and their domains checked against the DBL and ZRD. This approach has been proven useful, for example, in dating-scam campaigns.
- **Reverse DNS** - The rDNS of the last untrusted relay is checked against the DBL and ZRD.
- **Body URLs** - The hostnames of URLs found in the body of the message are resolved and the resulting IP addresses are checked in ZEN (SBL, CSS, XBL and DROP). Whole hostnames from body URLs are also checked against the abused-legit component of the DBL.
- **Cryptowallets** - Cryptowallet addresses (BTC, BCH, XMR, LTC, XRP and ETH) found in the body of the message are checked against the HBL.
- **Attachments** - The hash of every attachment is computed and checked against the HBL for confirmed or suspect malware.
- **Email address hashes** - All email addresses collected from the headers and the body are checked, by hash, against the HBL.
- **URL hashes** - URLs found in the message are hashed and checked against the HBL.

## How to get a Spamhaus API key

1. Signup for the non-commercial use key [here](https://www.spamhaus.com/free-trial/sign-up-for-a-free-data-query-service-account/) or the commercial use key [here](https://www.spamhaus.com/free-trial/free-trial-for-data-query-service/)
2. Navigate to `Warden Antispam and Virus Protection -> Plugin Settings -> SH` and enter the license key under Data Query Service API key and press the update button. Warden will create the service rules file `/etc/mail/spamassassin/SH.cf` with the default scores.
3. If using a **commercial use key** you can enable the [Hash Blocklist (HBL)](https://www.spamhaus.org/faqs/hash-blocklist-hbl/#what-is-hbl). This blocklist specializes in blocking cryptowallet, malware, email addresses and URLs (including shorteners, redirectors and online file storage providers). Important: The HBL is included in the commercial use key only so it should not be enabled when using a non-commercial key.

## Rules

| Rule name | Default scores |
|---|---|
| `RCVD_IN_AUTHBL` | 2.5 |
| `SH_BODYURI_REVERSE_SBL` | 8 |
| `SH_BODYURI_REVERSE_CSS` | 3 |
| `SH_BODYURI_REVERSE_DROP` | 8 |
| `SH_BODYURI_REVERSE_XBL` | 2 |
| `RCVD_IN_ZEN_LASTEXTERNAL` | 8 |
| `RCVD_IN_XBL` | 1 |
| `RCVD_IN_PBL` | 0.001 |
| `RCVD_IN_SBL` | 6 |
| `RCVD_IN_SBL_CSS` | 3 |
| `RCVD_IN_SBL_DROP` | 6 |
| `URIBL_SBL` | 6 |
| `URIBL_SBL_A` | 0.1 |
| `URIBL_DBL_SPAM` | 8 |
| `URIBL_DBL_PHISH` | 8 |
| `URIBL_DBL_MALWARE` | 8 |
| `URIBL_DBL_BOTNETCC` | 8 |
| `URIBL_DBL_ABUSE_SPAM` | 7 |
| `URIBL_DBL_ABUSE_REDIR` | 0.5 |
| `URIBL_DBL_ABUSE_PHISH` | 7 |
| `URIBL_DBL_ABUSE_MALW` | 7 |
| `URIBL_DBL_ABUSE_BOTCC` | 7 |
| `URIBL_DBL_ERROR` | 0.001 |
| `URIBL_CSS` | 0.1 |
| `URIBL_CSS_A` | 0.1 |
| `URIBL_ZRD` | 6 |
| `SH_DBL_BODY` | 8 |
| `SH_DBL_HEADERS` | 8 |
| `SH_ZRD_HEADERS_VERY_FRESH` | 8 |
| `SH_ZRD_HEADERS_FRESH` | 6 |
| `SH_REVERSE_ZRD_VERY_FRESH` | 8 |
| `SH_REVERSE_ZRD_FRESH` | 6 |
| `SH_REVERSE_DBL` | 8 |
| `SH_HELO_ZRD_VERY_FRESH` | 8 |
| `SH_HELO_ZRD_FRESH` | 6 |
| `SH_HELO_DBL` | 8 |
| `SH_AUTHBL_AND_DBL_ABUSED` | 6 |
| `SH_ZRD_BODY_FRESH` | 6 |
| `SH_ZRD_BODY_VERY_FRESH` | 8 |
| `URIBL_DBL_BLOCKED_OPENDNS` | 0 |
| `URIBL_ZEN_BLOCKED_OPENDNS` | 0 |
| `RCVD_IN_ZEN_BLOCKED_OPENDNS` | 0 |
| `URIBL_DBL_BLOCKED` | 0.001 |
| `URIBL_ZEN_BLOCKED` | 0.001 |
| `RCVD_IN_ZEN_BLOCKED` | 0.001 |
| `SH_DBL_ABUSED_FULLHOST` | 6 |
| `SH_SBL_URL` | 6 |

## Hash Blocklist (HBL) Rules

| Rule name | Default scores |
|---|---|
| `SH_HBL_FILE_MALWARE` | 10 |
| `SH_HBL_FILE_SUSPICIOUS` | 10 |
| `SH_HBL_CW_BTC` | 10 |
| `SH_HBL_CW_ETH` | 10 |
| `SH_HBL_CW_BCH` | 10 |
| `SH_HBL_CW_XMR` | 10 |
| `SH_HBL_CW_LTC` | 10 |
| `SH_HBL_CW_XRP` | 10 |
| `SH_HBL_EMAILS` | 8 |
| `SH_URLHASH_ALL` | 8 |
| `SH_URLHASH_WITHQM` | 8 |
| `SH_URLHASH_NOSLASH` | 8 |
| `SH_URLHASH_DEFAULT` | 8 |

## Related Pages

- [SH Settings](https://docs.danami.com/warden/settings/antispam/plugin-settings/sh "SH Settings")

 [](https://docs.danami.com/warden/command-line-interface/antispam/antispam-plugin-sh)

---

## Navigation

- Parent: [Anti-spam Plugins](https://docs.danami.com/warden/user-guide/antispam-plugins.md)
- Previous: [RuleStatistics](https://docs.danami.com/warden/user-guide/antispam-plugins/rulestatistics.md)
- Next: [Shortcircuit](https://docs.danami.com/warden/user-guide/antispam-plugins/shortcircuit.md)