Usage Policy

SURBL intelligence datasets are updated more than 240 times daily and are provided to users worldwide via public DNS servers or via a data feed service. The former (DNS query) is completely free and subject to certain usage restrictions, while the latter (Data Feed) is a paid service. The revenue generated by the paid service ensures that SURBL can continue to reliably provide the information that hundreds of millions of users depend upon to keep their mailboxes and computers safe from messages that are unsolicited, phishing, or malware.

Free Use:

For individual users, small charitable or non-profit organizations, small businesses or any other organizations that have fewer than 1,000 users or that scan fewer than 250,000 messages per day in total, the SURBL Free Query Service (FQS) is completely free and can be accessed via a worldwide network of servers. Free use of FQS is restricted and does not include embedding SURBL data in any way into products or services for which a fee is charged.

This network of FQS servers is geographically diverse to ensure a very high level of responsiveness and reliability. These servers are reserved for use by small organizations and individual end users, and they are monitored against abuse by heavy users.

Sponsored Use:

Any end-user organization, including software developers, ISPs, or providers of email filtering (either as hardware, software or services, individually or as a combined offering) of 1,000 or more users MAY NOT use the SURBL free queuery service (FQS). Instead they need to sign up for our Sponsored Data Service (SDS). SDS was developed to meet the professional needs of organizations and email technology providers who have a large number of mail messages to scan. As such it is far more efficient to conduct these scans against a local copy of the SURBL data.

SDS data are provided using an rsync feed that automatically updates the content with new additions. The SDS subscription fee includes unlimited access to our technical support team. Any product or service which makes use of our intelligence must have a valid SDS usage agreement.


usage-policy.html version 2.00 on 12/12/2022, revision 1.02 on 12/12/2022

SURBL Data Feed Request

SURBL Data Feeds offer higher performance for professional users through faster updates and resulting fresher data. Freshness matters since the threat behavior is often highly dynamic, so Data Feed users can expect higher detection rates and lower false negatives.

The main data set is available in different formats:

Rsync and DNS are typically used for mail filtering and RPZ for web filtering. High-volume systems and non-filter uses such as security research should use rsync.

For more information, please contact your SURBL reseller or see the references in Links.

Sign up for SURBL Data Feed Access.

  • Sign up for data feed access

    Direct data feed access offers better filtering performance with fresher data than is available on the public mirrors. Sign up for SURBL Data Feed Access.

  • Applications supporting SURBL

  • Learn about SURBL lists