Mailgun Now Checks Individual Email Addresses Against Spamhaus

Mailgun Optimize can now check the email addresses inside a message against the Spamhaus Hash Blocklist (HBL), the company said in its Oct. 21 release notes. Until now, Blocklist Monitoring watched only domains and IPs.

Any address in a message can be watched, up to 10 per domain

Mailgun said the check covers addresses such as the From, Reply-To and unsubscribe address. A sender adds up to 10 addresses to a domain it already monitors. The domain must be monitored first. Stopping domain monitoring removes its address monitors automatically.

The feature is live for all Optimize accounts with domain monitoring enabled, Mailgun said. It sits in a new Content tab under Blocklist Monitoring.

The HBL lists addresses, which a domain or IP check can miss

Mailgun’s help center describes the HBL as a list of cryptographic hashes of specific items, including email addresses, cryptocurrency wallet addresses, malware files and URLs. Mailgun said a listed address has usually been compromised and used to send spam, phishing or other threats.

Mailgun pitched the feature at one case. A domain can look healthy and its IPs can be clean while mail carrying one address keeps getting filtered.

Alerts, a threat count and 30 days of history

Mailgun said HBL alerts have their own setup, so a team can send them to email, a webhook or Slack. The Content tab shows how many addresses have threat detections and which are hit most. Each address has its last 30 days of monitoring history, with the threat type for each detection.

The take

We think this is a small feature that fixes a blind spot. A listing on a domain tells you where to look. A listing on one address is easy to miss. Mail can be filtered long before anyone connects it to a Reply-To or unsubscribe address.

A sender controls the domain but often not every address in the message. A reply address might belong to a vendor or a shared mailbox. Teams on Optimize should add every address in their templates, point HBL alerts at a channel someone reads, and put one step in the runbook: when mail is filtered and the domain and IPs are clean, check the addresses next.