--- a/mod_dnsbl/mod_dnsbl.lua	Wed Mar 25 10:45:20 2026 +0000
+++ b/mod_dnsbl/mod_dnsbl.lua	Wed Mar 25 18:13:00 2026 +0000
@@ -1,6 +1,7 @@
 local lfs = require "lfs";
 
 local adns = require "net.adns";
+local async = require "util.async";
 local it = require "util.iterators";
 local hex = require "util.hex";
 local parse_cidr = require "util.ip".parse_cidr;
@@ -24,6 +25,8 @@
 	return;
 end
 
+local is_host_anonymous = module:get_option_string("authentication") == "anonymous";
+
 local dnsbls = set.new();
 local dnsbls_config = {};
 
@@ -180,6 +183,46 @@
 	end
 end);
 
+if is_host_anonymous then
+	module:hook("resource-bind", function (event)
+		local session = event.session;
+		local username, ip = session.username, session.ip;
+		if not ip then return; end
+
+		local queries = {};
+		for dnsbl in dnsbls do
+			queries[dnsbl] = promise.new(function (resolve)
+				check_dnsbl(ip, dnsbl, function (_, hit)
+					resolve(hit);
+				end);
+			end);
+		end
+		local results, err = async.wait_for(promise.all_settled(queries));
+		if not results then
+			module:log("warn", "Failed to query dnsbls: %s", err);
+			return;
+		end
+		local any_match, any_error;
+		for dnsbl, result in pairs(results) do
+			if result.status == "fulfilled" and result.value == true then
+				local flag = dnsbls_config[dnsbl].flag or default_dnsbl_flag;
+				module:log("info", "Flagging %s for anonymous user %s connecting from %s matching %s", flag, username, ip, dnsbl);
+				mod_flags:add_flag(username, flag, "Matched "..dnsbl);
+				any_match = true;
+			elseif result.status == "rejected" then
+				any_error = true;
+			end
+		end
+		if not any_match then
+			if not any_error then
+				module:log("debug", "DNSBLs all clear for this IP address");
+			else
+				module:log("debug", "Errors were encountered while querying DNSBLs");
+			end
+		end
+	end);
+end
+
 module:add_item("account-trait", {
 	name = "register-dnsbl-hit";
 	prob_bad_true = 0.6;