Some ISPs including Verizon and Charter have apparently started modifying DNS NXDOMAIN responses in such a way that may cause false positives on SURBLs and other lists for systems using their nameservers. They may be doing this in order to drive search traffic for web sites that appear to not exist as indicated by an NXDOMAIN response to a DNS query. However SURBLs and other lists use a response of NXDOMAIN to indicate that a queried object is not on the list. If the last octet of the modified response happens to correspond to the bitmasked positions of blacklists (which seems likely given that 6 of 8 possible bits are currently used), then false positives may result.

Verizon and Charter have opt-out nameservers, but Charter's opt-out nameservers reportedly do not correctly return a NXDOMAIN result. One solution is to not use their nameservers. These issues won't affect systems running their own nameservers, or using other nameservers. These issues may affect other ISPs if they are also modifying NXDOMAIN responses.

The situation is somewhat like OpenDNS before they changed their behavior to not modify NXDOMAIN responses to list queries.

http://www.surbl.org/faq.html#opendns

Jeff C.