Denylist

A denylist is a list of things that are explicitly not allowed. The name comes from English and literally means a “list of denials.” If something is on this list, it gets blocked. Everything else is allowed through, without anyone having to check it individually. The principle is familiar from a bouncer who has a handful of names he won’t let in — everyone else gets in. In the past this was usually called a “blacklist,” but today “denylist” or “blocklist” is becoming more common, because the older terms are seen as unnecessarily burdened.

A convenient but leaky protective wall

Denylists are used wherever something undesirable needs to be kept out. Spam filters block known sender addresses. Browsers warn about websites that appear on a list of fraudulent sites. Chatbots refuse to answer when certain terms come up. The advantage is obvious: you only need to name what’s bad, not define what’s good.

But that is exactly where the weakness lies. A denylist only knows what someone has written down beforehand. New threats aren’t on it yet and therefore pass through unhindered. Experts call this a reactive approach: you always react only after something has already happened.

That’s why, in security-critical areas, the reverse rule is considered safer. An allowlist permits only what is explicitly allowed and blocks everything else. This is considerably stricter, but also more effort to maintain. In practice, the two are often combined: an allowlist for the core of the system, and a denylist for known problem cases around it.

From keyword to pattern matching

In the simplest case, a denylist is really just a text file with entries. A program compares every request against this list. If it finds a match, it stops the request. For a few thousand entries this is entirely sufficient — modern computers handle such comparisons in fractions of a second.

It gets more complex when exact matches alone aren’t enough. Then one works with patterns instead of fixed words. A pattern might be, for example: any address ending in a certain suffix. This way, thousands of variants can be covered with a single rule. In AI systems, a second, smaller model sometimes checks the text and decides whether it violates the rules.

A well-known problem is evasion attempts. Anyone who knows a word is blocked can simply write it slightly altered — with a digit instead of a letter, or with a space in the middle. The list then no longer catches it. A second type of error is the opposite: the rule is too broadly defined and ends up blocking harmless content as well. Experts call these false positives. Keeping both types of error to a minimum at the same time is the real art of it.

Denylists in chatbots, school networks, and sanctions lists

Most often, people encounter denylists without noticing. The spam folder in an email program is partly based on one. School networks block certain websites through such lists. Ad blockers in browsers are practically nothing more than a very long, constantly updated denylist of ad servers.

In the news, the term comes up especially in connection with AI chatbots. When a provider reports that its system refuses to give certain information, a denylist is often behind it — as one of several layers of protection alongside the actual training of the model. Critics regularly point out that such lists are opaque, since no one outside can see exactly what’s on them.

The principle also exists outside of technology. States' sanctions lists name companies and individuals with whom no business may be conducted. Banks automatically check their customers against these lists. Anyone who ends up on one by mistake has a real problem — a good example of why maintaining such lists is so delicate.