SURBL works by maintaining a database of domains that are commonly found in spam emails. When an email is received, the filter extracts all the URLs from the message and checks them against this database. If a match is found, the email is flagged as spam or potentially harmful. This method is particularly effective because many spam messages contain links to malicious websites.