Slashdot Mirror
Why Are We on E-mail Blacklists?
LogicallyRogue asks: "I run an email server for a small webhosting company. We've crawled all around the email server to make it as secure as possible: tightened Sendmail's security, POP Before SMTP, denying non-authenticated relaying, using SpamCop DNS blacklist, etc. However, with all this in place, every few months, it seems that we have been blacklisted by some ISP somewhere. This month it was AOL. We had no warning, and we don't know why we were blacklisted. All the information we have is a single URL. We visit all the DNS blacklist services we can to be sure we are not on any of them. We send emails to the postmasters inquiring for more information (like perhaps a reason or copy of the email that made the ISP blacklist us) - however, those are usually bounced back because we are blacklisted. We've tried calling the Blacklisting ISP tech support - and usually get the stunned I-have-no-clue-what-you-are-talking-about silence.
Have any other Slashdot readers experienced similar problems with blacklisting and the big ISPs?"
This isn't a customer support issue as much as it is a your-server-is-being-over-anal-and-you-probably-wa nt-to-know-about-it issue. Email postmaster@host, if that doesn't work, submit them to postmaster.rfc-ignorant.org and call their NOC.
Help us build a better map!
From the spam-l list:
Where I work, we have that problem frequently. Often, it's a result of an overzealous spam list that decides that because the spammer forged headers that make it look like mail passed through one of our machines, mail MUST HAVE come through that machine, so we should be blocked.
Call the ISP and ask which spam filtering or RBL services they use. The first-level drone won't know, but if you explain that you're being blocked and you need this information to fix the problem, you'll probably get transferred or get a call back from someone who -does- know. You'll probably discover that their filtering was overzealous.
Sometimes, you'll run into a knee-jerk admin who unconditionally believes anything the RBL tells them. It's best just to write off this ISP -- you won't convince them that you weren't sending spam. Put a custom "ISP admin is an idiot" bounce message in for that domain so that your users know why the mail didn't get through, then move on.
Of course, this assumes that you're already actively handling open relays and abuse on your end. That's part of the job, and you should check carefully to ensure that your setup is okay before contacting anyone.
Forward, retransmit, or republish anything I say here. Just don't misquote me.
..and as such, shouldn't be relied upon as a "oh this is definately for rejection". My firm uses an RBL as a plug in to SpamAssassin. Just being in the RBL by itself isn't enough to get rejected, but it bumps up the score a bit. Unfortunately, because RBL's are easy to slave and use, too many people rely on them, when the use is now limited. Limited by the fact that the 'big' spammers are incredibly clever these days. Having said all that, it wouldn't surprise me if AOL started blocking addresses with the '@' symbol... ;)
Lee
--
'I love spam. Come get me.'
Here you are complaining that you are being blacklisted, but at the same time you are blacklisting loads of other people.
Instant karma's gonna get you.
None are more hopelessly enslaved than those who falsely believe they are free. Johann Wolfgang von Goethe.
AOL also requires that your R-DNS matches what you claim your domain name to be. Do you have your PTR records in order? If you're on DSL (or dial-up) that can be difficult or impossible, depending on your provider.
I also question AOL's explanation of 'open relay.' They say that, if someone not on your network can connect to port 25 on your server, then you're an open relay. This entirely ignores POP-before-SMTP, IMAP-before-SMTP, and SMTP AUTH, which is what we use.
They may be better about it than their simple explanation; I only filled out their webform last night, so I don't have my results in yet. My solution was to hard-code the MX record for AOL.com to actually be my ISP's SMTP server, so mail to AOL gets relayed from a more legitimate-seeming source.
It sounds like you've done an admirable job securing YOUR system. What about your USERS?
There are far too many morons who run what I call "Spammer@Home" (a play upon Seti@Home) - software that downloads a list of addresses from a spammer, then uses direct-to-MX from the luser's machine to send spam. Thus spammers get around blacklists.
So the luser on your system pisses off the world, and gets your netblock blacklisted. If you catch them, you can terminate them (or at least their account) and maybe get back, but....
Now, I know this is an unpopular suggestion with many SlashTrollBots, but have you considered blocking outbound SMTP from your customers? You can always allow the customers with a real need out (they just have to let you know), but by default block SMTP to anyplace other than your server (or better still, redirect it to your server).
The average user will not notice if they cannot send directly to other servers. If you redirect to your server, programs that do direct-to-MX will still work - you will just have a chance to check the mail (or at least log it). And anybody too 31337 to use your mail server can call you and ask you to change the settings to allow them out.
(Sits back to watch the morons bitch about this...)
www.eFax.com are spammers
This is a real problem. Many blacklists are far to eager to list an IP without real evidence of spamming.
openrbl.org is useful for looking up your host and trying to figure out what blacklists you are on. But it is still fairly difficult to track down. Our server is listed on three blacklists there even though we have a static IP and have never emitted a single spam address. Sigh.
The other problem I've found is that when a bounce arrives from another server that says you are blacklisted, you can't email them to find out what list they use!
Our mail server does not use any blacklists, which is a shame because we get quite a bit of spam. But we are a business and I cannot take the risk of a client email bouncing, especially if they are innocent and the blacklist is wrong.
What I'd like is a SMTP front end that uses blacklists to determine the likelyhood of the site as a spam source, and delay spam messages for a day or so. The idea being that many mass email programs cannot keep retrying for that long.
Are you using any sort of IP address that has been flagged by a provider as a dynamic IP address? AOL refuses email from ALL dynamic IP based servers... which kind of sucks for a lot of people that run their own servers.
Let me try to understand this.
While far too many people are willing to jump into Grassy Knoll theories at the drop of a hat that are unsubstantiated, and my theory is unsubstantiated, it nevertheless remains true that foot-dragging on resolving this particular issue will serve to help the larger ISP grow larger at the expense of the smaller ISP.
"Provided by the management for your protection."
When asked why the company is implementing this policy, Bob Harvey, AOL's Minister of Information, said that they had determined that 70% of the emails coming from those IP's was Spam, and the remaining 30% didn't look very important to him anyway.
With all the renewed focus on fighting SPAM it has occurred to me that this could be a good business opportunity. It seems that small business could use someone who could not only help them to nail down mail servers but also someone who has experience with getting issues like being blacklisted resolved. A combination techie and advocate who knew who to call to get issues resolved quickly. Someone who has contacts throughout the industry. Anyone interested?
Did this remind anyone else of the onion 'statshot' feature.
Top-ten reasons: Why are we on e-mail blacklists?
1 - Poor social skills cause instant dislike in anyone we communicate with
2 - Cursed by bequest of Nigerian Uncle's Viagra stockpile
3 - Was unaware that neighbours were advertising us as "live nerd-cam!"
4 - this is slashdot?????
5 - profit!
We had a simular problem at the Web Hosting company where I work. Our clients are permitted to setup blanket email forwards to a selected address, that is all email to @ are forwarded without filtering to .. Some of them use AOL accounts, so they end up with SPAM forwarded to them (they asked to get everything so they get EVERYTHING). AOL has a "feature" that permits you to click "this is spam" when you delete it. This generates a SPAM complaint. AOL only looks at the last place that the email was delivered from for these complaints. Enough complaints and that server gets black-listed. So we have our customers getting us listed, even though our servers are NOT open relays, open proxies, require SMTP Auth and that we have a very anti-spam policy as part of our TOS. We have now instituted a policy of not permitting this kind of forwards to AOL accounts. BTW we have re-submitted our servers for testing at http://postmaster.info.aol.com and have been de-listed.
...and we ended up on it also. Had to make a call to their hostmaster in VA, and 120 seconds later it was fixed. I was repeatedly assured that the issue was in no way related to anything particular on my end... they just screwed up while implementing something yesterday morning.
- SBB
help me i've cloned myself and can't remember which one I am
So easy to use, no wonder it's #1!
sulli
RTFJ.
I've found that a lot of users will use email aliases/forwarders to forward all their email to an AOL inbox. They do this for the convience of reading all their email in a single inbox, since AOL wouldn't setup email aliases/forwards (or do they?) they have the email forwarded to AOL.
Since all of their email is forwarded, this includes the SPAM that they receive. These clients then report the spam... but since it was forwarded from your server, guess who AOL blocks?
AOL has a really bad system for spam. You can reprot spam that is of any vintage, months or years ago.. and they will count it against you; blacklists are automatically applied, there is no human intervention.
I've had clients with exploitable formmail scripts installed, upon receipt of a complaint the formmail scripts were immediately removed; however, not before thousands of emails were sent to AOL accounts. It took over a month before reports stopped getting filed and we stopped getting blacklisted; regardless of the complaints being over a month obsolete.
Recently we switched a large set of servers to another netblock (yeah, I know sucks). We discovered after that the previous netblock owner had gotten themselves on a bunch of black-lists. Maybe that has something to do with it.
There is a phone number to call... (let me grab it) 703.265.4670. If you call that number, you talk to some actually intelligent and customer service minded AOL people. They will give you a call ticket number if not solve the issue right on the phone, and will follow through (read: call you back) if they can't solve it right away. Miami University got blocked recently, we solved it in this manner. Hope this helps!
I haven't posted in so long, my sig is out of date.
Post your IP range and the sites blocking you, someone will tell you what the problem is.
Sometims they just get confused between the attacking and defending system.
I have a program which scans http connects for nimda style probes of my server (given that I don't have a 'live' website, or even a real dns address that points at my box, I know that 95%+ of connects are bogus to begin with, but I filter for obvious attacks anyways).
At the height of the NIMDA season, I was getting more than a dozen provable probes a day, and statistics would just catch up to me. Once in a while I would get letters to my roommate threatening him with cutting off his broadband connection unless he cleaned up the virus on his system..... Given the work that he's done to lock down his system and the fact that he depends on it for his business (he pays business broadband rates, even), he would freak.
He'd then pass the letter to me, I'd ask them for the log information indicating when the complaint occurred, and then look in my logs, and send them my (saved) copy of the original complaint. After the second or third complaint, I sent them a much sterner message asking that they completely clear my roommate's name and put an explicit note on his file explaining my program.
I got a call from a rather knowledgable member of their group who appologized profusely, and even took a copy of my program to play with. We agreed on some minor changes to my automatic email that made it even more obvious that my machine was the defender, and that was that ...... for a while.
A couple of months later I got another email from my roommate -- forwarding yet another threatening letter from our cable company.
In response, I sent a rather bitter email and wrote a rather sarcastic how-to on reading my logfiles. Once again, their abuse uber-geek called me up and apologized. He told me that the latest email was because they had changed their abuse reporting system and hired a fresh set of newbies. Between then and when I moved out, I didn't get another complaint from them.
Free Software: Like love, it grows best when given away.