Ask Slashdot: Is There a War Against Small Mail Servers?

softegg writes "My company hosts our own mail server. We have high-speed business connections through Verizon and Comcast. Recently, Verizon and Comcast have been blocking port 25, causing our private mail server to stop functioning. Additionally, a lot of ISPs just started blocking any mail coming from any IP in the address block of cable modems. This caused us to start laundering our mail through a third-party service called DNSExit. Now, McAfee's MAPS anti-spam system tells us they are blocking DNSExit for spam. Essentially, we are finding ourselves increasingly cut off from sending any outgoing mail. What is a small company supposed to do if you want to host your own mail?"

Comments

Not much to do

[enec]

Most ISPs block outgoing port 25 because 99.99% of that traffic is viruses or otherwise malicious computers trying to send spam. Even more mail services block all dynamic pools used by major ISPs because of the same reason.

Just invest a few bucks a month into a cheap hosted VPS behind a static IP where you can run the server.

Re:Not much to do

[Anonymous Coward]

You have several options.
1) Get a real internet Service provider.
2) Host mail on a different server such as a vps
3) host mail on a different server and use Fetchmail to pull mail and send mail out bound.
4) Configure your server to send mail through your ISPs send mail server. Receiving mail may be a problem depending on ISP.

Re:Not much to do

[Anonymous Coward]

Or stop using a dynamic IP for a business. I know static IPv4 addresses are an endangered species, but come on man.

Re:Not much to do

[guybrush3pwood]

"First, they went after port 25, but I didn't care, because I didn't host my own mail server..."

blah blah blah, you know how it goes

Re:Not much to do

[PIBM]

A lot of companies offer static ips for which you can set all the reverse dns & email information, and they are also out of their normal subscriber pool, thus allowing you to send emails from the computer behind it. The cost of that option is usually lower than 5$ per ip per month around here.

Re:Not much to do

[pipatron]

We have high-speed business connections through Verizon and Comcast

Would these be dynamic too?

Re:Not much to do

[Seng]

Wow, they do their own network reporting? Perhaps SMTP?

Re:Not much to do

[dosius]

Maybe, maybe not. I have "high speed" (4 Mbps ADSL) through Verizon and it's static IP, though I pay out the arm for it.

-uso.

Re:Not much to do

[SimonTS]

Moderator!! Above post +1 for sarcasm and +1 for being pedantic. Mustn't have had his coffee yet.

Re:Not much to do

[networkzombie]

I would really like to know various solutions for cutting-over to the backup. How do you deal with DNS for internal email and web services? Are the solutions worth the effort to avoid a two hour downtime? Do you have the next priority MX record pointing to the backup connections IP as a cold stand-by? Does IPv6 offer any solution to these DNS problems of cutting over to a backup connection?

Re:Not much to do

[icebike]

Or stop using a dynamic IP for a business. I know static IPv4 addresses are an endangered species, but come on man.

Agreed.

Our company has the business pacakge from Comcast which includes a static IP.
Its not a problem for our mail server. We don't get blocked, and our reverse is properly set up, and our IP is in a
non-dynamic pool. Yeah, we pay a tad more for this. But we can run all the services we want, and our mail
goes out.

Most of the blockage you get with dynamic SENDING IPs is on the the RECEIVING end, not always your local
ISP.

Re:Not much to do

[Cyberax]

Mail and DNS is easy, just add backup MX records with lower priority. For Web, not so much.

The real solution is getting your own AS ( http://en.wikipedia.org/wiki/Autonomous_system_(Internet) ) and PI range from your RIR. It costs about $1700 initially with $100 a year for maintenance. This will allow you to do real seamless failover.

Re:Not much to do

[moco]

Static IP is not enough. You also need your ISP to change the reverseDNS records or else you end up on many RBLs. Unfortunately, not many ISPs are willing to do that.

Anyway, you are better off sending your email "to the cloud", contracting an SMTP relaying service or renting a VPS if you can't afford a dedicated (T1/E1) connection.

Re:Not much to do

[EdIII]

It's not just the ISPs. This is a problem with SPAM in general.

If you are running a mail server on a dynamic IP address block that your ISP states cannot be running a mail server you are going to be on the Policy.Block.List.

Whether or not the ISP lets your traffic go out is irrelevant. It's whether or not my mail server will accept your connections. It won't. I do scrub incoming IP addresses with multiple RBL providers that I trust to give me fairly clean results. PBL's are included in this, so I won't be accepting your connections.

Does it suck? Yes. Yes it does. However, after applying the RBL my SPAM rate went down a LOT. I mean a LOT.

So don't blame the ISP entirely and blow it out of proportion. They are making whatever attempts they can reduce the impact on their infrastructure from SPAM and Malware infected computers in general as it affects the whole network, including you.

So unfortunately due to a bunch of dickhead marketers and organized crime in foreign countries the email system is largely broken. We are just limping along being assaulted every day by huge numbers of SPAM. This raises the barrier to entry to operate a mail server substantially, or at least one that will actually receive and send mail reliably.

My best recommendation to people out there trying to run services off their own home connection is to purchase a VPS subscription. Split with a bunch of friends and setup a whole web server, mail server, p2p social networking, voip, etc. Really make it worth it. Then you won't have the same number of problems from an IP address that is colocated and set up with proper rDNS. Not to mention far greater uptime and reliability.

I would recommend this for small business too. Even with a business account and static IP address you are not really guaranteed that you will get reliable service either.

Of course, if you get a VPS, or put yourself in the "Cloud", you need to be careful where. Amazon apparently does not give two shits about fraud and SPAM and we so more and more SPAM and VOIP hacking coming from Amazon services everyday.

Re:Not much to do

[networkzombie]

That wouldn't be so bad except the price of the backup connection leaves no extra cash for small businesses so few places can afford it. Any experience using SVR record priorities?

Re:Not much to do

[bsane]

GSLB is the way to go here- its not perfect, and it relies on the client to honor the DNS TTL. Its simple, and should be cheap (we do it all in house, but for a couple sites I'm sure you could purchase the service from someone).

Basically set your DNS TTLs low, and the DNS server returns an IP based on the health of those services.

Re:Not much to do

[lofoforabr]

So unfortunately due to a bunch of dickhead marketers and organized crime in foreign countries the email system is largely broken.

Foreign countries? Last time I checked, the USA was the clear leader in sending out spam. But indeed, this is not a problem with the servers. We are just trying to protect ourselves from spam. Blame the spammers. I report all unflagged spam to SpamCop, and by doing that I managed to make a few of them lose their accounts. It's kinda funny to see their responses, claiming they did not spam.

Re:Not much to do

[sulimma]

So unfortunately due to a bunch of dickhead marketers and organized crime in foreign countries the email system is largely broken.

Foreign countries? Last time I checked, the USA was the clear leader in sending out spam.

Indeed. But the USA are considered a foreign country where I live.

Re:Not much to do

[Quarters]

Your friend was getting AOL tech support and you told her about SMTP? You totally misunderstood your audience.

Re:Not much to do

[pipatron]

due to a bunch of dickhead marketers and organized crime in foreign countries

Foreign if you're in europe maybe. Last time I checked, most spam originated from the US. Maybe it has changed the last year or two. Or maybe the dickhead marketers in the US vastly outnumber the organized crime (what's the difference, btw).

Re:Not much to do

[mlts]

Even if the traffic is not blocked, a lot of places will not accept mail if dumped through an IP address on a known dynamic range.

So, one needs to split mail two ways:

Incoming mail, cable ISPs tend to block just because. Telcos tend to allow incoming 25. This plus dynamic DNS solves this part.

Outgoing mail can be routed through the ISP's SMTP server, or if the mail volume is too much for that, there are third party outgoing SMTP services which act as relay hosts.

Re:Not much to do

[DJRumpy]

The correct action is to call Comcast or whoever your provider is and get an exception. Comcast at the time I had them, and Time Warner now, have no issue with someone running a server on a business contract. If you are using a personal (home) account and running one however, it shouldn't surprise you if you were blocked (I know the article says a business account but it's relevant to the discussion). Both stated that was against the TOS to run servers on 'home' accounts.

Re:Not much to do

[smash]

You lot do realise that the USA probably makes up only a small percentage of the /. population?

Re:Not much to do

[machine321]

Doesn't even have to be virtual, I pay $30/month for real hardware with two IP addresses. That's cheaper than most plans with Comcast and Verizon.

Re:Not much to do

[SecurityGuy]

According to Alexa, slashdot is 40% US users. The US may be a small part of the global population, but it's well represented on the Internet, and even more so on an English language, US centric web site like Slashdot.

Re:Not much to do

[Albanach]

"First, they went after port 25, and I rejoiced for I host a real mail server..."

FTFY

Re:Not much to do

[shawb]

To make sure you don't get it wrong, use the initialism that users will remember: "Send Mail To Place."

Re:Not much to do

[nabsltd]

Give that AC some mod points.

Verizon's announcement about this stated that static IPs were specifically excluded from the blocking.

Re:Not much to do

[SaDan]

I have Comcast business, and it's static IP service. I believe you get one by default, and can request more if needed. I have no ports blocked on any of my IP addresses, and have run a small Zimbra mail server for multiple domains for years. Never had a problem with traffic or being marked as junk email.

Maybe the OP doesn't really have "business" service, and really has a high-end residential connection?

Re:Not much to do

[EdIII]

What I mean by organized crime in foreign countries are those groups that use SPAM primarily as a vector for malware infestation so they can increase the size of their lucrative botnets.

At this point I highly doubt there is that much money to be made in drug scams and the odd Nigerian scam. I suspect that the vast majority of it is to get you to visit a malware loaded URL for prompt infection as botnets are a far more lucrative use of your machine.

That is at least my impression of the current state of things.

Now you may be right about how compromised machines in the US account for a lot of SPAM, but what caused the infection is often foreign sources.

Re:Not much to do

[EdIII]

The article indicates the submitter is in the US from the ISPs that are mentioned. Therefore, in context my use of foreign indicates countries other than the US.

Most SPAM may originate from the US, but is caused by sources outside of the US since the vast majority of all SPAM comes from infected personal computers. I have heard that infected corporate computers amount for some, as well as infected servers, and Amazon is always increasing its "market share", but the overwhelming percentage is personal computers.

The difference between dickhead marketers and organized crime is that dickhead marketers are usually trying to get you to buy a product or pump up a stock. Organized crime is merely interested in infecting your computer to sell you as slave in a botnet, steal your identification, and/or use your banking credentials to drain your accounts. Organized crime also disguises itself as dickhead marketers, so it's hard to tell.

In any case, my use of foreign countries is not intended to denigrate them as a whole at all. In fact, if we want to be really specific here it is Russia and Eastern Europe. That is where most of those criminal organizations are anyways and they make up the bulk of the black market economy in botnets, malware production, virus creation, child pron sites, etc. They are just the market leaders at this point.

Re:Not much to do

[InfiniteWisdom]

Amazon apparently does not give two shits about fraud and SPAM and we so more and more SPAM and VOIP hacking coming from Amazon services everyday.

[citation needed]

Re:Not much to do

[amorsen]

Please don't do this unless you really need to. It may only cost you $100 a year, but TCAM space in most core routers is quite limited. If you announce a PI route, you take up a spot in practically EVERY core router on the entire Internet. You will likely announce an IPv6 route as well, and those take up even more resources.

Re:Not much to do

[InfiniteWisdom]

I have a better one! "Simple Mail Transfer Protocol". That mnemonic never fails to remind me what the protocol is for.

Re:Not much to do

[EdIII]

Amazon Indifference to EC2 Attacks - http://www.voipusersconference.org/2010/amazon-ec2-attacks-continue/

Slashdot story about it - http://it.slashdot.org/story/10/04/17/2059256/SIP-Attacks-From-Amazon-EC2-Going-Unaddressed?art_pos=1

Phishers using EC2 - http://broadcast.oreilly.com/2009/03/blame-the-credit-card-franchis.html

Complaint about SPAM coming from EC2 IP Address - http://www.ipillion.com/ip/174.129.162.38

EC2 used for Botnet C&C - http://securitywatch.eweek.com/botnets/amazon_ec2_used_as_botnet_command_and_control.html

Just Google for it. This stuff is all over the place. A lot of fraud websites host themselves with Amazon. Now that alone is not a reason to vilify them, but they are slow to act and seemingly ignore complaints about traffic coming from their EC2.

Personally, I bought a product from a site hosted on Amazon EC2 and had payments going through PayPal. Seemed to be above board and was the only place online selling a rather rare product at the time. Never got anything and both Amazon and PayPal were both aware of previous complaints but failed to shut the place down.

I can see how that might make me look biased, but I also have logs of brute force SIP attacks on my own servers and much of it has come from EC2. Not just Rwanda. Not just Romania. Not just China. EC2. What use is there to complain to them when everyone else gets ignored too?

How hard is it? The IP in question sends me 100,000 SIP registration requests that are clearly walking the extensions up from 1000 with dictionary attacks on the secret. Seriously? That much to investigate? Just shut the crap down and work with the account owner to clear their "infestation" up or nail them as the hackers they are.

Re:Not much to do

[sabt-pestnu]

... Giving this thread a Godwinization Score of 2?

Re:Not much to do

[yakatz]

You also need your ISP to change the reverseDNS records or else you end up on many RBLs. Unfortunately, not many ISPs are willing to do that.

Verizon is more than willing to change the DNS PTRs for anyone who calls the business support line and claims to be from the business that has the service.
When I called for the company I work for, they asked for our billing address and phone number, nothing more (and those are public information).

Re:Not much to do

[klubar]

For mail, just have multiple MX records. Web hosting, ftp, etc is harder... but for most small businesses mail is really most important. We use a cheap Linksys RV016 to handle load balancing and failover. It's not perfect... but will happily handle up to 8 redundant ISP connections and automatically disable and re-route a failed one. It also handles load balancing... There are a couple of quirks with the unit... but for $300 it's a good deal.

As for outgoing mail, we use static IP from comcast and haven't had any problems with mail be rejected or port 25 being blocked. You'll pay a couple $ more for comcast business and the static IP... but they will gladly sell you a block of 8 or 32 for a few bucks. Also make sure you get a reverse DNS pointing to your domain.

Re:Not much to do

[rocca]

5) Stop trying to run a mail server from a dynamic IP address and wondering why the rest of the world doesn't want to accept your mail.

Re:Not much to do

[micheas]

As far as can tell comcast only gives out static IP addresses. So that is not an issue.

Re:Not much to do

[Kvasio]

Like PIs are hanging on the trees in 2011. Get serious.

Re:Not much to do

[afidel]

Two hour? Last time AT&T screwed up our DS3 it took over 3 *days* for them to fix it. Luckily we had a time warner business class line that we were using to provide guest wireless and it was enough to keep everyone at HQ working and mail routed through our DR site. Unfortunately it didn't have enough upload to keep all our remote offices connected into our Citrix environment so the field basically did whatever they could do locally for that time. Since then we have brought in TW to run a fiber connection into the building and upped our connection to 10/10 and it can be turned up to 1000/1000 with 24 hour notice so if there's a next time we can provide full services with just a DNS change.

Re:Not much to do

[afidel]

And then you get the aholes live VZW who ignore TTL and cache records for upwards of 72 hours =(

Re:Not much to do

[AaronW]

Comcast will gladly do this. I have a business account and with just a single phone call they set up the reverse DNS mapping.

Re:Not much to do

[Darinbob]

But if you have your own server, it has to use port 25 for outgoing mail too. Or is there some new fangled mail port everyone uses to send mail around?

Re:Not much to do

[ntsucks]

enec is 100% right. 99.99% of all port 25 traffic from cable modems is from spambots running on compromised PCs. Comcast, AOL, et al. will never again accept email from address blocks that represents non-commercial users or cable modems, no matter what things you try, static IP, DKIM, SPF or white listing.

Re:Not much to do

[RedACE7500]

3) and 4) are not real solutions unless you're running a micky mouse operation. Even option 2) is sketchy. OP doesn't say if his connections have static or dynamic IPs. I would assume (perhaps incorrectly, but if so, change ISPs) that since they're BUSINESS lines, they'd be static IPs. If the ISP is blocking port 25 on your business line, call them up and get them to open the port. Isn't this what you're paying them for?

Re:Not much to do

[jcwayne]

I thought 4 was supposed to be Profit! Dammit!

Re:Not much to do

[sparkeyjames]

The problem with this is that no matter if you have a consumer (dynamic IP) or commercial account (static IP) with Comcast or Time Warner/Brighthouse your IP address will look like a dynamic IP because they all come from each companies address pool and reverse DNS looks like a dynamic IP in either case. A lot of other Email providers do not take this into account so basically your screwed unless you do as I did and call them all up and state your case.

I have made numerous phone calls to outside email providers techs like Yahoo, AOL and few dozen other outfits that ban dynamic IP email servers. It's a game you have to play if you want your email server to work with everyone. Just like making sure your email server does not become a spam bot so it stays off email server black lists. In this case you have to be extremely vigilant that no internal computers that may share the email servers IP address become infected spam senders. We are after all talking small business here and it is not uncommon to have the web server, email server and firewall on the same box.

Re:Not much to do

[acoustix]

The correct action is to call Comcast or whoever your provider is and get an exception.

That won't help. The article says "Additionally, a lot of ISPs just started blocking any mail coming from any IP in the address block of cable modems." Even if they could send out from Comcast (or whoever they use) they will most likely be blocked by the receiving server.

Re:Not much to do

[rocca]

If you aren't able to get a proper reverse DNS entry for your public outbound mail server then you probably shouldn't be running one. If you have a real static IP (as opposed to "my IP doesn't seem to change") - then it shouldn't be a problem getting the DNS setup correctly.

To answer the original question about "what should you do", the answer is simple - if the ISP won't issue a PTR record because of the type of connection being used then the customer should smart-host their mail through the ISP mail servers to ensure global reachability. As you say, often the edge device is a swiss-army knife and in many cases the admin isn't competent enough to properly secure/maintain it. This is exactly what blocking outbound SMTP from dynamic space is meant to accomplish and I'm pleasantly surprised to hear that Comcast/Verizon have finally started to implement what every other responsible ISP has been doing for a decade.

Re:Not much to do

[aduxorth]

Mail and DNS is easy, just add backup MX records with lower priority. For Web, not so much.

The real solution is getting your own AS ( http://en.wikipedia.org/wiki/Autonomous_system_(Internet) ) and PI range from your RIR. It costs about $1700 initially with $100 a year for maintenance. This will allow you to do real seamless failover.

Did you even Read the Summary????

He is trying to SEND email, he doesn't mention any difficulties in receiving it.
Having their own AS won't solve things regardless of whether it is coming or going, unless they have their own (at least) /24 and they are multihomed.

The only real options here are the following.
a. Use the ISP's mail server as a smart host and send all email through their server.
b. Get the ISP to issue you with a real PTR record that isn't just some default record from the ISP.
c. Go to another ISP.
d. Get a VPS and send all your email through it.

Re:Not much to do

[hardwarefreak]

A lot of companies offer static ips for which you can set all the reverse dns & email information, and they are also out of their normal subscriber pool, thus allowing you to send emails from the computer behind it. The cost of that option is usually lower than 5$ per ip per month around here.

It's $10/month extra for a single static IP atop aDSL from CenturyTel here in rural Northwest Missouri. They have a local monopoly but so far their pricing is reasonable and the service is top notch--not a single outage in the past year. CenturyTel doesn't offer custom rDNS, period, neither for small business nor residential accounts. So far this hasn't been a problem. No reputable DNSBL will list an IP strictly due to generic rDNS. And CenturyTel doesn't register the parent block with the Spamhaus PBL nor any other "DUL" type DNSBLS. Neither my IP nor parent net have been listed by any reputable DNSBL. I noticed the parent net was listed on, IIRC, one of the super aggressive fiveten lists some time ago, but that didn't obviously affect delivery as nobody in their right mind outright blocks using these fiveten lists. I registered my IP with dnswl.org quite some time ago and have a 'medium' rating, which helps with delivery in cases where receivers do block based on things like generic rDNS.

221.216.41.65.list.dnswl.org. 43200 IN A 127.0.6.2

So far I've had zero problems with outbound delivery over this CenturyTel aDSL. Having a static IP is more important for deliverability than custom rDNS, but it's good to have both if you can get them. If you have static IPs and are being listed in "policy" DNSBLs, you need to talk to your ISPs and get that straightened out. If you have static IPs and you're being listed by trap driven DNSBLs, then the problem isn't with "what type of service you have" but with spam emission from zombie infected PCs behind your NAT. In this case YOU need to egress filter TCP 25 so nothing can send outbound SMTP but your mail server.

Re:Not much to do

[TechyImmigrant]

>Verizon is more than willing to change the DNS PTRs for anyone who calls the business support line

It took me a whole week in phone tree hell to get Verizon to set up my reverse DNS.

The final act took under a minute, talking to a guy who appeared to know what he was doing, But getting anyone to even understand the question enough to know what department to pass me to took a week.

Yes, I was calling the business support line.

Re:Not much to do

[hxnwix]

Aren't we allocating about 2500/yr?

Re:Not much to do

[rvw]

Most ISPs block outgoing port 25 because 99.99% of that traffic is viruses or otherwise malicious computers trying to send spam. Even more mail services block all dynamic pools used by major ISPs because of the same reason.

Just invest a few bucks a month into a cheap hosted VPS behind a static IP where you can run the server.

My provider blocks port 25. You can use port 2525 instead.

Re:Not much to do

[JWSmythe]

that since they're BUSINESS lines, they'd be static IPs.

    Actually, that's an incorrect assumption. What I've seen in a variety of markets, with a variety of providers, if you're using a service that's usually residential, but sometimes sold as commercial (cable modem, *DSL, FiOS), the person purchasing has the option of getting static IP's at an increased cost. If it's someone less technical making the purchase, they'll frequently see it as an unnecessary expense.

    What the original poster is describing is a commercial/business account, which only means you get priority service (customer support, not QoS). Frequently, you have to check and double check that you have purchased static IP's, and then you have to go through the hoops of trying to get your PTR records delegated or set correctly.

    If you chose to use a T1, T3 or higher circuit, those little things are assumed to be true.

    What we're seeing now is that anyone can buy these residential lines sold as "business" services, for a seriously reduced cost. At my office, I can get a 50Mb/s (up and down) FiOS line for $250/mo, with no time locked contract (month-to-month billing). I don't know what the current costs are on T3's, but if they are similar to what they were in the past, you'd add at least a couple zeroes to the price, and more expensive equipment.

    I have found that FiOS uptime and service is great. Getting PTR records set is another headache. Even though we call to their "business" support, it's only about 1 in 4 CSR's have any clue what a PTR is, or even what DNS is. Sometimes I wonder how they get these jobs, when they don't

    The one thing that has been consistent though is that if you do get a commercial/business line with static IP's, and things work, they won't have ports blocked. Well, that is if they properly configure their modem. A lot of times, they get the same modem as residential customers get, which blocks quite a few ports, including 25 and 80.

Re:Not much to do

[Erik Hensema]

Yes, port 587. This is the port authenticated clients can connect to (eg not spammers). So, run your mailserver externally with port 25 incoming and outgoing unblocked. From behind a line with port 25 outgoing blocked, you connect to this server using port 587 and smtp auth. Problem solved.

The OP can also solve his problem easily and cheaply by using comcast's outgoing smtp servers as smarthost.

Re:Not much to do

[Phopojijo]

What's step 3???

Re:Not much to do

[gd2shoe]

... If you are using a personal (home) account and running one however, it shouldn't surprise you if you were blocked (I know the article says a business account but it's relevant to the discussion). Both stated that was against the TOS to run servers on 'home' accounts.

It shouldn't surprise anyone, but I still take exception to it. They are selling Internet access. Why should businesses have a fundamentally different Internet than hobbyists?

They're just being bullies and extortionists.

(Yes, you can sometimes convince them to give you an exception on port 25. It still does not excuse their institutional prejudice against home servers.)

Re:Not much to do

[Rakarra]

If you aren't able to get a proper reverse DNS entry for your public outbound mail server then you probably shouldn't be running one. If you have a real static IP (as opposed to "my IP doesn't seem to change") - then it shouldn't be a problem getting the DNS setup correctly.

But whether the DNS is set up correctly or not isn't going to make a lot of difference if the entire IP range that your connection falls into is banned.

Re:Not much to do

[pehrs]

I am not sure if you are aware of it, but the USA is a foreign country...

Re:Not much to do

[AVee]

Indeed, I've been running a mail server from my home (consumer) DSL line for ages. But I've got a proper ISP which provides a static ip, configurable reverse DNS and which actually has a functioning abuse desk which will actually quarantine lines which send spam. I haven't had any issues getting mail delivered anywhere.

However, what stops you from using your ISP's smtp server as smarthost for outgoing mail? You really shouldn't need external services to get your mail out. A block on port 25 (incoming) is a showstopper, unless your ISP provides a facility to remove the block or to route around it.

I know of a dutch ISP which has a setup where you point your MX to their mailserver which will relay all incoming mail to your server. That setup makes sure an open relay in their network is harmless while still allowing their users to run their own mailservers.

Re:Not much to do

[mwvdlee]

AFAIK, Most ISP's open up port 2525 (or some other number) to replace the closed port 25.
Simply reconfigure your mail tools to use the new port and everything will work again.

Re:Not much to do

[Antique Geekmeister]

I'm afraid you've been misled. Check out the Wikipedia article at http://en.wikipedia.org/wiki/E-mail_spam and check out the "Origiin of Spam".The US sends out less than 20% of all spam.

The US is a leader in being the _target_ of spam, because we have more money than most potential victims. And unless you actually trace it back, it's hard to tell from the contents of the spam where the author actually is.

Re:Not much to do

[geohump]

Both comcast and verizon's business services provide static IP addresses, and those addresses are not supposed to be in the dynamic IP blocks which each ISP provides to the various block list services.

If the ISP itself is blocking the outbound port 25 port, and/or reporting the IP they gave you as dynamic, complain bitterly, and sue. Begin the law suit immediately after they don't fix the problem within a few days after a written complaint. Solict other businesses who have been adversely affected and mount a class action.

Enec: - the static IP's given by Comcrap and Verizoned are not in the dynamic IP pools unless those respective companies specifically listed them in the dynamic pools, which they should NEVER do with their business class IP's. The blame here clearly lays at the feet of the respective ISP's eg: Comcrap and Veryzoned.

Re:Not much to do

[geohump]

You have several options.
1) Get a real internet Service provider.

Like who? GoDaddy? Ha ha ha ha ha ! Comcrap and verizoned are two of the largest ISP's in the world, and not just for consumers, for businesses as well.

2) Host mail on a different server such as a vps
3) host mail on a different server and use Fetchmail to pull mail and send mail out bound.
4) Configure your server to send mail through your ISPs send mail server. Receiving mail may be a problem depending on ISP.

There is no sane reason why any typical business should have to route their email through the ISP's mail server, or use some remote server no on their own IP address if they have a business class service. The entire point of business class service is to have a static IP and have "real" internet access, as opposed to what the consumers get. (However, No one can claim that C+V treat their customers in anything resembling a sane fashion. It come closer to rape. )

That means the ISP shouldn't be doing ANYTHING to the businesses traffic and the ISP should be guaranteeing that the IP they have given the business is not in the DUL or any other RBLS of Dynamic IP's

Re:Not much to do

[geohump]

That won't help. The article says "Additionally, a lot of ISPs just started blocking any mail coming from any IP in the address block of cable modems." Even if they could send out from Comcast (or whoever they use) they will most likely be blocked by the receiving server.

Again, this is the ISP's fault for either giving them an IP thats not in their block of static IP, but was instead listed BY the ISP as a dynamic IP and therefore putting that IP on the blocklist, or for giving them an IP that was static but somehow the ISP added it to the Dynamic IP lists.

Re:Not much to do

[geohump]

Again, Business class services from comcrap and verizoned are STATIC IP's, not dynamic. Its the ISP's fault for not keeping up with managing their static vs dynamic IP addresses lists properly and keeping them updated with the various block list services, or for giving the business customer a consumer class IP.

Re:Not much to do

[geohump]

and I'm pleasantly surprised to hear that Comcast/Verizon have finally started to implement what every other responsible ISP has been doing for a decade.

Uhm, hey Rip Van Winkle, don't nap so long next time. They've been doing it for at least 7 years.
http://www.zdnet.com/news/comcast-takes-hard-line-against-spam/136518

Re:Not much to do

[bsane]

Yes- but 90% of your traffic is better than 0%

Re:Not much to do

[geohump]

Using comcrap's smtp relay via smarthost config limits you to some number of "less than 200" emails per day, after which they silently drop your email to /dev/null. Please note this number is derived from actual experiences.

Not exactly a business class service.

Re:Not much to do

[Original Replica]

You have several options. 1) Get a real internet Service provider. .

If only that were an option for most of America. Even in NYC we have only two choices and this is the most densely populated place in the country. Choice and ISP are mutually exclusive concepts.

Re:Not much to do

[rocca]

Really? From TFA: "We are singling out spammers on our network and blocking port 25," said Mitch Bowling, Comcast's vice president of operations. "We don't think it's the right approach to blanket port 25. The right approach is to seek out people who are spamming our network and others." ...so, any spammers they find, instead of terminating the account they block port 25. Of course everyone else they don't 'find' can still spam away...

Re:Not much to do

[rocca]

Very rarely are static and dynamic IP's issued from the same subnet. If you can't get out of a blocked range and won't switch ISP's, then smart-host.

Re:Not much to do

[geohump]

that since they're BUSINESS lines, they'd be static IPs.

    Actually, that's an incorrect assumption.

Actually its not an incorrect assumption, its a reasonable normal assumption:
from a comcast web page, note the last item in the feature list:
Comcast Business Class Internet \n Blaze new trails with big business features.

Whatever the size of your company, it needs to respond quickly to the needs of customers, communicate reliably with suppliers, and find smarter ways to increase employee productivity. That's why Comcast Business Class Internet offers:

Downloads up to 50Mbps, uploads up to 10Mbps
Internet speeds up to 64x faster than T1
Flexible Web hosting options
Norton Business Suite security and virus protection
Free Microsoft Communication tools
** Static IP addresses **

http://business.comcast.com/internet/index.aspx

but then, of course, they are engaging in a not so subtle misrepresentation. following the link to the next page you find out you have to pay extra for a static IP.

As for verizoned - well they're still selling like they are the phone company: "Hot Dead Chickens! gett your Hot Dead Chickens! "
http://smallbusiness.verizon.com/products/internet/hsi/plans.aspx?tfn=s2&CMP=KNC-SMB_D_P1_CS_Z_Z_U_Z165
note the AD is targeting small businesses like a hair dresser, and then uses terminology like 3/7 mbps/kbps to describe what they are selling.
Here the static line is an extra fee option.

Frankly, calling any service "business class internet service" that doesn't include a static IP as the standard base is false advertising as its useless for a business identity, a web server, and email on the internet without a static IP. But hey: "We don't care. We don't have to. We're the Phone Company."

comcrap and verizoned - both fraudulent by nature. In a truly free market neither would exist, but wired/fibered telecomm will never be a free market and neither of those companies is at all interested in competing in a free market. See "regulatory capture".

Re:Not much to do

[PsyciatricHelp]

Generally no. I can't speak for all ISPs but from everything I have looked into the only advantage to Business accounts is a block of Static IPs and open ports. However, you pay the price in higher premiums and lower bandwidth.

Re:Not much to do

[yakatz]

What I put in the email:
Name on account
Service Address
Account Number

Sent it to:
Verizon Business Technical Support
Support Email Address : help4u@verizonbusiness.com
Toll Free Support Number: 800-900-0241 options: 2-1-2
Hours of Operation: Monday - Friday 8am-8pm ET

Re:Not much to do

[Lennie]

The people who control the botnets of computers in the US are foreign.

Re:Not much to do

[omnichad]

Which probably just means you need to have correct reverse DNS set for the static IP address. The ISP should help with that too. Yes, there are large databases of IP addresses that are part of modem pools. But if the reverse DNS for your IP isn't mail.mydomain.com and is instead something like adsl-99-67-123-53.dsl.covlil.sbcglobal.net, you're going to have delivery problems.

Re:Not much to do

[Rysc]

At least for Comcast business service actually is better QOS. Maybe not officially, but there's a measurable drop in random downtime incidents.

Otherwise you are correct. You must request a static IP, you must go through additional configuration hoops and even then your reverse DNS will look funky unless and until you request that it be fixed.

Re:Not much to do

[operagost]

I second this. Fix the RR and you'll fix most of the blacklisting right there.

Re:Not much to do

[Dr.Dubious DDQ]

I read that as "dickhead marketers" = "USA".

Re:Not much to do

[NecroBones]

Even static-IP VPS solutions are under fire for this. I host my own mail, and had been using my VPS for out-bound mail for quite a while, but I was increasingly having mail delayed for hours or blocked completely by some of the larger ISPs. My only solution was to add a static route to use comcasts outbound mail servers instead of my VPS, since I'm behind a comcast business line.

For a small business mail server, apparently your best bet is to use your ISP's mail server with a static mail route, unfortunately. And don't forget to set up SPF records with a proper include.

Re:Not much to do

[jcwayne]

No, no... What's step 2, I don't know is step 3.

Re:Not much to do

[Amouth]

ok wait a sec.. you have a DS3.. and you tried to "back" it up with a TW cable modem?

you have a DS3 and had a TW fiber line installed - and your going to do DNS change for fail-over?

if have a DS3 you can afford to do things right.. get an AS record and your own block - don't mess with changing DNS for fail-over..

and whom ever thought it was a good idea to use a cable modem as a backup for a DS3 needs a talking to about how to do redundancy correctly.

Re:Not much to do

[afidel]

Dude, we weren't budgeted for ANY redundancy, we just happened to have the other line that we had been using for separation of guest traffic. Now for about the same amount of money we're getting a line that can probably provide full services during a failure. The expense of trying to get global failover working between two ISP's and the risk of having AT&T change something (service has been rock stable except when they try to do any kind of change ticket) is just unwarranted. That's the only downtime we've had on that line in over 5 years so it's been good enough. /shrug

Re:Not much to do

[Amouth]

ok then i missed the first bit..

but still for the amount of money you are pouring out for a DS3 it's 100$ a year maintenance cost for an AS record.. and and once you have BGP setup on your router and the routes with your providers it is very very seamless and nice.. i bet if you did a time cost look at your last outage - just the money spent on the phone with your outside workers tell them what is going on and to wait for a DNS change and all that jazz you will see that going with an AS record and doing it right isn't every expensive if you ever use it.

and i understand that you didn't have an outage for 5 years.. so do the math for having one outage every 5 years with a span of 3 days (as in your last one) and then do it again with 5 years over 1 day (more normal) and both will show that it is cheaper to do it right.

Re:Not much to do

[sabt-pestnu]

Schizophrenics?

Re:Not much to do

[Cramer]

the address block of cable modems

And what block would that be? IANA, ARIN, et. al. have never assigned a block "for cable modems". Netblocks are assigned to organizations and they use them as they need. One cannot assume and thing that start "24." is a cable modem and should therefore be ignored. (while there are CMs in 24/8, every address is not a CM nor are all CMs in 24/8)

Re:Not much to do

[Cramer]

It's not about *who* you are, but what class of service you're paying for. Business class services cost more, and thus have less restrictions.

Re:Not much to do

[Cramer]

your IP address will look like a dynamic IP

It looks like a dynamic address because of it's DNS PTR. Or because the netblock is listed as "residential" in (r)WHOIS. Or, if some RBLs are to be believed, because the ISP told them to list it. (I put zero stock in such claims.)

That said, my 24.xxx biz.rr.com addresses are not on anyone's blocklist that I've ever been able to find. And none of the addresses map to "mail.domain.com". On the other hand, my VZB DS3 doesn't have any DNS PTR's so many (most?) mail servers refuse to deal with those addresses. [I don't send mail from them, so I don't care.]

Re:Not much to do

[X0563511]

Perhaps not, but they are likely a segment of the "pool" that is assigned to Verizon and Comcast.

Re:Not much to do

[PlusFiveTroll]

The OP can also solve his problem easily and cheaply by using comcast's outgoing smtp servers as smarthost.

Unless his ISP outgoing SMTP sucks. Our local cable company has all kinds of issues... attachments timing out, long queuing delays, getting blocked for spam on occasion themselves. Running your own SMTP server can have great benefits for a business if their admin is knowledgeable. At a title closing company I'll set the queue time much lower, it doesn't make much sense to queue mail up to seven days when you need the docs delivered that day. Much better to get a bounce in an hour so someone can make a phone call. Also you can set the attachment limits much higher with your own private server and don't have to worry about it chocking.

Re:Not much to do

[Profane MuthaFucka]

Exactly. Call your ISP up and tell them to set the PTR record for your IP address. That's exactly what I did for my private mail server.

Re:Not much to do

[Profane MuthaFucka]

ATT did it for me. I have a static DSL line. When I called them they acted like it was the most perfectly natural request in the world. They took care of it immediately, with one phone call.

Re:Not much to do

[gd2shoe]

Most of those "restrictions" are artificial, hence "bullies and extortionists". Some of them can be quite punitive. Not paying our business rate? We're going to go out of our way to make it hurt.

And if who you are defines how much you're willing to cough up every month, yeah it really is about who you are.

Re:Not much to do

[Peil]

Because they can charge a differential to cover the SLA.
If you run a business on the internet and your ISP has a problem with the line, you are going to want to invoke an SLA and associated penalties for loss of business.

Re:Not much to do

[gd2shoe]

Interesting... Have you ever heard of a small business invoking such penalties? Can they be extracted from the megacorp without a great deal of effort? Are those penalties greater than a few months difference in business/home rates?

I could be wrong, but I think you've bought the bridge they're been selling. Maybe you know details that I don't?

Re:Not much to do

[Paracelcus]

If you have "business" class service you can ALWAYS have your provider unblock all ports to your static IP address (they should be unblocked by default) and when you are registered in DNS running your own BIND server or even caching name server, your emails will not be rejected when the recipient does a reverse DNS lookup.

Re:Not much to do

[steppin_razor_LA]

I have a static IP and I've ran into variants of this problem before. My ISP started implementing port 25 filtering (which is a good thing IMHO) but they set up a process by which you could exclude yourself. I think their process included some automated checks to make sure you were well behaved (i.e. not an open relay).

I've had my emails rejected before because I my static IPs were being classified as dynamic IPs by a RBL. It was a while ago so I forgot what hoops I had to jump through, but I eventually got it straightened out.

Re:Not much to do

[Kvasio]

I don't know about your RIR, but in practice getting PI from RIPE in mid-2010 (last time a friend from my local IX tried) was very difficult and there was not silver bullet solution that granted obtaining it. Also decisive process takes a random amount of time (ie. you may get reply in few days or few months, if any). There are more and more companies claiming that they do "consulting services' in obtaining PI or ASN, with the scope of advertised actions / influences somehow beyond what one would expect that "sponsor LIR" should be responsible for.

As a side note, there is problem with obtaining ASN, these are also in short supply.

Re:Not much to do

[LVSlushdat]

I use DNSExit for mail also, and they allow use of tcp/2525 as an alternate to tcp/25.

Sounds like an ISP problem.

[raitchison]

If your ISP (Verizon and Comcast) are blocking port 25 outbound it doesn't sound like they think you have a "Business" connection. Check your contract/TOS for any provisions that would prevent you from running a server (common for residential cable connections but not for business) and if there isn't one call and complain. If they won't unblock port 25 for your mail server (assuming it's properly configured) you need to find a new ISP.

Re:Sounds like an ISP problem.

[yoghurt]

How is "telnet smtp.example.com 25" a server? As per the RFC, outbound is NOT a server; it's a client. The SMTP server listens and receives mail on port 25. So I don't understand why a no server TOS clause should prevent sending mail. Another TOS clause is probably more relevant.

Re:Sounds like an ISP problem.

[commodore6502]

>>>you need to find a new ISP.

That would be great, if the government had not given Comcast/Verizon an exclusive monopoly (or duopoly). And then decided not to regulate them.
Choice - we don't haze it.

Re:Sounds like an ISP problem.

[Anonymous Coward]

>>>you need to find a new ISP.

That would be great, if the government had not given Comcast/Verizon an exclusive monopoly (or duopoly). And then decided not to regulate them.
Choice - we don't haze it.

If you're buying a serious business connection, you have a choice. We're not talking about grandma's cable/dsl connection here. If you're trying to run a business mailserver over a consumer broadband connection, you've got far bigger problems than blocked ports.

Re:Sounds like an ISP problem.

[jimicus]

If your ISP is preventing 25 outbound, you don't have an ISP.

TBH, I'm not quite sure what you do have. I've met that sort of thing once before, I would describe them as a Web access provider.

Re:Sounds like an ISP problem.

[raitchison]

There are no DSL providers available in this area?

Even if there are not Cable or DSL providers there are always more traditional connectivity options, of course those might be cost prohibitive for a small company.

Re:Sounds like an ISP problem.

[metalmonkey]

Because as soon as you telnet smtp.example.com 25 they will do the same to the source address and if they don't get a HELO with the matching hostname in it they will not accept your mail.

I know not part of the standard, but I ran into this issue when running own mail server for small business. One upgrade and somehow the fully qualified host name in the HELO response changed to the internal hostname. We didn't find out until outgoing 'client' mail stopped.

Re:Sounds like an ISP problem.

[Linux_ho]

They behave differently. A client normally connects to it's local mail server or its ISP's mail server on port 25. Clients normally don't generally connect to port 25 on mail servers outside the ISP's network unless they're spamming, which is why ISPs have been limiting that kind of connection from home networks.

Re:Sounds like an ISP problem.

[ScentCone]

the government had not given Comcast/Verizon an exclusive monopoly

Which government ... your local city government?

Re:Sounds like an ISP problem.

[houstonbofh]

It could be the block lists as well. Make sure you have a business class service with a static IP as those are least likely to be in the block lists. Also add "@ IN TXT v=spf1 mx ?all" and "domain.name IN TXT v=spf1 mx ?all" to your DNS zone record.

Re:Sounds like an ISP problem.

[dougmc]

Because as soon as you telnet smtp.example.com 25 they will do the same to the source address and if they don't get a HELO with the matching hostname in it they will not accept your mail.

Please, give me some examples of mail servers that do this.

I've never seen this happen, and I would expect this sort of filtering to be full of problems -- not everybody does outbound and inbound SMTP from the same IP addresses.

Re:Sounds like an ISP problem.

[dougmc]

If your ISP is preventing 25 outbound, you don't have an ISP.

You are picking nits, but that setup for end users is quite common.

In most cases, 25/tcp isn't totally blocked outbound -- you can usually connect to the ISP's mail server and use it to relay your mail. That way, they get to make sure you're not spamming (and can monitor and control your mail if they want, though they could just do that by sniffing the network if they wanted too.)

Re:Sounds like an ISP problem.

[v1]

It's been my experience that they block outgoing connections on port 25 to any ip except their mailserver. This prevents spamzombies from using external open relays or directly relaying to destination mailservers.

Sometimes the ISP's dns server requires authentication, which is ideal, but sometimes not. Even with their internal relay open though, it's very easy for them to monitor for abuse if the zombie figures out the IP address of the mailserver, and just cut it off. They usually then just cut off your service completely and wait for you to call them to complain and then have a discussion about your cleaning your PC up before you get your service restored.

That's how two of the big providers in this area work.

But I have a mailserver at home, it's on the 3rd option ISP here that does not block outgoing port 25 thankfully. Even though it's on a static /29 it's still considered by some RBL lists to be in a dhcp pool, and I've had my server land on a blocklist 3-4 times. But they've always been punctual about removal when requested. I count myself lucky, I realize I could have had a much harder time if I somehow got on a heavily used blocklist that didn't want to listen to me.

OTOH, my server also subscribes to blocklists, and I've had to deal with a variety of upset people because they were not getting important emails from business associates. In ALL cases however, their associates were using their company's email, and it was a small outfit they were trusting a somewhat incompetent IT freelancer to manage and setup. And then I get to spend many email exchanges educating their IT guy about how to clean up the machines on the little network and/or get their client's mailserver off the blocklist.

Re:Sounds like an ISP problem.

[marshle]

raitchison is 100 per cent correct. This happened to me too. Give up early trying to get your solution working... assuming you have small home office based internet connection. Most ISP's publish their DHCP client ranges to MAPS and real time black hole lists in effort to keep their users from being mail relay zombies. You are falling victim to this and there really isn't any way to get your mail servers (or your edge router/firewall) fully routable IP removed from the MAPS of black hole list. Better get happy with your DNS exit solution, rehost elsewhere or buy an appropriate "business" internet service where your IP will be cleared to connect and receive connections on all ports and protocols....

Re:Sounds like an ISP problem.

[KingMotley]

EXIM can be configured as such.

Re:Sounds like an ISP problem.

[multipartmixed]

> Even if there are not Cable or DSL providers there are always more traditional connectivity options, of
> course those might be cost prohibitive for a small company.

Only if said company is already on the verge of collapse.

I live in a small city (105,000?) in Canada and pay less than $400/month for T1 service with a /28.

This gives me a *real*, business-class connection, with IP addresses in a suitable range, with no restrictions other than the size of the pipe.

We run small-small "production" infrastructure off the T1 (mail, mild web, primary DNS) and use it for the office internet connection as well.

Even in the case where the OP can't be served by T1, he can probably pick up ISDN service for a couple of hundred bucks a month. Two B channels is plenty for outbound SMTP.

Incidentally, you'd be surprised at how much better the casual surfing experience is on an unladen T1 compared to even a 5meg ADSL connection. I'm not sure if it's traffic shaping, the faster upload, or the lower latency that's in play, but it's definitely a good experience.

We were running a 3meg wireless connection for surfing for awhile, and frankly, don't miss it in the least.

Re:Sounds like an ISP problem.

[nabsltd]

Because as soon as you telnet smtp.example.com 25 they will do the same to the source address and if they don't get a HELO with the matching hostname in it they will not accept your mail.

First, the client sends the HELO, not the server. Second, in both the server banner (which is sent on initial connection) and the response to the HELO, there is no requirement that the hostname be included in the text (although it is commonly done). What you have done is confuse two different anti-spam technologies, which have in common only the fact that both are of dubious quality.

The first is reverse DNS, which is done by the server on the client IP address, and matched to the HELO argument. This is bad because the RFC does not require the HELO argument be anything but a FQDN. It often will not match exactly, even though a human would look at it and realize that it's probably "close enough".

The second is SMTP callback, which happens after the "MAIL FROM:" command, and the sender e-mail address is checked to see if it exists and is deliverable. This is bad for so many reasons, including the fact that an infinite loop can be created if servers with this system try to send e-mail to each other. But, it also gives you almost no real information about whether the sender is legitimate.

Re:Sounds like an ISP problem.

[j h woodyatt]

At times like this, I often turn to the RFC series, which is a trove of useless answers to questions like this. From "Terminology for Describing Internet Connectivity" (RFC 4084):

* Client connectivity only, without a public address.

            This service provides access to the Internet without support for
            servers or most peer-to-peer functions. The IP address assigned
            to the customer is dynamic and is characteristically assigned from
            non-public address space. Servers and peer-to-peer functions are
            generally not supported by the network address translation (NAT)
            systems that are required by the use of private addresses. (The
            more precise categorization of types of NATs given in [2] are
            somewhat orthogonal to this document, but they may be provided as
            additional terms, as described in Section 4.)

            Filtering Web proxies are common with this type of service, and
            the provider SHOULD indicate whether or not one is present.

Re:Sounds like an ISP problem.

[Phroggy]

If your ISP is preventing 25 outbound, you don't have an ISP.

TBH, I'm not quite sure what you do have. I've met that sort of thing once before, I would describe them as a Web access provider.

Sorry, but I disagree. I strongly support residential ISPs that block outbound port 25. My preference would be, if you have a static IP address (which may cost a little extra, which I'm also fine with) they should unblock port 25 upon request (for no additional fee, but only upon request, not by default).

Yeah, it's an extra hoop to jump through if you want to run your own mail server. I run my own mail server, and that's precisely why I want outbound port 25 to be blocked by default: I have to deal with spam coming from all the ISPs that don't do this.

And no, this shouldn't affect end users, because end users should be using 587 or 465, not 25. It's not 1998 anymore.

Re:Sounds like an ISP problem.

[amirulbahr]

I know iiNet in Australia do this by default even on "business" connections with static IP addresses. You can log on to their administration console and remove these blocks or even add your own on a per-port basis. This is in-bound port blocking BTW.

I think this is a very sound practice given the massive number of spam-bots. If you are trying to run a mail-server and you are competent, then you quickly figure out where the problem lies. Even a phone call to iiNet quickly reveals the problem if you don't figure it out for yourself.

Re:Sounds like an ISP problem.

[bored_engineer]

You're a hardier soul than am I. I just gave up. My ISP also doesn't block port 25, but I ended up using the ISP's mail server anyway. Once I ended up on a blacklist, and even with a static ISP I found that UCLA wouldn't accept mail from me, no matter what. I don't remember with any certainty, but I may have had trouble with Hotmail once, too.

Re:Sounds like an ISP problem.

[metalmonkey]

Sorry, this was ages ago, in a previous life. It was not many mail servers, but one of our customers did it, so it was a problem. I don't know if it was instant, could have even been one of the black lists scanning us - but once the HELO response was updated mail started working without delay. I didn't have to wait for it to get removed from black list.
Doesn't make much difference to the person trying to send mail which it is as the client won't work correctly without having a server.

Re:Sounds like an ISP problem.

[realityimpaired]

Incidentally, you'd be surprised at how much better the casual surfing experience is on an unladen T1 compared to even a 5meg ADSL connection. I'm not sure if it's traffic shaping, the faster upload, or the lower latency that's in play, but it's definitely a good experience.

Latency most likely. The first 70KB or so of any download is sent during the slow ramp up period of a TCP connection, and barring a few large sites like slashdot and streaming media, most websites don't actually have any files larger than 70KB. The page itself may be a 1MB+ download, but it consists of a dozen 40-50kb files. Because of that, there isn't really a big difference in surfing speed between a 1mbit connection and a 100mbit connection, given identical latencies. Because of this, latency is the big determining factor in how fast browsing appears subjectively, once you get past a 1-2mbit connection speed. Similarly, traffic shaping isn't a likely culprit, because Bell doesn't traffic shape 24/7: only during peak hours, and only on peer-to-peer ports.

Where the T1 most likely wins out is probably a combined effect from not running an ATM link, meaning less packet overhead (packets are 53 bytes, 5 of which are header and 48 are payload in ATM, versus Ethernet which is usually 1500-byte payload with 38-byte header), along with having a better router at your end. You probably also drop some latency because of not having to translate between ATM and Ethernet (DSL is ATM from modem to DSLAM, but Ethernet on either side of that connection, so translates twice), and probably still more because of not being on an interleaved DSL mode. Your ping on the T1 is probably about 10-15ms lower than it was on the ADSL, and that makes a big difference for subjective experience.

Re:Sounds like an ISP problem.

[socsoc]

Or you could actually set up your domain's SPF correctly on your IP addresses.

Re:Sounds like an ISP problem.

[fenix849]

Awesome yet another meaning for the letters WAP.
(Wireless Access Point, Wireless Application Protocol)

Re:Sounds like an ISP problem.

[afidel]

The most likely cause of the confusion is that you don't have proper rDNS setup for your domain. Get your ISP to point the rDNS for your IP to your domain and you likely won't end up on an RBL again (no promises obviously).

Re:Sounds like an ISP problem.

[l0ungeb0y]

Exactly, I use Comcast Business at home as I am self-employed, port 25 is definitely not blocked by comcast business internet services and I've been running SMTP + POP & IMAP services just fine.

Re:Sounds like an ISP problem.

[TechyImmigrant]

>Which government ... your local city government?

Yes.

Re:Sounds like an ISP problem.

[ModMeFlamebait]

What's incorrect about referring to mx records instead of specifying ip addresses by hand?

Re:Sounds like an ISP problem.

[Kosi]

>>you need to find a new ISP.

>That would be great, if the government had not given Comcast/Verizon an exclusive monopoly (or duopoly).
Seems you'd better get started with finding a new government. In which country do you reside? Comcast/Verizon smells like USA for my German nose, but the motherland of capitalism wouldn't have gov't issued monopolies.

Concerning your problem: cut their pay until they deliver (unblocking), make them give you static IPs not out of the dial-in pool (will probably cost more). Or better, look for a hosted email service, V-server or co-locate your existing mailservers.

Re:Sounds like an ISP problem.

[houstonbofh]

This makes it easier to get all your mail blocked when your mail server moves, however. You have to remember to change the spf records for all your domains. Not so bad if you have one. Real bad if you have 30.

Re:Sounds like an ISP problem.

[multipartmixed]

Hey, thanks for those comments, some issues there I hadn't considered, in particular the TCP slow start.

> Your ping on the T1 is probably about 10-15ms lower
> than it was on the ADSL, and that makes a big difference
> for subjective experience.

Yeah - 4.3ms from the workstation to the ISP's core router.

My home ADSL 2+ connection is 27.4ms to the same router, and that is without Bell's ATM network in the way (Bell doesn't have ADSL at my CO so the ISP/CLEC co-los their own DSLAM).

Re:Sounds like an ISP problem.

[realityimpaired]

Most of Bell's network isn't ATM, from what I understand... They're running Ethernet, mostly over fibre optics. Their "fibe" service refers to Fibre-to-the-node, which is usually GigE over fibre to the green Bell box in your neighbourhood (or in your basement if you're in an MDU).

Your ADSL service *is* running ATM, though. I have no clue whether it's ATM from the DSLAM to the ISP's core network, but I know it's ATM from the modem to the DSLAM, because I'm not aware of any DSLAMs on the market that don't use ATM for communication with the modem. The "synch" they're talking about is the negotiated transfer rate between the DSLAM and the modem, using ATM negotiation. As I understand it, that's a design decision in DSL based in the way the PSTN itself is designed, and short of ripping up all the lines and starting over (to get rid of bridge taps, end taps, and pairs that extend beyond the house they're connected to), it'd be a pretty bad idea to move away from ATM.... that simply isn't going to happen, given that they're in the process of rolling out FTTH (had guys in my neighbourhood last week installing fibre, though I'm still on copper at the moment).

Re:Sounds like an ISP problem.

[dougmc]

EXIM can be configured as such.

OK, but give me one real world site that actually works this way.

Re:Sounds like an ISP problem.

[DavidTC]

Yeah, I'm a little baffled by that also.

That actually seems the safest way to do it, if all your outbound mail servers are also inbound servers, which is probably 99% of the servers out there. (And if you're using something else, you're presumably skilled enough to know that.)

Granted, if you have backup MX servers, you're including servers in there that won't be sending mail...but as they're servers under your control, it seems unlikely they would be spamming.

Maybe he's annoyed because it will take another DNS lookup?

If so, that's silly. Mail servers often already do MX lookups for mail being delivered to them...mine requires incoming mail have a FROM domain that can be responded to, for example. (I.e., that it actually has a MX or A record pointing somewhere.) It doesn't require the connection be from that IP, just that it is an IP somewhere.

That's not only for spammers, but to catch people who've mistyped their own address...better to reject it back to them with a message saying their domain name doesn't exist then to get it here and then be unable to bounce it or reply to it.

Re:Sounds like an ISP problem.

[badkarmadayaccount]

ECN enforcement at the network edge would throttle the zombies if the spam victim behaves appropriately (if not, it's their problem), and not screw with outgoing network connections to other mail servers.

Dump Comcast

[cstec]

Comcast's idea of the Internet is an increasingly detached 'consumer endpoint' version of the Internet. If you're not in a rural area, then find a true Internet provider and move on.

Re:Dump Comcast

[Steauengeglase]

While I understand it 99% of the time, I'm not sure if I should get hit with violating the ToS for firing up a Quake server once a month. I mean, yes, I "should" get hit, but I'm not sure if it leaves me very satisfied with my service, especially when Netflix and torrent guys use much more bandwidth.

PS: Might want to find a better term to use than "freetards". It is kind of vague. Some days of the week tossing that term around means you are out to defend a man's right to feed his family and expand the market place, you know truth and virtue and all that jazz. On other days it means you are supporting rent seeking and people will assume you are a shill who don't want their stock dipping. All in all I find it best just to avoid the term. Granted it is a free country, you can say what you want, but for some people around here you might as well be saying, "faggot".

Re:Dump Comcast

[elfprince13]

If you're in a rural area you probably don't have Comcast or Verizon anyway. Neither of them provide service for miles on any side of me.

Comcast Business works for me...

[Frosty Piss]

I haven't had this issue with Comcast Business (static IP). Port 25 works just fine. But, some recipients don't like us.

Re:Comcast Business works for me...

[edmudama]

My Comcast Business account explicitly allows servers on the static IP, including mail, web, etc. Anything allowed unless it's against the law in the local jurisdiction. If you go over bandwidth caps, they reserve the right to promote you automatically to the next tier of service. At the top tier, there are no caps.

It costs a little extra, but it seems to me like a business big enough to run it's own mail server should be able to afford the ~$75-100/mo for a business cable modem account.

Re:Comcast Business works for me...

[houstonbofh]

But, some recipients don't like us.

Check your DNS entries. A clean and proper DNS will help keep you off spam block lists.

Re:Comcast Business works for me...

[Douglas Goodall]

I have a Comcast business account, but it is on the same cable as the neighbors video, and it is very flakey. When I have had business accounts with other vendors, I got real tech support. Every time I turn around, Comcast does something nasty to me that makes things unstable again. They keep opening my access box and putting filters, sometimes backwards, and everything goes to hell. Or they unplug my cable down the street because years ago I terminated a video account, and they don't check to see I am a business Internet customer. Blah Blah... You can't run a reliable server if the packets don't reliably come and go, no matter whether they filter certain ports or not.

Do they allow you to turn it off?

[a.koepke]

Over here in Australia quite a few ISPs will have port blocking like this turned on but they do provide you the option to disable it. It can even be done online via their user control panel.

Have you spoken to your ISPs about this issue?

Pay for a business connection?

[way2trivial]

they only (so far as I know) block ports on residential accounts
you don't mention it, I suspect you are using a residential class account.

I have a comcast business account.. 2 actually.
pay for an account where the TOS allow servers... they won't block the port

before I had a 2nd commercial account, (at my home)
my biggest gripe was connections from my home to work
  took too many hops to go 8 miles in very different ip ranges...

see if comcastbusiness.net is on the block lists you fear..

Re:Pay for a business connection?

[slashdotard]

Comcast & Verizon have been known to routinely treat business customers as residential customers. ,

Your ISPs 'smart host'

[W3bbo]

Usually when ISPs block port 25 (ostensibly because of all the botnets sending spam, a wise precaution that I advocate) they will provide a mail relay for their customers to connect to. They might not advertise it as that, but if your ISP (still?) provides a POP3 mail service, then they're going to give you an SMTP one too. Failing that, why not put a relay on any server you have in a datacenter or colocated? Configure it so only your computers can relay though it and it'll be fine.

Re:Your ISPs 'smart host'

[shentino]

What if they block port 25 as an incentive for you to pay for SMTP access?

Anyone with a resource under their absolute control will be tempted to restrict access to it for economic reasons.

Re:Your ISPs 'smart host'

[billstewart]

If they're providing you with SMTP service, these days they'll typically use one of the authenticated mail submission protocols instead of Port 25. But there's no reason for a business that knows how to run a mail server themselves to use that, as opposed to sending their email directly. Not only is it a security issue, but it's a huge reliability and transmission-speed issue, and consumer-oriented services like that often limit how many messages you can send per day, which doesn't work for businesses.

more like casualty of war

[trybywrench]

this seems more like a casualty of war with spammers.

Re:more like casualty of war

[fuzzyfuzzyfungus]

I suspect that it is a mixture of "collateral damage in the war on spammers" and "convenient mechanism for price discrimination".

Back in the day, the ISPs could use the simple "dialup=cheap gits(unless they inquire about worldwide availability of dial-in numbers, in which case Soak 'em), T1=Soak 'em" heuristic to more or less distinguish between business and home users.

Now that a T1 is pitifully slow by consumer broadband standards(and, depending on location and providers, not much more reliable than a faster and cheaper consumer broadband connection, never mind two or more coming in over different wires for redundancy...) they need something else to keep business users paying more. Crippling common server functions is, conveniently, both a plausible reaction to spambots and a good way of making consumer-priced connections less useful...

Re:more like casualty of war

[Mashiara]

My ISP back here in finland will actually rent you a static IP-block even for consumer-grade connection if you ask nicely (and configure reverse-dns for them upon request too [though that might be just me; I have very good relations with them and very rare name]), don't really know if they block outgoing 25 since I always have used their mail server as smarthost (it saves me a whole bunch of trouble with blacklists etc).

I also have a proper business-grade connection from them (since the uplink speeds on consumer-grade connections suck) at another location and that one is expensive (over 5 times the price of the consumer link), however it's not "best effort" of a theoretical maximum bandwidth you will never reach (and that too is shared between who know how many subscribers) but proper guaranteed bandwidth from your modem to their interconnects (and up/down bandwidths are the same), now the consumer stuff is in theory 10Mbit per sec, still for "some reason" (aka the "best effort") the 4Mbit/sec business-grade connection constantly achieves higher sustained transfer rates...

This is a big deal for me. :-(

[Omnifarious]

I've run my own mailserver for over a decade. It's IP has changed every few years if I switch ISPs, but otherwise it remains stable. I have a static IP on a DSL line and have reverse mappings set up. I have SPF records. I've registered with a whitelist. I've done everything I can. And still nobody who uses hotmail gets email from me. And I have increasing difficulty getting email to anybody else.

And I do not believe a single spam message has ever made it out from my network. I even block outgoing port 25 for the network segment my roommates use (when I have roommates) unless I'm administrating their computers.

This whole trend is really upsetting to me, and totally broken. I never have a problem sending email to someone with a gmail.com address, and they have the best spam filtering of any email provider I've ever used. The shortcut of blocking any DSL IP is clearly unnecessary if Google can do such a good job without it.

Re:This is a big deal for me. :-(

[Omnifarious]

I actually do check blocklists periodically because I use them myself and understand the danger. I don't think I've ever found myself listed in any of them.

That's another thing, my email is always just eaten. I always make sure that either delivery is refused when the email is being sent (in the case of a blocklist) or that it's delivered. I do not reject mail after I've accepted it for delivery to avoid being a source of backscatter spam. But I do use RBLs and other cheap-to-execute tools to reject mail before I accept it for delivery. I consider it to be the polite thing to do. If someone sends me an email that has no chance of ever reaching me, they should at least be told why.

Re:This is a big deal for me. :-(

[anom]

I remember once upon a time when I was first setting up my mail server I experienced this exact problem. As I recall, there was some kind of hotmail-ish website I went to that helped me get its IP allowed by their system.

Here are some great resources on sending email to hotmail:

http://mail.live.com/mail/troubleshooting.aspx (generic troubleshooting page for sending to hotmail)

https://postmaster.live.com/snds/ (Signing up here lets you see what hotmail thinks of a specific IP, assuming you control RDNS for it. This might have been what I did once upon a time)

Finally, if none of those help, you can ask them directly here:

https://support.msn.com/eform.aspx?productKey=edfsmsbl&ct=eformts&st=1&wfxredirect=1

Regards,

Anom

Re:This is a big deal for me. :-(

[wumpus188]

Sorry to hear that, but you are a 0.01% minority. Almost all mail that is coming from ADSL or cable netblocks is spam. I also have run my mail server for many years but I run it on a colocated server, and I've always (and I suspect many other admins) blocked everything coming directly from ADSL. Sorry, but the time for setup is long gone, get a cheap VPS and be done with it.

Re:This is a big deal for me. :-(

[RavenChild]

I would have to echo you on this. I've been running my own mail servers for about 8 years and have had to switch ISPs at least 5 times. The first was from a move, the second one (Insight) changed their TOS to make companies upgrade to a business class line. I told them to go screw themselves and got a business-class DSL (from one of the *Bell companies). When they changed their TOS at Insight though, they ran port scanners on every subscriber. If you had any ports open such as 25 or 80, they placed you on a watch list. Once on that list, if they detected any traffic, they cut your access and tried to extort business-class fees from you. The place I'm at now is not a business connection but I still have those ports for use. The only problem is that every major email provider blocks residential IPSs for mail. I haven't sent an email to a major provider from my servers for 1.5 years. However, all the people I know running their own servers get my emails just fine. In their attempts to "stop spammers" they have made it impossible for anyone but companies with money able to send email. I can't even relay my outbound SMTP through my ISP anymore.

Times change and now the majority of users think email only comes from hot/gmail and their work. ISPs don't have any reason to cater to those who want their own email unless they pay up.

Re:This is a big deal for me. :-(

[bcrowell]

I've had similar problems.

The clueful email service providers are yahoo and gmail. They both support dkim and sign all their outbound mail with dkim. They both have mechanisms for reporting dkim-signed spam from their users ( http://mail.google.com/support/bin/request.py?hl=en&contact_type=abuse and http://help.yahoo.com/l/us/yahoo/mail/classic/spam.html ). If you dkim-sign your own outgoing email, you can go through a process with yahoo http://help.yahoo.com/l/us/yahoo/mail/postmaster/forms_index.html to tell them that, and if the info you provide satisfies them, your mails are less likely to end up in users' spam boxes.

The one that doesn't work for me is AOL. Any email I send to their users goes straight to the bitbucket. I have never been able to find any mechanism for convincing them that I'm not a spammer. I'm sending mail from a dedicated server with a permanent IP address, SPF, DKIM, and reverse DNS all set up properly.

This whole trend is really upsetting to me, and totally broken. I never have a problem sending email to someone with a gmail.com address, and they have the best spam filtering of any email provider I've ever used. The shortcut of blocking any DSL IP is clearly unnecessary if Google can do such a good job without it.

It baffles me that some large email providers like hotmail and AOL don't implement DKIM. The added CPU load is negligible on a modern machine. I'm not saying that DKIM is a cure-all, but it works much better than these silly, ad hoc measures like blocking all vanity domains. If someone with a yahoo account sends spam to someone's gmail account, the user can report it to yahoo, yahoo can verify the dkim signature so they know it really came from that account, and they can deactivate the account. If someone sends spam to a gmail account, and they claim to be a yahoo user but they aren't, google can detect that it isn't properly signed and trash the mail.

Re:This is a big deal for me. :-(

[timeOday]

I have run my own mail server from home on my comcast account for over a decade (since it was @home). About 5 years ago I had to start routing outbound through Comcast (dc_smarthost='smtp.comcast.net') simply because nobody else's servers would accept them.

In principle it's distasteful having to do this, but there is really no disadvantage. The benefits all come from handling your own *incoming* mail, so you can receive email at your own domain, take your email addresses from one ISP to another, make up more addresses, etc.

What is the downside of sending outgoing mail through your ISP's server?

Re:This is a big deal for me. :-(

[Omnifarious]

Yes, and lose physical control over my stuff. No thank you. If someone is going to come for my servers, they're going to have to come to my house and have a real warrant.

Re:This is a big deal for me. :-(

[Omnifarious]

I've debated doing that. It makes it easier for a third party to collect my outbound email, but only slightly.

Re:This is a big deal for me. :-(

[gad_zuki!]

Then pay for business service. I have AT&T business DSL and Comcat's business and outbound 25 is not blocked nor am I blacklisted. The problem is that people refuse to pay for proper business service and then whine and whine about caps and blocks from their cheap residential plans.

Re:This is a big deal for me. :-(

[timeOday]

If you want to communicate with somebody in particular securely, consider giving them an account on your system, so they can add it to their email client (which connects to your server over ssl) and use it for correspondence with you. Then it will only touch their client and your server in unencrypted form.

Re:This is a big deal for me. :-(

[Omnifarious]

*rolls eyes* I don't whine about caps. And blocks require active effort to maintain, so I don't understand why they'd be cheaper. Yes, pay more money so you can actually use the Internet service you were sold...

I don't think my ISP even _has_ a business plan. And they certainly don't advertise a lack of caps or blocks as being a feature if they do.

Re:This is a big deal for me. :-(

[Malc]

I used to be in a similar situation. I started having intermittent problems with Hotmail about four years ago. The worst part is that the messages just vanish without being delivered or bounced. It seems to me that Hotmail isn't spec compliant from this regard. It was particularly bad sending to one friend of mine, and got to the point where I'd CC his wife who had a non-Hotmail account. Hotmail support were actually responsive for a while, but of course I didn't really get anywhere with that. These days I just don't bother running a mail server... in fact I'm kind of glad not to have the extra hardware running day and night in my home.

Re:This is a big deal for me. :-(

[jonwil]

This is why these ISPs should have one net-block for residential customers (where all the SPAM comes from) and a different net-block with static IPs for business customers who want to run their own mail server etc.

If the ISPs are (as others said) giving their business class customers static IPs from the same pool as their residential customers then that's poor network management IMO.

Re:This is a big deal for me. :-(

[Hurga]

Yahoo clueful? Maybe when it comes to accepting email. Try to report spam to them. You'll get some nice boilerplate answers telling you either they've taken action, or that they didn't send the spam, both for emails clearly originating from Yahoo (and yes I know how to read headers). And of course the spam keeps coming in either case.

Yahoo is the only big ISP I had to block at work.

Re:This is a big deal for me. :-(

[geohump]

.

It baffles me that some large email providers like hotmail and AOL don't implement DKIM. The added CPU load is negligible on a modern machine.

If it's "negligible", why don't you pay for them to implement it? Do you really think your small business solution that adequately handles hundreds of messages a day on a single machine will scale to millions of messages a day on a server farm?

You mean like Google groups and Yahoo who both use it? I think Google understands scaling pretty well. I suspect they aren't having any issues with the compute load of DKIM, to the tune of billions of emails.

Re:This is a big deal for me. :-(

[badkarmadayaccount]

Some sort of SMTP in HTTP encapsulation would be a convenient workaround, if a few big providers would use it (I bet GMail would add support about two hours before the RFC is even ratified.

Re:Ports

[pipatron]

Uhm. It would also require that they contact every other company they are doing business with and ask them to change their mail server port, right?

Residential or business service?

[peacefinder]

I had a customer (a small town government) recently have port 25 outbound blocked by Comcast. After going around with Comcast for a bit, it turned out that they were subscribed to a residential-class service, which has port 25 outbound blocked by an implacable policy. The only way to get the port unblocked in this case would have been to move them to a business-class service with a static IP. (Fortunately the block wasn't a big deal for them, we were just using it for automated status reporting rather than running an inhouse mailserver.)

Spam

[sketchbag]

I think it should be up to ISPs to block port 25 from their own client pool. That way, you can get whitelisted if you want to run your own mail server by your ISP. If all ISPs did this, it would be an obstacle for spam. Or if there were a registry of approved mail servers, so botnet zombies on cable pools cant easily dump thousands of spam messages per day. I think it is a step in the right direction, as long as your ISP is willing to open up port 25 to users upon request.

Re:Spam

[Sarten-X]

For only $9.99 per month, per port!

Business class service

[Anonymous Coward]

Are you getting business class service from your provider? Verizon, Comcat, TWC, Cox, etc all give unfiltered access to business customers. If you have business class service and are being filtered call your rep or open a ticket with support and tell them to fix it. Any ISP I have ever worked with will provide you with appropriate PTR records or delegate your netblock to you allowing you to run your own reverse DNS which in turn allows proper MX reverse DNS verification which in turn helps see mail accepted on the far end. Also using SPF and/or DKIM along with a properly configured mail server are all critical to avoiding problems with blacklists and other filtering mechanisms these days.

Just call them.

[TheDarkener]

I have Comcast business class, but I used to have Comcast at my home and both setups just required a call to customer service to ask to unblock port 25 because you're hosting your mailserver there. They're usually pretty helpful about doing what you need done - I even had them put in a reverse DNS (ptr) record for my mailserver's IP addy because some mailservers do reverse lookups to see if the IP points to a/the hostname (try "nslookup -> set q=ptr -> ip.add.re.ss" to check it) for spam control.

Re:Just call them.

[woolio]

Did you call them for the residential account or the business one?

Their residential TOS forbids running servers at home. I cant imagine that they eould happily help in such a case....

But if they did, I would like to do the same!

Re:Just call them.

[TheDarkener]

7 years ago I was residential and didn't have a static IP block, so I used EasyDNS for that - though they technically knew I was running a server because I had to register a MAC address with their modem and called to do that (which they did, knowing from me that it was a web/e-mail/dns server of my own). But yeah, when I got "business class" with a /29, I did the PTR record with them.

Would be nice if they simply treated those types of "rules" the same whether or not you're a "business" or paying more.. You know, provide Internet access and related services (DNS, for example)..

get a real Internet connection...

[pak9rabid]

Sounds like your company is extremely cheap & stupid for not just getting a real Internet connection. I don't blame companies for straight-up blocking any mail traffic originating from blocks of cable modem IPs...it's generally a source of illegitimate spam. Tell your boss to put down the money for a T1 to use for email. Route all other traffic through your cable connection.

Re:get a real Internet connection...

[pak9rabid]

That works too...hell, if they're really that cheap, they could just use their ISP's SMTP server (aka, Smart Host), and rely all outgoing mail through there.

Re:get a real Internet connection...

[Baloo Uriza]

Let's just ignore the fact the Internet is supposed to be peer to peer and equal access! That's the answer! Seriously, the idea that one shouldn't host their own services is the kind of mentality that makes me hope the fleas of a thousand camels infest the erogenous zones of the people who suggest that.

Re:get a real Internet connection...

[NormalVisual]

Depending on what he needs, even $40 may be way too much to spend - decent VPS packages from reputable providers can be had for $15/month, depending on how much RAM/disk space is needed. In any event, the VPS will likely have a symmetric 100 megabit connection to the outside world, and live in a real data center where it's likely to have much better uptime than something hanging off a cable or DSL line. Plus, additional IPs are usually available for little to no cost as needed with justification, and there's usually no headache with getting RDNS taken care of either.

both comcast and verizon

[nimbius]

are inappropriate for small businesses yet continue to grow in popularity due to their heavy marketing and low cost.

Contact your local bell, or find a t1/t3 reseller, and let them know you need a fractional leased line. the cost is higher, but you get a real service level agreement to which the provider is contractually obligated.

using a dedicated/shared server for email hosting has its drawbacks. the shared server may become overloaded by spammer accounts and other users, and its generally not a priority for most hosting companies as they get very little money off a shared hosting sale. dedicated hosting is just as bad because you're commonly forced through one relay host, or a set of relay hosts that routinely become overwhelmed by spammers on your providers other dedicated hosting boxes. the dedicated and shared boxes are also notorious for floating in and out of various blacklists and sender reputation services, so you can expect mail to break-down about once every few weeks.

Re:both comcast and verizon

[Attila Dimedici]

Both Comcast and Verizon are inappropriate for small businesses yet continue to grow in popularity due to their heavy marketing and low cost. Contact your local bell, ...

Verizon would be his local bell.

Re:both comcast and verizon

[houstonbofh]

As someone who has both a 5 mig fiber to Qwest, and a Comcast business class, I disagree. While you are correct that there is no SLA, as long as it is not "full" it performs well, and give much more bang for the buck. But once the connection starts to saturate, performance goes down fast. Horses for courses.

Re:both comcast and verizon

[Lehk228]

Verizon is one of the baby bells (bell atlantic)

Use smarthost mode

[hidden]

Most mail server software is capable of routing the outbound mail through the isp's mail server in such a way that it gets listed as the origin. You get to keep running your mail server, but the spam labelling and port blocking issues all go away.

The only time this is an issue is if the isp's mail servers do some kind of filtering or mangling, but most of the ones I've dealt with don't

Re:Use smarthost mode

[sirsnork]

This!

If he can't be bothered to call his ISP and ask them to unblock it, and really does have a Business account that allows server, then this is the solution. It's really quite simple to do on every mail server I've ever tried it on.

If you use SPF you may want to update the records for it to list your ISP's outbound IP addresses, but I'm guessing if there is outbound port 25 blocking issues going on and that required an Ask Slashdot then SPF isn't something in use :)

Cable modem mail server? No

[19thNervousBreakdown]

Rent a dedicated server, or get your own co-location space. I have one that I pay $70 a month for with 1and1. I use 'em because I was able to install my own OS image on there, and they're generous with the bandwidth, although I'm not sure I'd run a company's e-mail server through them--the network connection can be flaky. About a year ago they went down after 5pm for an hour or so for a week or two due to a DDoS, then the last week they have been not accepting new connections (existing connections work fine) for periods of 1-3 hours during business hours. Seems to have cleared up now, and those are the only issues I can recall. Not sure if they have a multihomed network connection available for more money.

Of course, pretty much anything would be a step up from running it off a cable modem.

Anyway, rent a dedicated server, or get to a co-lo. 1U would be plenty, and shouldn't cost too much. Preferably one run by an ISP, as they have plenty of experience being on both sides of the spam issue and if you're on a nearby address space, a personal interest in keeping that address space off of spam lists.

Re:Cable modem mail server? No

[woolio]

You do realize one can get their own VPS for about $100/year, right?

Re:Cable modem mail server? No

[19thNervousBreakdown]

Yeah, that's why I specified dedicated.

Are you sure you need to host your own?

[facebiff]

Are you in the business of running mail servers? If not, then odds are that another company is better at running mail servers than you. They can probably do it more reliably than you, more securely than you, and in a more cost-effective way.

If you're being paid somewhere near market salary for a tech job in the US, then you've probably spent hundreds of dollars worth of man-hours addressing these issues already. Is it worth it?

Re:Business Account

[Manip]

I read the summary. Don't believe him. He is using a consumer connection. I've never heard of an ISP blocking ports on a business connection since the entire point of the damn connection is to get servers on to the internet and to allow VPN passthrough. If they blocked ports required for e-mail they might have well discontinue offering business accounts at all.

Most business connections also come with fixed IPs for exactly that purpose, and those aren't ever blocked by spam lists, since again the entire point of a business line is to bring servers online - not clients.

In principle

[mysidia]

You should be able to run your own mail server.

Pragmatically... to get your mail out, either upgrade to leased lines with your own IP allocation, or subscribe to a reputable spam filtering service that offers outbound relay and filtering of spam, e.g. Postini.

The general idea is your 'outbound filtering' service will have a good reputation for mail deliverability, and they will be able to more accurately model your mail profile and recognize spam/malicious activity than any third party not beholden to you.

Business Cable blocking Port 25?

[EMR]

My dad's server is on Business Cable and Port 25 is not blocked and we have had no issues running our mail server on that connection.. Now one thing that we did do to aid in preventing us from being blocked is requesting our 5 IPs setup with reverse DNS entries to our domains instead of the Generic "ISP looking" ones that comcast assigns by default. You should contact Comcast and Verizon to set that up.

Also, make sure when you are testing if port 25 is "open" that you aren't yourself on an ISP that blocks 25 outbound. And make sure you setup port 587 (SMTP submission.. Authenticated SMTP) so that users can send mail from any ISP.

Yes, but the problem is spam filters

[proxima]

Even if you have a non-cable modem IP, it can be difficult to send (opt-in) business email from a small mail server. The reason is that spam filters at major email providers like Yahoo are turning to whitelisting, and you have to contact each major provider to avoid getting your email sent straight to the spam filter.

Since the implementations of spam filters at the server level seem to vary quite a bit, I tend to avoid sending particularly important single emails through my own small email server for fear they just end up in the spam folder of the recipient.

That said, in general I wouldn't trust a business-class cable modem connection to host an email server for business purposes. Virtualized servers are commonplace now and quite affordable (I pay $15/mo for mostly personal use). Set up the backup on your own connection.

Re:Yes, but the problem is spam filters

[LodCrappo]

VPS is a temporary "fix" at best, as nearly all mail providers are now starting to list VPS-land IP space in the same category as residential/dynamic IP space. Any advantage using a VPS gives you in delivery is about to go away.

The cheap VPS providers where you need nothing more than a credit card (easily stolen) are abused by bulk emailers as much if not more than compromised home accounts, and email providers know this.

Re:Yes, but the problem is spam filters

[proxima]

VPS is a temporary "fix" at best, as nearly all mail providers are now starting to list VPS-land IP space in the same category as residential/dynamic IP space. Any advantage using a VPS gives you in delivery is about to go away

Agreed. My comment about trusting a cable modem connection was one of reliability. A couple of VPSes in different places set up redundantly is an inexpensive way to ensure uptime. You also know they won't block your outgoing ports, but you will still have to be concerned about getting filtered into large providers' spamboxes based on IP range. The solution is to send through a large, trusted SMTP server and receiving at your VPSes. Leave the cable modem for non-server purposes.

Relay thru smtp.comcast.com

[WaffleMonster]

Most likely your system is misconfigured and sending misdelivery reports rather than rejecting the smtp request in realtime or worse (open relay)

Comcast and Verizon are reacting by shutting you down...you have to beg to get it restored from what I understand...

There is no good solution for most of us other than to just relay thru comcasts SMTP server.

Comcasts user networks are in the subscriber block lists of many RBLs however typically business class accounts are exempted from these lists.

For outgoing mail if you can't send directly your best bet is to configure your SMTP server to relay all messages thru comcast smtp.comcast.com which is less than ideal.

Comcast runs with aggressive dns timeouts and their mail system does not properly translate DNS timeout to a temporary condition.. This sometimes cause emails to valid destinations in distant countries with slower links to bounce.

Re:Relay thru smtp.comcast.com

[Alworx]

I agree...

I too got tired of ending up in black-lists so I just relay all outgoing email to my provider's SMTP.

Piece of cake

Small CoLo's aren't safe either

[Bigbutt]

I host my personal server with a Mosaic forum (Mosaic and Stained Glass.org) out of a CoLo in Florida. It's not the cheapest solution but I do get 100% access to the server to do what I want and a reasonable time on reboots when necessary.

Still, Microsoft will randomly block my mail for a month at a time with no recourse. I've attempted to contact them but they send me to a troubleshooting page which tells me I'm configured correctly but they still won't accept email. This wouldn't be too bad of a problem except that other ISPs use them to manage their e-mail. So I can't get any e-mail to Shaw.ca or AT&T in Canada. They don't even have a whitelist option for their users.

And there are a few smaller ISPs in the US that use anti spam blocking sites that don't have any way to let them know that I'm not spamming.

Most others though have contact information in their bounce and I've used it to check the various sites in the block list, then forward the results to the postmaster at the offended site. Then I get it opened up for the folks on the forum.

Heck, one ISP replied that I needed to get in touch with them and their Postmaster account won't accept further e-mail. I had to send them a note from my Yahoo account. Then they said it was a problem with my ISP and they should fix it. My ISP had no idea what they could do to fix it.

Even the company I work at, who uses MX-Logic can't receive e-mails from me because I'm not able to convince MX-Logic I'm not a spammer.

On the plus side, if I did want to spam Microsoft, they have a program where if I pay them, they'll open their servers up so I can send e-mail to their clients.

I'm not doing any real business on the server. I have my consulting website there but traffic is pretty much non-existent. The biggest impact is when the forum folk try to send the other folks e-mails (the PM notifications). I have a note in the Site Agreement to let folks know on shaw.ca, frontier, and the others that they might want to use a Yahoo e-mail to manage their forum account.

[John]

Re:Small CoLo's aren't safe either

[jnelson4765]

We converted all our customers over to Gmail before I started working at my current job. Now, this was after the old mailserver got hacked (long story) but it makes life a hell of a lot easier for communication. IMAPS and POP3S out of the box, decent web UI, and it would have to be a spectacularly retarded sysadmin that would block inbound Gmail.

I did run a mailserver at my old job - actually, three of them in a load-balancing arrangement. I'm much happier with not having to deal with the problems in running a modern mail server.

Re:Small CoLo's aren't safe either

[Hurga]

Well, I guess the problem is the Florida colo. Florida has very spam-friendly laws (just google "florida spam"), so my guess would be you have some spammers in your neighborhood (i.e. colo) and are caught in the collateral damage of filtering them.

Re:Small CoLo's aren't safe either

[Nimey]

FWIW Florida (especially the Boca Raton area) is a major spam haven.

CableOne's been that way for years

[RogueWarrior65]

CableOne has blocked outgoing mail for years. It's annoying to have to reconfigure your mail program every time you travel somewhere. And it hasn't stopped the flow of prescription drug e-mails and Nigerian-ish scam e-mails. Hell, if all of those e-mail from barristers in foreign countries telling me a long lost relative left me several million dollars were real, I could by that 30,000 acre ranch in western Wyoming...and a helicopter. And why is it always a seven-figure inheritance? Wouldn't more stupid people believe $20,000?

VPS

[dlevitan]

Get a VPS. You can get one for $20/month and set up a full e-mail server on it. You'll get better hardware and better connectivity than your own server. Your IP will be seen as coming from a data center, not a cable modem pool of addresses. You can also host your own website, and leave the server you have at your office for internal things only. For mail access, just set up IMAP and SMTP with TLS, with the latter on port 587 (known as the submission port) which is generally not blocked like 25 is.

Re:VPS

[Brama]

I second this. I've been using a VPS for the last 5 years for mail and DNS, and don't regret it for a moment.

How to setup a SMB mail server

[DigiShaman]

Being that I setup SBS 2003 and SBS 2008 boxes, let me explain what you really need to make it work.

1. A business class ISP subscription. Along with this classification, you get a netblock of IP/s that (usually) wont be preemptively blacklisted by SORBS (I hate them).
2. Reverse DNS (PTR) record. Not having one is almost guaranteed to get your sent e-mails blocked. Getting one created is easy as pie if you subscribe to a business class ISP.
3. SPF record. They're many online wizards to help you create one. My favorite is from Microsoft.
4. DNS that will host TXT records. Needed for that SPF record you just created.

Once all completed, be sure you test out your handy work over at http://www.mxtoolbox.com/ Good luck.

Re:How to setup a SMB mail server

[socsoc]

Thanks for the mxtoolbox link, I've been usinto IntoDNS. Nice to have another tool.

Re:How to setup a SMB mail server

[DigiShaman]

Ya, mxtoolbox is pretty sweet website. I love how you can cut-n-paste e-mail headers and have them rendered into an easy to decipher format. It makes troubleshooting mail flow a heck of a lot easier.

Re:How to setup a SMB mail server

[mea_culpa]

Also make sure you have a firewall policy in place that prevents your users from bypassing your mail server.
All it takes is for one spam sending malware infected PC on your network to pretty much permanently ban your IP address.
Yes, you can try to get unblocked from spamhaus, SORBS(spawn of Satan), and others. But once your reputation is damaged it spreads fast to places like barracuda, sonic, Symantec, and many dozens more firewalls and spam filters that do not whitelist you for a really long time if ever.

So. Your firewall policy should be something like this:
Allow FROM (IP of mail sever) TCP 25 TO *
Allow FROM (IP range of DHCP pool) TCP 25 TO (Allowed SMTP Smart-hosts, ISP SMTP server)
Block FROM * TCP 25 TO *

The order/syntax will depend on your firewall. But it is crucial that no host on your network be allowed to send anything through port 25 to any host outside of your control or knowledge except your mail server.

Re:How to setup a SMB mail server

[gregmac]

You're bang-on with this. Reverse DNS entries and SPF are critically important. Your forward DNS should also match, eg; if you send from 1.2.3.4, you should have a PTR record for that IP to "mail.mycompany.com" and "mail.mycompany.com" should have an A record that points to 1.2.3.4.

Though as you point out, not all "business class" IP ranges are created equally. Notably, if the ISP allows many other businesses to send spam (from virus infections) in the same range as your IPs, you'll probably eventually be blacklisted as well.

This setup will get you a good outbound setup. I did something similar when I joined the company I'm at now, though took it a step further, and because we have some servers in a data center anyways, I changed our Exchange server to relay it's outbound mail (aka use the stupidly-named "smarthost" thing) to a server running postfix, when then sends to the rest of the internet. The reason I did this was two-fold: I don't really trust our cable co's IPs, and we have a secondary DSL line: if we fail-over to that, I still wanted outbound email to work. This setup allows both, since our mail always comes from an IP in our datacenter netblock. In the 2.5 years we've been using it, we've had no problems with people getting our mail.

The other side of this is inbound: personally, inbound mail on a cable modem hosted in a regular office is a recipe for disaster, eventually. In fact, one of our clients had it happen to them, their office flooded, and their ability to get email was down for several days while they tried to get a new server up and relocate it. Email was actually bouncing back to people sending to them, because nothing was responding. Since their phones were also down at first, it looked like they were out of business, except that they called us to tell us what was going on. You don't want this to happen to your business.

When I first did the email setup described above, I also got an account at dyndns using their Mailhop Forward service. Effectively, you point your MX records at their server, and then they deliver mail via SMTP to your (possibly dynamic) IP. If the office connection goes down, they spool mail for you for up to a week, and deliver it once you come back online. No mail lost, even if your connection is down. In a disaster, you can easily redirect the service to send to another mail server, without having to wait for DNS changes to propagate and all those other servers to retry sending and/or people to manually re-send.

Since then, we got tired of the spam (whatever crappy software we had that integrated with Exchange sucked), and so probably a year ago, we switched to Messagelabs, which provides a similar service to Mailhop but also does virus/spam filtering. Spam went to effectively 0. I HIGHLY recommend using an external company for this.. it costs us a few dollars per person, well worth it, and we don't have to manage anything ourselves. I see Dyndns is now offering something similar as well, I can't vouch for that service specifically but we continue to host our DNS with Dyndns and I have nothing but good things to say about them.

There are other solutions...

[eld101]

Depending on the amount of email you want/need to host, you could turn to a vps like Linode. I have a few small servers with them and their performance is great. There is a small cost associated with it but that is probably well worth it considering you are obviously posing potential important emails.

Re:There are other solutions...

[eld101]

I forgot to mention you get full Root access to do what ever you want (as long as its legal)

Re:ITs the end of the small business mail server

[Sarten-X]

Outsourcing is often not feasible. As an example off the top of my head, any American company working with medical data needs to be certain that personal medical data does not leave their control, or they get hit with huge penalties from HIPAA and HITECH. That eliminates a lot of outsourcing options, and especially anything cloud-related, because one mistaken message, even from someone outside the company, can have devastating effects.

A few things to try

[chrisgeleven]

1) Get a static IP address for your mail server if you don't already have one. Many mail servers use DNSBL blacklists that distrust anyone with a Dynamic IP address.
2) Get your ISP to configure Reverse DNS for your mail server's IP address. Many mail servers reject mail because Reverse DNS isn't configured properly.
3) Make sure your server is set to not run as an open relay.
4) Have a proper abuse@ and postmaster@ e-mail addresses so e-mail providers who claim to have spam complaints against your domain can actually send them to you.
5) Setup an SPF record (openspf.org has a great wizard for this) for your domain. SPF records basically specify which mail servers are allowed to send mail from your domain. This will help cut down on spammers spoofing e-mail addresses at your domain and increases the odds of legit e-mail not being marked as spam.

Not all of these will guarentee delivery of any e-mail, but they can certainly improve the odds.

Re:A few things to try

[Phroggy]

6) Configure your server to identify itself by the same hostname that your reverse DNS points to (and, obviously, be sure that you have an A record for that hostname that points to your IP address).

Re:A few things to try

[ricky-road-flats]

All solid advice - but make sure when you get a fixed IP address it's not part of a residential block of IP addresses, or you will still be on the blocked lists.
I fell foul of this last year, we had to switch our broadband to a 'business' account to get a clean IP address.

Also, the Messagelabs service is excellent, and surprisingly cheap, and removes the problem you have - recipients see emails arriving from trusted Messagelabs whatever your connection looks like. They also periodically check your email server and make recommendations.

Re:Ports

[drhlx]

Actually it would require a rewriting of the SMTP protocol :P However, the standard solution is to use port forwarding on an external unencumbered host accepting inbound port 25 and forwarding to your unblocked port (e.g. 1025). You can use a smarthost to similarly forward external email via another 'unblocked' host. This generally gets you closer to the benefits of a "local" mail server vs simply hosting your mail server external to your network.

Re:ITs the end of the small business mail server

[SnoopJeDi]

Outsourcing it is cheap because it needs to compete with these roll-your-own systems. If small mail were totally blacklisted, I wouldn't be surprised to find mail services prices bump a bit. Afterall, they'd be the only people with an ISP allowing port 25...

SMTP with AUTH and SSL and/or TLS

[Anonymous Coward]

Unencrypted, open authentication SMTP on 25 is dangerous and can get you on a blacklist easily.

Use SMTP AUTH combined with SSL (465) and/or TLS (587)

Forward 25 port to SSL one

[paziek]

Forward 25 port to SSL one - thats how we do it at company where I work. 25 port is blocked cause of spam.

ISP Link

[Imagix]

First question... do you have a residential or a business link? That usually changes the network preferences. As I recall most residential agreements prohibit running servers on the network to begin with.

Re:ISP Link

[dririan]

From TFS: "We have high-speed business connections through Verizon and Comcast." So I'd say business.

Re:ISP Link

[WillRobinson]

We have Verizon business and they block it. Fortunately we host our own server in a colo, but still have to use a off port to access it.

Re:ISP Link

[socsoc]

Then he's getting scammed

Re:ISP Link

[dririan]

It's entirely possible that Comcast/Verizon block port 25 unless you specifically request otherwise, as they both have smart hosts to forward mail that comes from their network. I had to call Verizon and ask for them to unblock port 80 inbound on a business-class connection.
It's also possible to get business-class Internet without a static IP, in which case they shouldn't be trying to run their own mail server...

A couple of options

[a9db0]

1) Talk to your ISP and get the block removed.
2) Change registrars / DNS providers to EasyDNS. They do mail forwarding for customers. Don't bother if you send spam - they'll quickly shut you down.
3) Set up a VPS somewhere - Linode's are great. They all come with dedicated IP addresses.
4) Farm it out - let Google handle it for you.

Are you sure you're on business class service?

[Omeganon]

1) If you're being blocked then you're hosting your mail server on IP space that Comcast and Verizon have designated as dynamic. Don't do that. Either get them to properly classify your block as non-dynamic _or_ make sure that you're really on non-dynamic space.

2) Ensure that you have proper reverse DNS configured for your server. If you have business class service, they should be completely understanding of your need to change PTR names for the IP's you use.

3) If you really are running on dynamic IP space and have no way around that (that's not painful to you), you always have the option of smarthosting your mail through the Comcast or Verizon mail servers. That's what they're there for.

Re:Business Account

[Sarten-X]

I once worked at a company whose ISP blocked all incoming connections, period. That was on a mid-level business connection (which at the time was DSL, at something under 1 MB/s), on the only ISP in town. Getting a port unblocked required a few hours on the phone, trying to explain to the support monkeys that yes, we really did need to run our own server, it really was allowed in the contract, and our connection really was already fast enough for what we needed.

That was in the mid 90's, before every company had to have a presence on this new-fangled Internet thing. Back then, the only thing the Internet was typically used for by a business was sending and receiving "electronic mail" to or from other businesses. Running your own server was practically unheard of unless you were big enough to practically start up your own ISP. Heck, it took several months of complaining before the phone company even fixed up the phone lines enough to carry DSL, and the modem connections could be disposed of. Life in rural Indiana has its troubles...

Re:ITs the end of the small business mail server

[houstonbofh]

Assuming that you trust the outsource company. It is only as secure as the monkeys running it. Go ahead and get gmail for business if you want. I will host and control my own server, thank you.

Am I missing something?

[nblender]

I've run my own mail server since the .UUCP domain and comp.mail.maps. For a very long time now, we have not been accepting MUA->MTA mail on port 25. We have been using port 587 for MUA->MTA. MTA->MTA is port 25 and has been for a very long time. However, you don't try to connect to anyone else's port 25 from your cable or DSL modem unless you have setup some sort of non-home internet access and signed an AUP... Even then, chances are your cableco or telco will insist you relay through their mail server and I agree with their motives for doing so.

My mail server (a VPS on panix.com running postfix) has no trouble sending mail to anyone; including hotmail. I won't trust my cableco to relay my mail for me; ever.

Purchas a VPS

[gladbach]

They are cheap, allow you full control over your RDNS, and will solve your problems.

Re:Use Google Mail

[houstonbofh]

Just use google business apps for your mail. Hosting it yourself is a huge headache.

Hell... Just post your e-mail to Usenet. That way it is backed up everywhere and you will never delete it by mistake.

Re:Stop hosting your own mail

[houstonbofh]

Who do you trust more, your own skills or someone else's? For arthroscopic surgery, I will outsource. For mail services, I KNOW that I know more than the idiots I have spoken with at several "Hosting providers." You may be different.

Yep, sounds like the issue

[Sycraft-fu]

Most residential providers block port 25. Part of it is they just don't want servers on residential connections but another part is spam prevention. 99.999% of home connections have no reason to run something on 25 and if they are, it just means their system is owned and spamming.

For servers, you need a business class line, which has no restrictions. I have a business class Cox cable line at home for that reason. Lets me have static IPs, no port blocking, more upstream, and no bandwidth limits. It does cost more, but it means I can do as I wish.

Mod parent up

[pavon]

Assuming the domain in question is softegg.com, then reverse DNS is indeed not setup correctly, and it is no surprise that his email is getting blocked.

Re:Mod parent up

[DigiShaman]

Correct. a reverse lookup points to (static-71-178-232-50.washdc.fios.verizon.net) which means he hasn't set up a PTR yet. He needs to simply call his ISP and create one over the phone. A process that should take all but 5 minutes. Another problem I see is what's listed in the SMTP banner of the responding mail server. I'm not sure localhost.localdomain is valid. And while he's at it, cleanup those MX records. I don't see why there's triplicate of the same IP with different weighting. Not that this will cause any issues, but it's just messy IMHO.

Re:Mod parent up

[Phroggy]

Assuming the domain in question is softegg.com, then reverse DNS is indeed not setup correctly, and it is no surprise that his email is getting blocked.

My diagnosis is slightly different: in fact he does have perfectly valid reverse DNS (71.178.232.50 resolves to static-71-178-232-50.washdc.fios.verizon.net which resolves back to 71.178.232.50), but it's his mail server that is misconfigured to identify itself as "localhost.localdomain". That's what looks suspicious, not his reverse DNS. I would recommend either:

1) Configure his mail server to identify itself as the hostname that his IP address resolves to (static-71-178-232-50.washdc.fios.verizon.net), or

2) Ask Verizon to set up custom reverse DNS for him, and configure his mail server to identify itself with that hostname. This is prettier, but technically no more valid than option 1, which would require no help from his ISP.

(And yeah, he has extra MX records. Some spammers will skip straight to the last one; legitimate MTAs should try them in preference order, lowest to highest, so this could mean if there's a failure, MTAs will try his server three times before falling back to Google, but some implementations may be smart enough to recognize all three as the same host and skip to Google on the second try. I wouldn't personally set it up this way, but I'm not gonna recommend changing it without asking him why he chose to set it up this way.)

Re:Mod parent up

[Y0tsuya]

Some recipients are extremely picky as part of their spam filtering routine. Craigslist.org is one example. Make sure you cross your T's and dot your I's when it comes to forward and reverse DNS. If you can get craigslist to accept email from your server then you're good to go.

Re:Mod parent up

[archen]

That sort of address will more than likely still be rejected because of the domain name that looks like a dynamic block. Simply having a matching ptr is often not enough.

Your options are...

[jetole]

Co-locate a server in a data center, lease a server from a data center, get a business class internet account, etc etc. Here is one of several free Real time Block Lists (RBL) that block all email coming from residential ISP's: http://www.spamhaus.org/pbl/

War against small email servers?

[Chuck Chunder]

Unless you have people breaking down your doors, shooting anyone who gets in their way and lobbing a grenade into your server room then no, there isn't a "war" against small email servers.

Re:War against small email servers?

[CAIMLAS]

That would be awesome. It would totally give me the excuse to push the red button.

Re:Welcome to the club

[DigiShaman]

It's that damned DUHL list that SORBS keeps. Admins don't let fellow Admins use SORBS. They're freaking evil! Want to stop legitimate SPAM? Use an RBL provider such as Spamhaus (xen.spamhaus.org). And while I can recall, I seem to remember those Barracuda firewalls using SORBS as a anti-spam filter.

VPN+VPS

[toby]

Works for me.

Re:dying technology...

[houstonbofh]

And how do you think gmail communicates with yahoo?

Reading between the lines, again...

[Anachragnome]

Here I am, reading between the lines, again.

The laws that apply to government having access to ISPs, to access email records, are very different then the laws that apply to your own server. It is MUCH harder to get emails, legally, from you directly (or, more specifically, your server), primarily because you probably wouldn't just hand them over like ISPs do. Secondary is the fact that they often don't want us to KNOW we are being scrutinized and a subpoena pretty much blows that particular fish out of the water.

That being said, this is more then likely the application of pressure to move everyone to ISP-controlled servers and thus make it far easier for government to access your private emails, all in the name of "spam-prevention".

Think of the kids!

So talk to them.

[MrL0G1C]

My ISP blocks port 25 and I'm glad they do because it stops botted machines from setting up spam servers. The point is that if I want port 25 opened, all I have to do is ask - Have you asked Verizon and Comcast to open the port?

SMTP port?

[antdude]

What about those who send e-mails from their e-mail clients like Outlook? I send a lot of e-mails from my home PCs that use port 25 (SMTP) from Mozilla's SeaMonkey mail client. I don't like webmails.

Re:SMTP port?

[i.r.id10t]

Use authenticated smtp - its at port 584

Of course, the server to server communication all runs on 25 still..

Re:SMTP port?

[antdude]

Yeah, but not all e-mail servers/services have that port. :(

Re:SMTP port?

[Baricom]

These blocks are only for people who run their own mail servers. If you're using a mail client, it'll be configured to connect to your ISP's mail server, and nothing changes for you.

Re:SMTP port?

[antdude]

Ah OK. I remember some ISPs block relays too so I thought that was related.

Re:SMTP port?

[hardwarefreak]

Use authenticated smtp - its at port 584

Of course, the server to server communication all runs on 25 still..

You're thinking of 587, which is for MUA submission. This is not for server to server SMTP communication. This will not help the OP.

Re:SMTP port?

[ModMeFlamebait]

587 actually, and usually servers accept auth also on 25

Re:SMTP port?

[DavidTC]

Not mine.

I got sick and tied of having to deal with support problems where someone was in a hotel or using public wifi or just switched ISP or their ISP got with 1998 and suddenly 'I can't send email.' because their ISP was blocking email.

And it's always an emergency. Always. I had to drag myself out of bed, look at the setup, and say 'Use port 587, you idiot, like it says on the support, I don't care what the default is in your client', and go back to sleep. I got sick and tired of that, emailed everyone, set a deadline, and turned off fucking port 25 for submissions, and dealt with all the support issues at once with a form letter explaining what was wrong.

And now that never happen again. They cannot set up their email wrong. When they set up their email, they must use 587 or 465 (For Outlook stupidity) or it doesn't work to start with.

forward it

[ggendel]

Set your mail server to relay through your ISP. Most dynamic addresses are blocked via RBLs anyway. Unless your ISP provides reverse DNS of your address a good percentage of your mail will not be delivered. I've been doing this way before they started blocking the ports.

Possibility?

[aklinux]

Have you tried an Outbound MailHop service such as the one from DynDNS? I am just looking into it for what I am attempting to set up, but it seems like a possibility.

Get with a small ISP

[cptdondo]

I use a small local ISP. When my server got blocked because it was in a block of IPs normally assigned as dynamic, I called them, explained the situation, and they assigned me a fixed IP from another block.

Sure, I could save $20/month by using comcast, but I talk to a real engineer who sits at a desk 60 miles from me. What's more they actually understand what I'm talking about. When one of their routers took a dump, and I traced my failure to it, they took my traceroutes seriously and dispatched a crew.

YMMV but I get better service, support a local business, and I get the services I pay for.

It's all in the contract for service . . .

[cjacobs001]

Where tiers are possible in service, service is tiered. This is not new. This is good business. For residential-class service they charge X and they block the port. For business-class service they charge X + and they unblock the port. there's nothing 'unfair' here, the contract defined the tiers. You do not 'own' the network, nor the access to it. You have a contract for access to use the network, and you agreed to fine print in the contract. The fine print states that if you want to run a web server, or email server, you must purchase business-class service. move along now. there is no story here. It has been this way

This is just plain wrong

[sgent]

As long as you have a business associate agreement there is no problem outsourcing medical information. Hospitals and clinics routinely outsource everything up to and in including electronic medical record systems.

Re:This is just plain wrong

[Sarten-X]

As I recall (though I haven't worked much on the business side of things), entering into a BAA doesn't necessarily remove the liability. Outsource to someone obviously incompetent, and it's still your patients getting notified and your reputation on the line. If you are able to find someone willing and able to take on all of the responsibility for security, is it still going to be affordable for a small company?

The OP says outsourcing mail service is "very cheap", but the required service gets messy for many industries besides just health care. "Very cheap" sometimes just doesn't cut it. It's certainly not a justification to cut off mail service to business customers, because they're not primarily in the mail-service business.

Re:This is just plain wrong

[Sarten-X]

As I recall (though I haven't worked much on the business side of things), entering into a BAA with an obviously incompetent company doesn't necessarily remove the liability. It's still your patients being notified and your reputation on the line. If you are able to find someone willing and able to take on all of the responsibility for security, is it still going to be affordable for a small business?

The OP said that outsourcing was "very cheap", but the requirements for regulated industries (including, but certainly not limited to, healthcare) gets very messy, very fast. "Very cheap" simply might not do the job. The availability of such "very cheap" services is certainly not justification to remove mail service from business connections, just because a company's not in the mail-service business.

Re:This is just plain wrong

[Sarten-X]

I apologize for the almost-double post. I posted at 1:55 AM, but it didn't show up until 11:30 AM... WTF, Slashdot?

Verizon blocks at the "free" router

[Wormholio]

I've run my own mail and web servers from my home for years, so I was worried about this when I was making the switch from Time-Warner cable (who didn't care, BTW) to Verizon Fios. One person I know reported that Verizon did indeed block port 25 (and port 80) inbound, while another told me his setup worked fine, once he replaced the free router they gave him with his own router.

And indeed, after making the switch, I still am able to get mail inbound on port 25. The modem/router they gave me does have controls to adjust security settings, which look a lot like Windows trusted -vs- untrusted controls. But I can't really tell if they do much. The key thing I found was to set up port forwarding to send port 25 to the machine in my internal network with the mail server. Same for port 80 to the web server.

Outbound I route through the ISP. Postfix makes that easy. I found a few years ago that certain domains I sent to, though not all of them, started bouncing mail even though I had an SPF record, just because my IP address was in a range listed as "dynamic" (i.e. "residential"). Clearly that's for spam control. Not everybody does this, and I could send direct to those who do not, but it was simpler to just send everything out via port 587 to the ISP.

This doesn't jive

[dave562]

If the OP really does have a high speed "business" connection, then that connection should come with a static IP. That static IP should provide the foundation for a stable mail server. Other than the static IP, all you really need is a reverse DNS and a PTR record for your IP that matches the A record on the MX record for the domain.

I used to do consulting for the SMB market. I setup more local mail servers than you can shake a stick at. It is a simple and straight forward process. I have yet to see an ISP block port 25 on a business circuit. If that is what is happening in this case, you need to take it up with the ISP. They are not giving you what you are paying for. If they won't play ball, switch ISPs. There are enough of them out there.

Two things

[WillRobinson]

You can have your own server hosted almost anywhere for 50$ a month. Second, use this to be able to do both port 25 (which is blocked) and reroute port 26 to port 25 in your ip chains pre-route rules. Then set your people in the office to use port 26 instead of 25. (I am using APF) you did say linux server right?

# place your custom routing rules below
$IPT -t mangle -A PREROUTING -p tcp --sport 443 -j TOS --set-tos 8
$IPT -t nat -I PREROUTING -p tcp --dport 26 \-j REDIRECT --to-port 25

Re:Two things

[WillRobinson]

I also wanted to mention, its cheaper to colo than to get a fixed ip from Verizon.

Re:Your ISPs 'smart host' (aka 'smart relay')

[oneiros27]

Exactly ... you just relay your mail through the ISP's outbound mail relay ... so long as you're not sending spam (or something that they think is spammy), you're fine.

I personally wish more ISPs would block 25 outbound, as it can significantly cut down on spam and virus propogation.

(disclaimer: I worked for a small ISP about 11 years ago; we'd allow 25 out on request, but this was back in the day before viruses were spreading spam for the most part)

ISPs blocking / redirecting Outbound Port 25

[billstewart]

Broadband access ISPs have several different policies about outbound port 25

• Block it entirely, to discourage spammers and Linux users. Those bogus ISPs are clueless cretins, and many of them have Acceptable Use Policies that don't let you run mail or web servers at home (though that shouldn't apply if you've got a business-priced service), so you're sort of warned if you deal with them.
• Block it by default, but turn it on for customers who ask them. I'm as hard-core an end-to-end-principle fanatic as anybody, but I'm fine with this. Once almost everybody made the transition to using SSL/TLS or at least authenticated mail submission protocols a few years back, the only people sending out Port 25 from home are a very small percentage of legitimate mail server users, who can be expected to know what they're doing, and a very large percentage of people who don't realize that malware has infected their system and is using it to send out spam.
• Force it through their outbound "smart" mail system, which may be doing some useful outbound spam filtering, but is usually dumber than the mailer you'd run yourself for home use, and much dumber than a business needs. For instance, many of them used to limit you to 100 messages per day or per hour - not only does that obviously fail for a business, but I'm part of a social group that sends out email with party and dinner announcements to 200-300 people a couple of times a week, and since the guy whose home computer has a Real ISP, it's not a problem. ISP smart mailers were a very convenient and necessary service back when most of the world was on dialup; they're a lot less useful now.
• Allow it, because what you bought was Real Internet Service, have terms of service that hit spammers very hard, have an abuse desk that takes spam complaints seriously, have a help desk that actually has a clue, maintains reverse DNS entries and SWIP registrations for static IP customers, and keeps their customers happy. (Ok, fine, not every ISP is sonic.net.... and I think they actually do the "block port 25 but provide a convenient web form for unblocking it" approach; I run my outgoing mail through the mail service I use for my inbound.)

Re:ISPs blocking / redirecting Outbound Port 25

[drinkypoo]

It seems like virtually everyone does one of the two middle things. I have a local WISP so they only tamper with http (or so it seems at times. that could be ATT though, which is DEFINITELY not supposed to be doing any such thing but who trusts the death star anyway?)

Not much to change...

[elbles]

There's a few things you can do for outbound mail. The cheapest/easiest solution would be to use your ISP's e-mail server as a smart host (i.e., DSmail.comcast.net in sendmail.cf). What I would do is get a "virtual private server" or similar (with a static IP), and set that up as your smart host/relay. It doesn't have to be incredibly powerful or anything--a bare bones configuration would be enough these days.

As a side benefit, you could also use the same system as your primary or secondary *inbound* mail server, by configuring it to simply relay mail to your primary mail server as long as it can connect to it. Otherwise, if your cable connection goes down for whatever reason (they aren't T1 lines, after all), your e-mail will be queued up on a system you control. Well worth the $20-30/month a VM from someone like Linode will cost you...

Use an alternate port

[tparkergeum]

If port 25 is being blocked, perhaps you could configure your internal mail server to use a different port--say 587, which is another commonly used mail server port. Particularly if it is an internal mail server (and you have control over and knowledge of who uses it), then you can have everyone in your organization configure their email client applications to also use port 587.

Re:Why bother?

[izomiac]

Or spend the time paying HIPPA fines or losing DOD contracts. Some businesses need to keep confidential data on their own network/machines.

Parts of Rackspace IP space *should* be on RBLs

[billstewart]

Rackspace's customer "Traders Business Network" tbnonline.com (website) decided to send me their spam newsletter daily. The first message to their abuse@ email got me a robo-response with a ticket number, but there's no obvious way to look up the tickets to see if they've done anything, and the spam didn't stop. Subsequent emails to their abuse desk with the following few days' complaints got no response, calling their tech support desk got me forwarded to their abuse desk, who still didn't answer after several days, and after more than a week I eventually got annoyed and looked up their corporate general counsel. Email to him did get a response, but the spammers still have a working website.

Rackspace does some things quite well, but my opinion about their service went way down this past month; you shouldn't have to harass corporate officers to get a half-assed response from their abuse desk.

Re:Yes there is a war against small email sites :-

[VojakSvejk]

Damn. Wish I had mod points.

Re:Use Usenet

[billstewart]

Yeah, and then your ISP stops providing a News server, so you end up having to fetch it with Google Groups anyway...

Re:Stop hosting your own mail

[dranga]

And I'm sure your local government TLA agency will thank you for using a more centralized service for your email too.

Well, do you have static assignments?

[buss_error]

See this for Verizon: http://www22.verizon.com/residentialhelp/highspeed/general+support/top+questions/questionsone/124274.htm

Will outbound port 25 blocking apply to all Verizon broadband customers?

Outbound port 25 blocking will be applied to FIOS and High Speed Internet services that use dynamic IP addresses. If you subscribe to a static IP address service, you will not be affected.

Sounds like you have only to change to static IP service to get around this. If you have static IPs, then call Verizon. Obviously there's something wrong. If you don't have static IPs, well, you're doing it wrong to begin with. Many well run mail systems won't accept a IP known to be dynamic.

Verizon unblocks 25 if you ask

[ScottMaxwell]

Verizon will unblock port 25 if you ask them. They did for me. I hope that helps!

Carma Whoring

[I)_MaLaClYpSe_(I]

That's how this looks in a telnet port 25 session from a DSL line:

telnet mx2.hotmail.com 25

220 bay0-mc3-f21.Bay0.hotmail.com Sending unsolicited commercial or bulk e-mail
to Microsoft's computer network is prohibited. Other restrictions are found at h
ttp://privacy.msn.com/Anti-spam/. Violations will result in use of equipment loc
ated in California and other states. Mon, 21 Feb 2011 17:47:40 -0800
EHLO mine.home.net
250-bay0-mc3-f21.Bay0.hotmail.com (3.12.0.56) Hello [xxx.xxx.xxx.xxx]
250-SIZE 36909875
250-PIPELINING
250-8bitmime
250-BINARYMIME
250-CHUNKING
250-AUTH LOGIN
250-AUTH=LOGIN
250 OK
MAIL FROM: i@home.net
550 DY-001 Unfortunately, messages from xxx.xxx.xxx.xxx weren't sent. Please conta
ct your Internet service provider. You can tell them that Hotmail does not relay
  dynamically-assigned IP ranges. You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors.

Now if you've got a dynamic IP or a static IP in a dynamic IP range or maybe even a static IP from a static IP range from a larger known-to-be-dynamically-assigned IPs...

EASY SOLUTION

[woolio]

Forward your outgoing mail in your mailserver to your ISPs SMTP server.

Problem solved.

You, my friend, need to pop for a static IP addres

[Karl Cocknozzle]

Really, it's not the most complicated solution ever, but sometimes the best ones are the most simple.

And think about co-locating, for hassle-reduction

[VoxBoston]

We used to host our own databases and mail / web server in the Boston area. Not in a huge office complex, just in a small suite of offices. It sucked.

Every couple of weeks, someone would dig up a cable in the street (causing an outage), or the power would go off for a long time (and our UPS would die, and that would cause an outage), or someone would trip over something (causing an outage).

Grrr. We eventually moved our stack of mac minis (cheap! and low hassle) to a specialist colocation place in Las Vegas that basically is a sub-tennant of the gigantic Switch datacenter.

Here was the surprise bonus - in addition to way better uptime, the quality of the connection we got was SO good it was crazy. Doing a 500Mb system update takes like, a minute to download. And because we didn't need the fancy Symmetric DSL connection back home, we could save money by downgrading to a regular ADSL connection. And, we got a 'naked' / all ports open connection to the net without hassles.

This was a seriously Good Move for us - think about moving your box somewhere offsite. It's cool.

If you happen to be using Macs, we used http://macminicolo.com/ (we're just a customer, but a pretty stoked one).

Small ISP's suffer too

[pcjunky]

In 1995 I started an ISP offering dialup and web hosting. We have moved on to High Speed wireless. We have a portable Class C address (204 block). We have for a couple of years been dealing with AOL and other large providers block our email. We don't have the resources to try and contact them every time someone has trouble sending them email. Lately I have taken to telling customer who want to send email to AOL and other large providers to get a gmail account. I explain that no matter how much SPAM comes from Gmail servers they will never get blocked. I explain they are "too big to block". War on small ISP mail servers, yea I would say so.

Re:Small ISP's suffer too

[Douglas Goodall]

Back in 1991 I was an early adopter when appropriate usage loosened up. I got a telebit modem and a UUCP account with UUNET. Mail traveled pretty well over UUCP, and if you spamed someone, they punished you by sending you a 50 page appropriate usage document that costed you big bucks in bandwidth. Later on I got several SLIP connections and started hosting an email server for Fair Isaac that forwarded received email using a modem and UUCP. Mail still moved fairly well. Then I got ISDN, and found I was paying for multiple connections within a single minute. Around that time, spam started showing up. I had to go to DSL because ISDN was killing me financially. I was a newbie admin, and soon discovered my DSL was saturated with mail traffic using my open server. As my bandwidth increased so did the amount of hostile packets hitting my network. I was so proud of my class C network at home, but soon discovered my DSL was saturated again with probes on all 254 IPs in my class C. I would get on a packet sniffer and look at the packets hitting me, and I would find out that I was getting reverse DNS requests for blocks I had never heard of, and tons of SMB attach requests with a dictionary worth of user names. Eventually I installed a linux system with good reporting on security alerts, and discovered I was getting thousands of failed SSH attempts (from China, from Brazil...). It was FreeBSD days and I mastered inet.conf and services, and found I could set up services. I would no sooner set up a service, then some hacker would probe and discover my server port, and saturate my connection again hammering the services trying to get something to happen. As much as I wanted to have my own local server at home with a static IP, it was making me crazy. Now I use Apple Mobile Me for email. I host my domain registrations at Network Solutions, and I use my home connection mostly as a client. Now and then I set up a special purpose port for a colleague to communicate with a local embedded system using an encrypted protocol. If you have all the time in the world to spare, running your own local server is a fun hobby. But I had my (I thought it was locked down) server hacked and web site blown away, and the wife's internet store was offline until I could restore the machine. The FBI wasn't interested in my trouble because my damages were too small money wise. I just decided to give up being an amateur server operator because there are too many skilled hackers out there that take delight in thrashing my machine. Microsoft servers don't even need to be hacked, they fail on their own. Buffer overflow problems never seem to end no matter how much attention we pay to CERT. As well informed as I thought I was, being responsible for client's on-line services was just too much heartache. So I have sympathy for those still trying to run their own mail servers. The list of people trying to give you grief includes your ISP, the Govt, and a worldwide collection of unemployed hackers with not enough to do. :-(

Stop using cable companies for your ISP service?

[iceT]

I learned a long time ago that the address ranges used for end-user oriented services routinely get blocked... If you got a dedicated line, and not a business class cable system, it would help your situation.

Re:Give up! The era of doing it yourself has passe

[doktorjayd]

why is this modded -1?

its the first and only sensible response in the whole thread!

got a smallish business? google apps for the domain will be free

really, you pay a fraction of the cost of running your own mail / calendar / collaboration services with the additional benefit of them also handling the spam filtering for you.

i too ran my own smtp/imap servers for years, but have switched and will never look back!

Did you check RBL's?

[erice]

RBL's are maintained by humans and they make mistakes. Your server can easily end up on an abuse,"dynamic IP", or "dialup" block list even if you have a static IP on DSL and have never sent a spam. http://www.anti-abuse.org/multi-rbl-check/ is a good start. If there is a match, fire off an email to the administrator and get it fixed.

Large ISP's often have their own private RBL's that can not be checked. Earthlink, at least, will send a bounce. Hotmail may not. It would be worthwhile to contact hotmail about your situation. My server's mail was bounced by Earthlink three times last year but there have been no problems for the last several months.

I also have run a private server on static IP on DSL. Since the last Earthlink bungle was fixed almost a year ago, I have had no problems sending mail anywhere including hotmail.

Re:Stop hosting your own mail

[FlyingGuy]

I would agree with you on the Postini point, but not on gmail. I take care of lots of little law firms and they simply have to have better categorization then gmail provides and gmails "folderless" system, just plain sucks. You have to tag e-mails? With an actual MTA and an post office the a-mail stay on the server are all nicely organized in folders and can be seached just as nicely as gmail's can if not better.

The era of doing it yourself has passed.

[tony_allan]

My advice is to give up. The era of a small organisation running their own email server has passed. I have been running a mail server since 1994, and I am about to give up. Even being careful, there is a percentage of my mail that doesn't make it to the intended recipient. I have reverse DNS setup correctly, am whitelisted by my cloud provider, and ensure that my mail configuration is correct. I have wasted more hours than I care to admit keeping everything running, but I face at least one major email related issue per year, compared to when I started with something every couple of years, and then usually a silly configuration issue. I have better things to do with my time now. Let one of the big boys handle the hassles. You can still have your own domain and even some aliases.

Just get a VPN server $20 a month and proxy

[BlueCoder]

You can either proxy the email connections or host them directly. Email doesn't take up that many resources. Another $20 with another company gives you a backup MX. As a bonus you can run them as your dns servers as well as maybe a couple other low priority jobs run in jails.

And it goes without saying I suggest that you consult with a couple external security hackers and audit all your servers a couple times a year. You may be a small business but your probably more of a target than the big companies. How much is your companies reputation worth?

Practical Advice

[mkiwi]

As someone who had to deal with the same problem for awhile (before I got a true static IP with my business account), I can tell you that most ISPs will use a relay server for any mail that you wish to send. Generally, you just put a URL, username, and password into your SMTP settings and again you can send mail.

The method has the added bonus that, if your netblock is not marked for static IPs, spamhaus and other mail services won't blacklist your server. Talk to your ISP about what relay settings your mail service should have.

Re:ITs the end of the small business mail server

[Lord_Byron]

If you are sending PHI via encrypted email, you are almost certainly doing it wrong, regardless of outsourcing. Sending it unencrypted could be considered disclosing it to the receiver's email service provider, and maybe anyone along its path, because the definition of disclosure includes "the release, transfer, provision of" data.

Call them

[npsimons]

Seriously, this isn't that hard. If there isn't a phone number or email address on the bill for business support, you need to stop paying your bill (ie, find another provider). That or look for a phone number or email address or even fax number in the DNS records. Your mail admins should know all this and have done it already. I'm a part time admin who runs his own email server, and I run into this on a semi-regular basis; it's not even my paying *job* and I'm able to take care of it.

First thing to do is check your own mail servers. Are you sure you are not sending spam? Are you sure no one in your company is sending spam? Are you sure you're not operating an open relay? If you are running mailing lists, make sure they are all opt in and dead simple to unsubscribe, with an automatic system to handle it, and if someone asks to be taken off without bothering to use the form, do it immediately.

The second thing to do is check the logs and DNS records for email addresses, phone numbers or web addresses or even just error messages as to why you are being blocked. Next is to try to remedy it: fill out the web forms, send email, leave voicemails, etc. Some solutions may prove infeasible (my last provider wouldn't change the reverse DNS, and yes, there are some retards who will block on this one fact *alone*), but it's still worth trying.

Its a war, but not against small businesses

[atomic-penguin]

Small businesses aren't the reason administrators are blocking mail from Cable/DSL modem network blocks. Verizon and Comcast consumer-grade networks have a bad reputation for originating SPAM from infected hosts, that shouldn't be a surprise to anyone managing e-mail

If your company has a static allocated network block, and you follow best practices (i.e. accurate SPF/MX/reverse records, working Abuse contact for your allocated network block) you can talk yourself out of a reputation block list. Speaking of which, the last time I checked Verizon didn't even have a working Abuse contact. If you're on what is considered a dynamic consumer-grade modem network block, there is a fat chance getting de-listed.

If its been incorrectly listed as consumer-grade, you have to convince the reputation blacklist maintainers that you are on a business grade network. You will have to prove to them that you follow best practices, and that you have the infrastructure in place, necessary to get yourself de-listed. It may not be easy, but it is not impossible. I have been able to get a business-class A-block de-listed, however it had been incorrectly recorded as a consumer-grade Verizon modem block in a reputation blacklist. Our company had a directly allocated C-block, a working Abuse contact, etc.

Talk to Verizon and Comcast, if you're paying for business grade service, they may offer small business smart hosting. It may cost a little extra. See if there are any small IT consulting firms in your area offering similar services. Are there any Competitive Local Exchange Carriers in your area that could physically host your mail server in a co-location facility at a reasonable price?

Another option is to consider outsourcing to a SaaS model, Google and Microsoft may offer affordable smart-hosting with your existing mail server.

Finally, you have a myriad of cloud Virtualization hosting options, such as Rackspace, Amazon EC2, Slicehost, etc.

Linode

[mattr]

You could get a virtual linux box at linode.com, it's very cheap and mail servers are some of the common uses for them.

That said, I noticed when I traveled to a home on Verizon that they do indeed block port 25 when trying to send mail via my linode based mail server, and the solution was to go to an alternate port number and configure my mail server to accept it. This turns out to be pretty common with broadband providers like Verizon. I would not trust Verizon to not block 25 even if they say it is a business connection. Incoming is another matter.. If blocked then you need to complain.

Use a VPS relay

[Craig Ringer]

I relay all my oubound mail via a VPS at a reputable host - in my case, Linode, but many others would do. The VPS has a static IP allocated from space the VPS host has registered as used for hosting static customer services. Reverse DNS is configured to match the hostname it reports on EHLO and the hostname listed in the MX records.

That way I'm freed from all those annoying DSL/cable modem filter rules, and I get a secondary MX as part of the deal.

Default vs mandatory

[Craig Ringer]

I *love* ISPs that block port 25 outbound... by default. It's a great spam control measure for Judy and Joe's unpatched Windows XP SP1 machine connected directly to the Internet via a USB DSL modem. Most ISPs, however, let you turn it off via a control panel offered for your service - if you know you want to and know enough to do so. Those that don't let you turn it off at all because they're trying to force you to pay them to unblock ports, they piss me off.

Change port #s

[Temujin_12]

Outbound port 25 suddenly stopped working for us at our home office. My wife has a CRM system that she runs in our home office and it frequently sends emails to her clients (appointment reminders, appointment follow-ups, promotions, etc.). I configured that CRM system to use our mail server setup on a VPS in a data center with Server Axis. After I figured out that it was Comcast that suddenly shut down outbound port 25 from our home, all I did was change the incoming SMTP port on our mail server to be 2500 and everything has been fine ever since (something which may not always be a practical option if you have lots of different groups expecting it to be available on port 25).

But yes, make sure you follow best practices for managing a *legitimate* high-traffic mail server:
* Use a static IP
* Have proper abuse@ & postmaster@ addresses
* Setup an SPF record for your domain
* Follow the FTC's CAN-SPAM act (http://business.ftc.gov/documents/bus61-can-spam-act-compliance-guide-business)

I use smtp relay outgoing, and fetchmail incoming

[sgrizzard]

I host my own mail server at home, and I use my Web Hosting provider's SMTP as an outbound relay for mail. To connect to my server from the outside to send mail, I use the ssl port to connect, which my ISP does not block.

For incoming messages, I set up a catch-all address on my Web Host's email server, and fetch-mail it over IMAP. Then, I let fetchmail deliver it to my mail server, and process the mail delivery to local addresses in LDAP on my server, but it depends what your host provider does to the headers when the mail goes to the catch-all. If this is a problem, you may need to set up separate accounts on your host provider's server, or if they will let you, set the outbound to your domain to relay to your sever over a non-standard port (which, if they will let you do the relay, they can usually encrypt the connection too).

Posted delivery guidelines

[trumpetboy8282]

Some organizations publish their delivery guidelines. For example, UCLA's delivery guidelines are available here: http://info.smtp.ucla.edu/guidelines.php The most common reason UCLA's servers reject mail is due to improper rDNS records.

We are having no problems with Comcast Business

[mikemalter]

My business has a Comcast Business account, and we host our own email and for several clients. Comcast is not blocking port 25 for us and we are having no problems being blocked anywhere. Do you have a reverse DNS record that resolves to the address of your email server?

how small are you?

[Tom]

What is a small company supposed to do if you want to host your own mail?

Get a VPS somewhere and use that as a mailserver. Heck, I have one privately, how small a company are you that you don't?

It makes sense from many perspectives. You are still online when the power or connectivity in your office goes down, it can serve as an off-site backup, it will have a static IP address, getting you past many RBLS, etc. filters.

Re:Yes there is a war against small email sites :-

[awyeah]

I disagree with you on a couple of items here:

BTW, news flash for those of you that think google has good
anti-spam. They don't. They false positive legit email
as spam.

I'm only speaking from my personal experience. I find Google's spam filtering to be absolutely top-notch. I only very occasionally get false positives in the spam folder, which is an acceptable rate for me. For a while I had my oldest domain name (which I've had for 12 years) hosted there. It was getting somewhere on the order of 2,000 spam messages per day. Very rarely would I see a non-spam message in the spam box.

I've done the personal mail server dance a few times before. It's really a lot of work to make sure that your mail gets delivered everywhere and to make sure that spam is effectively filtered. I still haven't found better spam filtering than Google - although, admittedly, I haven't ever used any of the expensive or dedicated-hardware solutions like Barracuda.

Web mail SUCKS.

I think that's subjective. I really don't like any of the run-it-yourself webmail solutions (Squirrel Mail and RoundCube come to mind). I don't like Yahoo (at least as of the last time I saw it), never used Hotmail... but I've got to tell you, I've been using Gmail (and now Google Apps) since 2005, and although I occasionally download and fire up Thunderbird when a new version comes out... I still prefer the web interface. In fact, my only complaint is that there's no good way to do GPG in Gmail (that I know of). But the net benefit is still positive for me.

Re:ITs the end of the small business mail server

[Sarten-X]

Assuming you meant unencrypted...

Not sending PHI in email is an internal policy issue. Of course, nobody should be doing it, but that's no excuse to leave the company open to liability. If anyone sends personal information to the company, it becomes the company's problem, and the company's responsible for keeping it secure. In the event of a breach, there's enough wiggle room that a big enough pile of lawyers can likely get the company out of any major penalties, but it's a death sentence for a small company, which is exactly what we're talking about here. The cheap & less-risky solution is to run your own mail server, with everything secured like any other data storage, and with IT crew that are fully aware of what they're handling.

Solution to the problem

[hkultala]

If your ISP is blocking outgoing connections to port 25 of other IP's than their own SMTP server, then the solution is to configure your own mail server to relay the emails via the ISP's SMTP server.

If they have blocked incoming SMTP, then you have a real problem

If you mean "dial-up-line" by "small", yes

[Pf0tzenpfritz]

It is, however, not a war against legitimate MX but against trojan-infected dial-up machines spamming legitimate MXs. If you're in a 'dial-up' (or 'dynamic') netblock you most probably do not have a valid MX record. At least not one that will be resolved reversely. So you can not provide a reasonable HELO/ELHO string (see RFC 821) and any MX insisting on a correct HELO dialogue will reject SMTP access. Unfortunately not all do. Mostly due to bugs in W2k mailservers (some of them are still alive and still unpatched and never ones are less buggy, but still run by morons. This is one of the main reasons why spam has become what it is today and why some ISP have been blocking in/outgoing SMTP traffic on their nets. IIRC AOL started doing so almost ten years ago others followed blocking port 25 at least between their dynamic address pools and from foreign dialup ranges.

Re:Stop hosting your own mail

[erice]

Please...

For anyone that actually uses the flexibility available in private hosting, *any* outsourced email is a *huge* step backwards. I use more than 500 email addressed routed among 35 folders. I can bring up a new address or terminate one leaked to spammers in under a minute. All this means that most of my mail arrives in folders that don't need *any* spam filtering. If you send me mail, I know that it will arrive and not be directed to a spam folder or the ether by an ever changing agent over which I have no control. Even for the filtered addresses, I have logs going back months of every transaction and nothing is ever truly dropped unless the sending machine chokes.

Once a year, I archive all folders. I have a complete email history going back 17 years, broken out by year and category and all without clogging up current activity.

And I can access all of this with any client I want. I currently rotate among three different clients because each has unique features not found in the others or in Gmail.

What did your ISP say?

[ALeader71]

Did you ask your ISP why they blocked port 25? What does your service agreement say about hosting your own servers?
It's time for engagement with your provider, rather than trying to find a hack to bypass their security. Look up what port your ISP is using for POP access. Assuming it's port 25, ask them why they didn't block port 25 on themselves.

Re:Stop hosting your own mail

[yacc143]

Guess you use public transport too, I mean they do it better.

Hint: better has an implied parameter of the half order used to sort the alternatives. Actually humans are so defective that they use anything resembling a half order sometimes, but that's another story.

So if you definition of better involves "better for the environment" (hint: that's again a better, and you can figure out what is "better" for the environment), being able to read/work/nap, the price (it's usually lower than the real costs of driving, hint: you need to consider capital costs, service costs, and so on and not only the cheapest part, gas), than public transport is really better.

Now if better for you is to be free of a schedule, to be able to travel to any reasonable point more or less directly, have some privacy while traveling, ... than you'll probably consider a car to be better than public transport.

Now applied to mail handling, it's easy to see that there are similar trade offs here. Google is the "standardized public transport", that is more reliable, non-tiring to the user solution. But if you need to do custom stuff, react to say SMTP envelopes, run a mail based incident response system, run a mailing list, than running it via Google's IMAP/SMTP services might be less than perfect. (Some software might be setup to use POP3/IMAP/SMTP, but others might want to be installed into the mail server more intimately.)

yacc143

Here's the simple answer!

[mcrbids]

This post is some half day old and nobody here's actually posted about smart host in Sendmail? Guys, you are losing your edge!

It's made for exactly this situation and is jaw-droppingly simple, little more than edit a config file and restart sendmail and away you go. Other mail server softwares should offer similar functionality.

This solves OP's problem completely, is invisible, and makes the mail delivery problem the ISP's problem. (which, presumably, they've worked out since you're paying them to)

How can you claim to be a population of techies and not know this?

Re:Here's the simple answer!

[DavidTC]

Are you not reading the posts? half the people here are talking about relaying mail via another server, aka 'smarthosting'.

No one really uses the term 'smarthost' anymore, because there's not a distinction from 'mail relay' anymore. It used to be a way to distinguish from using an 'open relay', but those don't really exist anymore, and no one would configure a server to send mail through them!

No one is, however, talking about sendmail, because we are, in fact, a population of techies, and no one comes anywhere near that if they don't have to.

And, incidentally, you've confused sendmail with other mail server. In other mail servers, you just have to edit a config file and restart the server.

In sendmail, you have to edit a macro file, run a command to make a new sendmail.cf, and restart the server, because sendmail's config is too complicated for mere mortals to comprehend and must be generated by another program using a macro file to define things.

Don't be cheap, switch to bussiness class.

[Ecuador]

No need to pay for VPS, but he certainly needs to pay for Verizon business class service instead of the residential he obviously has. It is a company after all, they should have a business account - going cheap has its downsides.

Use a 'smart host'

[blake1]

The solution to your problem is simple, either a) use a static IP configured with reverse DNS, as many people have indicated, or; b) use your ISP's SMTP as a smart host to forward all outgoing email to. Simple, really.

Re:There is a 5th option.

[jgagnon]

I thought the 5th option was usually PROFIT!!!

Some things don't delegate well.

[overshoot]

I know of a dutch ISP which has a setup where you point your MX to their mailserver which will relay all incoming mail to your server. That setup makes sure an open relay in their network is harmless while still allowing their users to run their own mailservers.

Which is dandy as long as you don't want to use DNSBL to block spam.

I run a small mailserver, and have the problems described -- but if I gave up my DNSBL filters, my incoming spam traffic would totally saturate my bandwidth (tried it).

Postini

[e3m4n]

use google's Postini service. IT will act as a virus/spam filter for you as well as a 'proxy' for your SMTP traffic. All your MX records will have their IPs and you can even send all your outgoing traffic to them as well for scanning before sending.

Are you sure you're on a business class service?

[bemenaker]

If you are on a business class service, they should not be blocking smtp traffic. I work at a place that uses business TWC and we send and receive a LARGE volume of email everyday. You need to call their business support and talk to them, it's not the same number as residential.

Re:RELAY ALL OUTGOING TO YOUR ISP...

[bemenaker]

No do not do this. The reverse lookups on the domain name will fail, and they will be blacklisted as a spammer. The CORRECT response is to get the ISP to not block 25.

Re:Use Google Mail

[Kosi]

For a business? No way in hell!

I can understand why an individual makes the choice of sacrificing their privacy to the big G. But I cannot understand how anyone with a functional brain can hand over the complete mail and contact information of his business to them. Just think about the way confidential stuff is mailed around in company networks? Would you really like Google or other not-to-be-trusted corps to read up on your latest business prospects or your to-be-filed-tomorrow patent application?

There are some good ways not to host your own mailserver at your location. Most of them don't involve Google or other parties knowing most of everything there is to know about your company.

Selective IP space blocking

[PuddleBoy]

I've run mail servers for 15 years and always struggle with how to filter out the mountains of spam. One way is to selectively block IP blocks based on the history of that space. For Comcast, I find out the IP space of their legit mail servers and whitelist that space. Then, I blacklist all their other IP space.

Why? Just as folks looking to build a botnet look to Comcast for fresh meat, those of us protecting mail servers from spam look to Comcast as the first place to block. There's just too much crud that comes in from that space.

To be fair, many of us block a *lot* of other IP space in our quest to control spam. I block entire countries - why accept mail from a country you are 99.999% unlikely to be sent legit mail from?

Your best bet might be to convince Verizon to allow port 25 out. You may have to pay for that privilege - welcome to the work of real mail servers.

I gave up and used Postini.

[zerofoo]

After spending many hours and days trying to diagnose mail delivery problems, I just threw my hands up and put my mailserver behind postini. Since Postini has been delivering our mail, we've had no delivery problems.

I have better things to do than spend all of my time convincing a blacklist provider that I'm not a spammer.

-ted

Re:There is a 5th option.

[darkain]

http://en.wikipedia.org/wiki/IP_over_Avian_Carriers

Until companies like McAfee start running around with shot guns, I think this is a fairly acceptable alternative.

use a non standard port

[doperative]

"What is a small company supposed to do if you want to host your own mail?"

They block port 25 because of the spam problem, use another port ...

Port 25 not completely blocked

[Relayman]

Actually, that's not true. Softegg can get to his ISP's mail servers on port 25. All he has to do is configure his mail server to relay all outgoing mail to his ISP's mail servers. Simple, end of story. Trust me, if the ISP's mail servers show up on a blacklist, it will be taken care of immediately.

In a word

[SCHecklerX]

yes.

I've been routing my outbound through dyndns's mailhop service to deal with comcast's blocks. Inbound still seems to be ok, and I hope it remains that way, as I prefer to do my own filtering and blacklisting.

Re:Stop hosting your own mail

[lowtekk]

I concur. Not only do you avoid any of the blocking issues, but you are also guaranteed near 100% that your customers will never have any of their mail to you bounce. Your mail server may go down, but Postini will just queue it until your server comes back up. And on top of that, you don't take a bandwidth hit for all of the SPAM, etc.

Postini for outbound

[darxpryte]

Another option outside of getting a VPS is to get a Postini account and use them as a smarthost. Postini (or Google if you will) has a good reputation out there and you'll find much less mail blocked as a result. They also provide good inbound spam blocking services which you'll need eventually if you don't know.

Security Blanket

[jman.org]

Others have suggested a VPS; that's just another way to get a static IP (under no circumstances consider shared hosting, you never know who your 'neighbors' may be spamming...) But, since you run the server out of your own shop, besides switching to a static ip for your own connection, get with StartCom or one of the other low-cost cert folks & switch to SSL for your email traffic as well. Any of the free DNS services (dyndns, whatever) can be used to create an A record for your IP.

Re:Yes there is a war against small email sites :-

[Something Witty Here]

>> BTW, news flash for those of you that think google has good anti-spam.
>> They don't. They false positive legit email as spam.
>
> I'm only speaking from my personal experience. I find Google's spam
> filtering to be absolutely top-notch. I only very occasionally get
> false positives in the spam folder,

Putting legit mail in a spam folder is one thing. Not delivering
legit mail at all is quite another, and gmail started doing that
at some point (date forgotten). If the only contact info for
someone you have is an email addr, (and that is common) you're stuck.

Oh, and you can't open a gmail account unless you have a cell phone
that can receive text messages. WTF?

> I've done the personal mail server dance a few times before. It's
> really a lot of work to make sure that your mail gets delivered
> everywhere and to make sure that spam is effectively filtered.

It used to work fine before so many people started the assume-you-
are-a-spammer-until-proved-innocent thing.

I hate spam as much as the next guy, but not being able to
contact people is orders of magnitude worse.

>> Web mail SUCKS.

> I think that's subjective.

OK, it is subjective. Web mail is SLOW SLOW SLOW.
Editing is a nightmare. Editing in an emacs text window
and then copy-and-paste into browser window helps, but is
still problematic. Having some company reading your mail
is evil. And you have to copy any info you want to save
back to your own computer bacause who knows when the
webmail will fail.

Webmail is a nice option to have and if you like it great.
But being forced to use it when you hate it sucks.

get with the times

[hesaigo999ca]

Gmail is the best for small companies, they even offer to change the extension for you for your company, that way you do not get a gmail extension, they do all the virus verifications, and spamming filtering, so what you are left with, is really what you need....a 99.9% up server that already has full AV and SPAM app, plus also has cool integrated features that are as powerful as Outlook, but from a web interface...so saves you licensing MS Outlook too!

subject

[Legion303]

"What is a small company supposed to do if you want to host your own mail?"

Rent a virtual server in a real datacenter and run whatever you want. I think I pay $30/month for mine.

Simple solution: Use Postini

[spacemky]

Postini is cheap, and your MTA can be configured to send and receive mail through it. Plus you'll get fantastic SPAM filtering. Problem solved.

Re:You are too small

[billcopc]

Well thank you for modding this troll, whoever you are. Clearly you've never installed nor managed a spam-filtered mail server.

Yes there is.

[LBBP]

I don't think it's entirely intentional, but it is a real phenom.

Same answer as others, but we had this same issue with a private instance of Exchange server. We were constantly being blocked when sending email to recipients in SBC and Comcast, even others occasionally, but those were the worst.

For a while we ran a second virtual email server as an 'edge' server for both incoming and outgoing email on RackSpace. This changed the IP to one of RackSpace's and solved the blocked email problems. It also worked great as a front line against spam. All of the load of spam filtering hit the virtual server, and spared the server in the office.

In the end though, we gave up. We now use hosted RackSpace Exchange. This has proven to be much cheaper overall, and without all the other small email system headaches.