Slashdot Mirror
Ask Slashdot: How To Unblock Email From My Comcast-Hosted Server?
New submitter hawkbug writes For the past 15 years, I have hosted my own email server at home and it's been pretty painless. I had always used a local Denver ISP on a single static IP. Approximately two years ago, I switched to a faster connection, which now is hosted on Comcast. They provide me 5 static IPs and much faster speeds. It's a business connection with no ports blocked, etc. It has been mostly fine these last two years, with the occasional outage due to typical Comcast issues. About two weeks ago, I came across a serious issue. The following email services started rejecting all email from my server: Hotmail, Yahoo, and Gmail. I checked, and my IP is not on any real time blacklists for spammers, and I don't have any security issues. My mail server is not set as an open relay, and I use SPF records and pass all SPF tests. It appears that all three of those major email services started rejecting email from me based on a single condition: Comcast. I can understand the desire to limit spam — but here is the big problem: I have no way to combat this. With Gmail, I can instruct users to flag my emails as "not spam" because the emails actually go through, but simply end up in the spam folder. Yahoo and Hotmail on the other hand, just flat out reject the traffic at lower level. They send rejection notices back to my server that contain "tips" on how to make sure I'm not an open relay, causing spam, etc. Since I am not doing any of those things, I would expect some sort of option to have my IP whitelisted or verified. However, I can not find a single option to do so. The part that bugs me is that this happened two weeks ago with multiple major email services. Obviously, they are getting anti-spam policies from a central location of some kind. I don't know where. If I did, I could possibly go after the source and try to get my IP whitelisted. When I ask my other tech friends what they would do, they simply suggest changing ISPs. Nobody likes Comcast, but I don't have a choice here. I'm two years into a three-year contract. So, moving is not an option. Is there anything I can do to remedy this situation?
It's a business account, you should have a business support line.
It doesn't mean much now, it's built for the future.
I gave up trying to do this on Comcast and now host my email at Zoho. It's free for the few accounts I need. I now it may not work for everyone, but I got weary fighting those battles.
call Comcast, it sounds like it's a "their problem" problem.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
When the entire RoadRunner residential IP spaces were blocked, I just got a virtual server (now a Linode) and simply run that as my MX. Helps on inbound mail as well for any times my home connection goes down.. it'll queue up there. I use trusted certs for relaying from home and send mail via authenticated SMTP (TLS required) for mobile devices, via the same virtual host avoiding issues with connectivity to home (which was rare, but now I don't have to worry). I also have the connections between the VM and home box use a port other than 25 to avoid any blocking of port 25 by my ISP (which, for San Diego at least, hasn't happened in years).
It comes down to $20 a month for the size of vm I got (I also started using it for a few other things too). I also do my greylisting and other anti-spam measure there before it even tries to deliver to my server at home.
- My favorite error message: xscreensaver, running on an old Sparc 5 w/ 8bit color: bsod: Couldn't allocate color Blue
I'm guessing that even though you have static IPs Comcast has tagged the /24 (or higher) as DHCP. Most providers are now blocking consumer/business DHCP IP classes.
It's better to burn out than to fade away
Set Comcast's mail server as your outgoing smart relay in your MTA's config. The other mail systems will accept your mail if it comes through Comcast's server.
Use Mandrill as a mail relay.
I got mine setup through what is now Google Apps for Business while the bottom tier was still free. Their current cheapest pricing isn't bad if you don't have a lot of email addresses for what you're getting.
Stop trying to "fix" comcast. You can't. Find a provider that will act as a relay, which may even be Comcast. Then setup your mail server to relay the mail through that provider.
You can fix this problem in less than half a day.
I have had the same problem, and this is regardless of providers. Lists of dynamic IP ranges (be it cable, DSL, or other providers) wind up on DUL (dial-up lists), and those are often part of blackhole lists. Since most botnet clients are from DUL-based IPs, E-mail providers just block those as a matter of course.
What I did was have my private E-mail server use the SMTP server of my ISP for relaying. Problem fixed. However, if you don't have a SMTP server available that allows for different domains, there are commercial services which can relay your outgoing E-mail, which provides "legitimacy" to your messages.
The exception were direct Exchange connectors. Those were established from Exchange server to Exchange server, so mail would go directly via a secure pipe, and not be relayed.
I would get a VPS somewhere (e.g. linode) and install OpenVPN on it. Then VPN between there and your local machine, set up your incoming and outgoing connections to route through there, and update your DNS to point to the VPS. Net effect: you're still on Comcast, but the world sees you as being in some datacenter.
"Believe me!" -- Donald Trump
I am probably going to repeat things that you already know, but lets start at the basics.
1. Do you have a PTR/reverse DNS record set up? This has to be done by your ISP, and is not something that you generally do on your own. You generally want it to match the host name for your mail server, but it doesn't have to be a match (but it does look better). Be sure to have an A record for that hostname as well.
2. Are your MX records pointing to hostnames and not an IP address? Again, you probably are, but we are covering basics here.
3. Have you checked to see if you are on any blacklists? mxtoolbox.com and dnsstuff.com have some very good tools for checking these things. If you are on one, they often have pretty good instructions on how/why you are listed and what you need to do to get off of it.
FYI backscatterererererererererer is generally a pain to deal with, good luck if you have to deal with them, you will need it.
4. Are you(or any other users) forwarding any email to external mail services? We (unfortunately) have several of our clients who are forwarding email from their custom domain name to a yahoo/hotmail/aol (yes, it still exists) email account. The problem with this, is that when they get spam (that they signed up for, like newsletters and bargain alerts), and they forwards to their external account, it looks like our mail server is the one sending the spam, so we get the black mark.
5. This is the tough one.. are you absolutely sure you are not sending spam? You may need to go so far as to slap a sniffer on your network and see if you are sending out any other email. You may be infected with a virus, or you have an account with compromised credentials that are sending out email.
6. Are you running SSL/TLS (even though SSL 3 and TLS 1.0 are now dead) with a real (non self signed SSL cert) on your server? SSL certs can be gotten very cheap, $10 year, or possibly even cheaper. They are a minor pain to set up as they need intermediary certs set up, but helps to define that you are a legitimate email sender, rather than a PC with a virus.
You may be all of these steps, especially if you have been running your own mail sever for 15 years, but I posted these suggestions in the hopes that it may jar something loose.
Good Luck
If possible, I'd definitely host E-mail myself if I were running something bigger than a SOHO where hosted Exchange is my best bet.
First, I keep physical control of my Exchange mailboxes. Mail might be intercepted, but internal users that send and receive at the same domain are not going to be at the mercy of some nosy (or hacked) provider.
Second, I know how redundant and secure my E-mail system is. Ideally, I have an edge instance of Exchange for incoming stuff, which gets scanned and then passed to the an instance that runs as a hub. Then, I have another edge Exchange instance for outgoing E-mail, and yet another edge instance for ActiveSync and OWA. This isn't 100%, but it will at least give an intruder a fun time in getting to the juicy stuff, and the actual mailboxe servers are nestled well away from the outside world via firewalling.
Third, it doesn't take much to use a "legit" relay provider. I personally use Rackspace's Mailgun (although similar offerings are just as good or better.)
Of course, the downside is the infrastructure. Four copies of Exchange, Active Directory, a good firewall that supports DMZs, and the utilities it takes to back up mailboxes. However, this makes eDiscovery and other regulation compliance quite easy to deal with.
This is a tough choice. A cloud provider is better than services poorly run, but the best of all is a well run enterprise with company servers so the data has good physical control.
Your IP is likely listed on a Blacklist. My company firewall checks a half-dozen or so blacklists and automatically compares them to all incoming email. You need to find out which blacklist is listing your server public IP and contact the blacklist service directly. They can, after some verification process, remove you from the list. I just had this problem with emails coming from a vendor...turns out their IP(s) were blacklisted by one of my blacklist providers. It was mistaken, but it happened nonetheless. My vendor had to get themselves unlisted. I also removed that blacklist provider from my settings.
The correct answer is 42.
He's having problems with 3 services.
1. GMAIL - messages accepted but marked as spam.
2. YAHOO - messages rejected (what do the logs say?)
3. HOTMAIL - messages rejected (what do the logs say?)
So the first step is to look at the logs and see if the rejection message has any information in it. Do the rejection messages at YAHOO and HOTMAIL have the same code?
The next step is to check with a service like http://www.dnsgoodies.com/ to make sure that Comcast has configured their side correctly. The reverse DNS should point to your domain. You DO have a domain, right?
The more information you have before you contact Comcast, the better. Because the first 2 levels won't know anything about anything. They will be reading off of a script.
At the company I work at, I run several large high volume mass mailing servers that send million of messages a month (50 million last month). Here is what I recommend you do:
1) Get forward and reverse DNS setup and most importantly, the forward and reverse DNS information must match.
2) Set up and use DKIM for all outbound traffic.
3) Have the SPF information in your DNS records. Don't put your block of IP's in SPF record, just the one IP that you use for sending email. Make sure there is a "-all" in the records so that it makes it clear that all other email claiming to be you is discarded by other server.
4) You will need to setup Feed Back Loops and proper SWIP (If possible) contact information. You will need to go to the big 10 ISP's and submit the FBL information to them and get put on their White Lists. Don't lie to them, just tell them your personal email server that is having issues sending mail to them and you want to get on their White List. FBL's are usually for people who send high volumes of mail, include Newsletters and some "spammy" mail, but I find it helps regular mail servers if you set up FBL information.
Linux O Muerte!
Yeah fuck that. I can host my own mail just fine, thanks. Google owns enough of the world.
Greetings.
I have a Comcast Xfiniti Business line, 5 static IP addresses, etc. It sounds like our mutual set ups are equivalent. I've been running my email servers in my own domains since 1998, through some gone ISP, PacBell/AT&T, and Comcast without issues.
Contact the Comcast business line. Have your actual account ready -- you can get that from the Comcast Business web page for your account. Those numbers changed in the last 12 months to a shorter, simpler format. Request technical support and discuss the issue.
One thing that you MUST do if you want to run your own email: request that Comcast set reverse DNS to point at your servers for the non-authoritative request. A reverse DNS request to your IP address must return the name you use for your primary (and secondary, and so on) MX records. If that's set up, then you've solved 90% of the issues with Gmail and Yahoo!.
As far as Hotmail: they've been rejecting my email unless users white list my address(es) in their individual accounts. This has happened since Microsoft bought them. No way around that, and no appeals; every time I tried to contact them I might as well have sent the emails/requests through a black hole.
Source: 8+ years with Comcast Business, and I moved to a new location (with new IP addresses and new routers) 12 days ago. It took them 10 minutes to set the rDNS and propagate. Within an hour it was resolving fine and any lagging email issues were resolved (36 hours of some undelivered messages).
Google my name "Eugene Ciurana" and ping me through my contact page if you want some assistance with your set up and/or other tips w/dealing with Comcast. I've been a very happy customer with them (they fixed my lines, including physical cable modem replacement due to physical failure, while I was out of the country last January and coordinating with someone who could open the door to them and so on), and in general found that, if you explain what you need and why, their tech guys do work with you to solve issues. The key is understanding that *you* may know more about networking/server set up than their tech guys, so if you aren't specific about what you want they may not grok what you need.
Dear admins: WTF is a lameness filter? What is it filtering? I couldn't offer complete information to this guy because of the Comcast support number and/or IP addresses I listed. With my Karma level and the number of years I've been around, your system ought to be configured to let stuff through w/o issue. Look at my user ID. Thanks.
Cheers!
http://eugeneciurana.com | http://ciurana.eu
You're being blocked because any mail leaving Comcast's IP spaces is expected to come from Comcast's mailservers only.
Configure your mailserver with a "smarthost" option, have it deliver using Authenticated SMTP (with your Comcast account's username and password hardcoded, yes) over SSL on 465, or if you can't do SSL, use 587.
Source: Am currently running Postfix on Comcast successfully delivering to Yahoo Mail with no spamfolder problem via this method. (Am using SPF, no DomainKeys yet.)
More from Comcast on this: http://corporate.comcast.com/c...
o/~ Join us now and share the software