Help - Search - Members - Calendar
Full Version: rejected but not listed??
SpamCop Discussion > Discussions & Observations > SpamCop Blocklist Help
somebody emailed us and got their emails kicked back to them stating .........

(reason: 521 Mail rejected - you are listed in Spamcop (Spam) [FREE] -

the rejected IP is []

when i search spamcop, i get this message......... not listed in

i don't want to have to shut off spamcop at our mail server, can anyone explain why this is happening?

thank you

Cummings Printing
The IP ( is not listed.

Either you did not get the complete error message that included the correct IP or the server receiving/blocking the email is improperly set up or maybe it was listed and it is no longer listed.

You have not given enough evidence to see what was happening.

Post the entire block message.
I'll agree with Merlyn. Nothing on the SpamCopBL (though noting that it hasn't been real-time in ages) ... However, the next level of checks results in absolutely zero data at .... (This is a first for me)

A lookup comes back with;
10/18/04 15:21:16 IP block
Trying at ARIN
Trying 155.212.64 at ARIN

OrgName: Conversent Communications
NetType: Direct Allocation

OK, then going back and re-reading .. your system allegedly did the blocking based on
somebody emailed us and got their emails kicked back to them stating .........

So first of all, you should fix the error message to include the IP in question so the user can link directly to the "evidence" page. (this is also making the assumption that you've set up the DNSBL sequence correctly in whatever OS/Application you're running)

If this IP was once listed and now not, there was an issue discovered that some ISPs mirroring the database were not keeping in sync, but that issue hasn't been raised in quite a while.

How sure are you that the IP offered is correct? A typo might have all of us trying to research the wrong target here. As SenderBase has no knowledge of this IP/system as an e-mail server, there may be a suspicion that this belongs to some end-user with a compromised machine (the hitting spamtrap scenario) ....

Are you sure of your BL checking sequence? Another flag setting for some other reason, but using the SpamCopDNSBL error as the message line?
let me start by posting the whole message. (see below in green)

as for wazoo's suggestions, i don't know how to implement them. for example, i don't know how to change the spam filter rejection message on my mail server. and as for my bl checking sequence, i don't know how to see/edit that. not that i expect people here to explain it all to me, but i honestly didn't know i had control over those things. i run an email server software named '602 lan suite' which has a web interface configuration page that lists free spam filters (such as spamcop) and i simply check them off. i looked and can't find any further configuration options beyond checking and unchecking which spam filters you'd like to activate.


suggestions and instructions appreciated wink.gif


From: "Mail Delivery Subsystem" <MAILER-DAEMON[at]>
To: <mjsweeney[at]>
Subject: Returned mail: see transcript for details
Date: Mon, 18 Oct 2004 07:59:40 -0400
Message-ID: <200410181159.i9IBxeIN095910[at]>
MIME-Version: 1.0
Content-Type: multipart/mixed;
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300
X-Spam-Score: 0.421
X-Spam-Tests: SARE_BOUNDARY_09
Importance: Normal

This is a multi-part message in MIME format.

Content-Type: text/plain;
Content-Transfer-Encoding: 7bit

The original message was received at Mon, 18 Oct 2004 07:59:35 -0400 (EDT)
from []

----- The following addresses had permanent fatal errors -----
(reason: 521 Mail rejected - you are listed in Spamcop (Spam) [FREE] -

----- Transcript of session follows -----
... while talking to
>>> RCPT To:<kenw[at]>
<<< 521 Mail rejected - you are listed in Spamcop (Spam) [FREE] -
554 5.0.0 Service unavailable

Content-Type: message/delivery-status;
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;

Reporting-MTA: dns;
Received-From-MTA: DNS;
Arrival-Date: Mon, 18 Oct 2004 07:59:35 -0400 (EDT)

Final-Recipient: RFC822; kenw[at]
Action: failed
Status: 5.0.0
Remote-MTA: DNS;
Diagnostic-Code: SMTP; 521 Mail rejected - you are listed in Spamcop (Spam) [FREE] -
Last-Attempt-Date: Mon, 18 Oct 2004 07:59:40 -0400 (EDT)

Content-Type: message/rfc822
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment

From: "Michael Sweeney" <mjsweeney[at]>
To: "Kenneth J Warnock" <kenw[at]>
Subject: FW: MAILINGS 10/15/2004
Date: Mon, 18 Oct 2004 08:34:03 -0400
MIME-Version: 1.0
Content-Type: text/plain;
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300
Importance: Normal
I believe it is/was your server having the problem. A 521 error refers to the "Machine does not accept mail". Your server is not explaining it good enough.

The machine issued a 521 error and the problem with a 521 error is it does not stop/close the SMTP transaction and it keeps going so it finished it's testing and spewed out the Spamcop error by mistake.

Just a thought.
Strange... From what I can find the MX records for shows two mail servers: at and at and

These do show up in SenderBase shows a 475% increase in mail in the last 24 hours shows a 113% increase
.24 shows a -100%

None show up in the spamcop list or any other list for that matter. My uneducated guess would be that the mail program is returning an incorrect error message.
Yes but if you follow the flow. The 521 error was issued first and it blamed Spamcop but a 521 error is issued in the SMTP transaction stream before the host checks any blocklists. Most likely an error in how your mail host handles a 521.

I am sure others will check it out also <g> biggrin.gif
602 LanSuite - are you using the free 5-user version or are you able to hit them for support because you bought a bigger package? (if this is for the corporate staff/e-mail, I see that you must be out of the "free" status <g>) Have you hit their support forums at all yet? Is this server stand-alone or is it using your ISP for data transfer? It's been a while, but I think you are correct in that all you can do is check/uncheck the various BLs offered .. am thinking that you were limited to what they had programmed in, but again, it's been a while.

While doing some other research, out of curiosity, are your web pages also being hosted on this same 602 package? (looking at the strange place a trace-route died)
i'm not using the free version. i haven't hit their support forums yet. if that's where i should be, i'll try there too. i came here first because the reject said "you are in spamcop's bl" and then i checked and they weren't.

when merlyn talks about 521's and SPTP (i need SPTP for my bunghole! are you threatening me?..... sorry), that's where i get lost. dont get me wrong, i'm glad the discussion is happening, even if it's over my head. i'm getting the idea that the consensus is that i need to dig into 602 and get them looking at the problem, so i'm having the person who installed 602 come look at these posts in this thread and let me know what he thinks about it all. i'm sure he understands these posts and can help me understand them too. he also has an "in" with 602 and can rattle some cages if their software is handling things incorrectly.

thank you everyone for the help so far. if anyone has anything else to pitch in, please let me know. i'll pull out my and try to follow along best i can.

Strange .. your sample shows an e-mail coming from a Domain of, which offer contact points at erols/RCN ... (once?) home of the legendary AfterBurner and his Dominion of anti-spam zealots with big mallets ... still trying to work on the tie-in (the IP address of the e-mail sample source) ..... Also strange in that SenderBase is still showing no traffic seen from the specified IP address ... wondering if you might also get your customer in here also, there may be something he/she/they can offer as to how their e-mail configuration is actually setup that might offer a clue or two ..???? SpamCopDNSbl is still showing the IP as not listed.
Sorry mistyped I meant SMTP
Jeff G.
Upon further review (on the basis of cummings's similar new post at and the hostname of the server that sent the bounce above), the rejected server appears to have been, which currently has IP Address, is not currently listed by the SCBL, and has the following recent Report History:
Submitted: Thursday, June 23, 2005 09:45:28 -0400:
cut your monthly mortgage payment in half

    * 1452606320 ( ) To: mole[at]

Submitted: Wednesday, June 15, 2005 21:00:59 -0400:
You best friends and family deserve the BEST internet photo album!i

    * 1447919030 ( ) To: postmaster[at]
    * 1447919025 ( ) To: abuse[at]

Submitted: Wednesday, June 15, 2005 12:53:06 -0400:
Understanding OEM softwareC

    * 1447691476 ( http:// ) To:[at]
    * 1447691449 ( http:// ) To: abuse[at]
    * 1447691307 ( ) To: spamcop[at]
    * 1447691289 ( ) To: postmaster[at]
    * 1447691236 ( ) To: abuse[at]

Submitted: Wednesday, June 08, 2005 14:42:18 -0400:
Get your meds inexpensivelyXSPOFELHAZ

    * 1443435588 ( ) To: spamcop[at]
    * 1443435587 ( ) To: postmaster[at]
    * 1443435586 ( ) To: abuse[at]

Submitted: Saturday, June 04, 2005 12:29:34 -0400:
Fw: Its all about L?EVITRA nowMYKOYG

    * 1440287077 ( http:// ) To: mole[at]
    * 1440287073 ( ) To: mole[at]

Submitted: Saturday, June 04, 2005 12:28:36 -0400:
full service pharmac|y featuring over one thousand different d|rugsN

    * 1440286352 ( http:// ) To: mole[at]
    * 1440286351 ( ) To: mole[at]

Submitted: Friday, June 03, 2005 03:58:16 -0400:
0rder your dr%ugs here and get toll-free customer supportKLLU

    * 1439356175 ( ) To: postmaster[at]
    * 1439356160 ( ) To: abuse[at]

Submitted: Friday, June 03, 2005 03:55:57 -0400:
0rder your dr%ugs here and get toll-free customer supportKLLU

    * 1439349771 ( ) To: postmaster[at]
    * 1439349755 ( ) To: abuse[at]

Submitted: Friday, June 03, 2005 03:54:51 -0400:
0rder your dr%ugs here and get toll-free customer supportKLLU

    * 1439350672 ( ) To: postmaster[at]
    * 1439350664 ( ) To: abuse[at]

Submitted: Wednesday, June 01, 2005 10:11:51 -0400:
24/7 pharmac&yF

    * 1438008035 ( ) To: postmaster[at]
    * 1438008006 ( ) To: abuse[at]

Submitted: Tuesday, May 31, 2005 16:33:35 -0400:
Your order has been confirmedPNBZQOLEM

    * 1437423322 ( http:// ) To: mole[at]
    * 1437423268 ( ) To: mole[at]

Submitted: Tuesday, May 31, 2005 02:59:01 -0400:
Top 1000 popular pharmac{y dr]ugsMR

    * 1436927162 ( ) To: postmaster[at]
    * 1436927141 ( ) To: abuse[at]

Submitted: Monday, May 30, 2005 06:46:08 -0400:
Online pharma{cy skin care rx online: re[at]tin-a & r$enovaPHDZ

    * 1436283876 ( ) To: postmaster[at]
    * 1436283875 ( ) To: abuse[at]

Submitted: Sunday, May 29, 2005 06:10:33 -0400:
Fw: Its all about LE.VITRA nowFCTRSJV

    * 1435617694 ( ) To: postmaster[at]
    * 1435617693 ( ) To: abuse[at]

Submitted: Friday, May 27, 2005 18:58:22 -0400:
Top 1000 popular pha%rmacy dru*gsKI

    * 1434687708 ( ) To: abuse[at]
    * 1434687695 ( ) To: postmaster[at]

Submitted: Thursday, May 26, 2005 10:33:46 -0400:
Re your Pres-cription order #8754IZTZD

    * 1433617633 ( http:// ) To: mail-abuse[at]
    * 1433617626 ( http:// ) To: spambr[at]
    * 1433617614 ( ) To: spamcop[at]
    * 1433617605 ( ) To: postmaster[at]
    * 1433617583 ( ) To: abuse[at]

Submitted: Wednesday, May 25, 2005 23:04:06 -0400:
SPAM: full service )pharmacy featuring over one thousand different dr$ugsBQUR

    * 1433303683 ( http:// ) To: abuse[at]
    * 1433303681 ( http:// ) To: abuse[at]
    * 1433303671 ( http:// ) To: hostmaster[at]
    * 1433303663 ( ) To: spamcop[at]
    * 1433303659 ( ) To: postmaster[at]
    * 1433303644 ( ) To: abuse[at]

Submitted: Wednesday, May 25, 2005 05:47:03 -0400:
No more }pharmacy waiting linesGKQWH

    * 1432739712 ( http:// ) To: mail-abuse[at]
    * 1432739709 ( http:// ) To: spambr[at]
    * 1432739705 ( ) To: postmaster[at]
    * 1432739687 ( ) To: abuse[at]
Jeff G.
I added some explanation to my previous Reply above.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2014 Invision Power Services, Inc.