Help - Search - Members - Calendar
Full Version: Why is my mail server being blocked?
SpamCop Discussion > Discussions & Observations > SpamCop Blocklist Help
Pages: 1, 2
JohnnyB
My mail server is being blocked and the only reason that is listed is "email was sent to a spam trap".

My mail server is 142.77.1.111. Can someone please check it? The server belongs to an ISP so there are 1000's of people using it which means that ANYONE could have sent a spam.

Thanks in advance for any help!

JohnnyB
RFowler
I am on the same server and have the same problem.
RFowler
Anyone who can help us with this?

I talked to the ISP that owns this mail server (a very large North American telecom.... very large ..... HUGE) and they say that the people here at Spamcop are very uncooperative. Spamcop refuses to tell them what exactly is wrong with the server.

Why the heck would you set up this system and not have a mechanism in place to tell the ISP's how to fix any issues?????????

Is it not in everyone's best interest to fix these problems permanently???

I hate spam as much as the next guy but why am I (forget that,.... like origonal poster said..... thousands of us) having all mail blocked.

I have nothing nice to say about Spamcop, so I will say nothing else.

Please help me change my opinion.

Regards,
Wazoo
http://www.spamcop.net/w3m?action=checkblo...ip=142.77.1.111
142.77.1.111 listed in bl.spamcop.net (127.0.0.2)

If there are no reports of ongoing objectionable email from this system it will be delisted automatically in approximately 14 hours.

Causes of listing
System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop)
Additional potential problems

System administrator has already delisted this system once

Listing History
In the past 47.0 days, it has been listed 13 times for a total of 10.1 days
Other hosts in this "neighborhood" with spam reports
142.77.1.53 142.77.1.58 142.77.2.12 142.77.2.26

CODE
Report History:
--------------------------------------------------
Submitted: Thursday, September 21, 2006 11:14:26 PM -0500:
Undeliverable mail: general fewer
1932849642 ( 142.77.1.111 ) ( UUBE ) To: uube[at]devnull.spamcop.net
--------------------------------------------------
Submitted: Thursday, September 21, 2006 6:50:38 PM -0500:
WARNING. Mail Delayed: Get rid of the pounds you hate
1932600889 ( 142.77.1.111 ) ( UUBE ) To: uube[at]devnull.spamcop.net
----------------------------------------------------
Submitted: Thursday, September 21, 2006 6:39:17 PM -0500:
WARNING. Mail Delayed: Get rid of the pounds you hate
1932590046 ( 142.77.1.111 ) ( UUBE ) To: uube[at]devnull.spamcop.net
------------------------------------------------------
Submitted: Thursday, September 21, 2006 6:05:49 PM -0500:
WARNING. Mail Delayed: Obesity is dangerous, stop it
1932558590 ( 142.77.1.111 ) ( UUBE ) To: uube[at]devnull.spamcop.net
-------------------------------------------------------
Submitted: Thursday, September 21, 2006 5:55:19 PM -0500:
WARNING. Mail Delayed: Get rid of the pounds you hate
1932548680 ( 142.77.1.111 ) ( UUBE ) To: uube[at]devnull.spamcop.net
---------------------------------------------------------
Submitted: Wednesday, September 20, 2006 12:29:55 AM -0500:
Undeliverable mail: Cum splatter amateur girl
1929420593 ( 142.77.1.111 ) ( UUBE ) To: uube[at]devnull.spamcop.net

Time to read the SpamCop FAQ here folks ... starting with the "Why am I Blocked?" entry (which has also been separately Pinned)

Check the parts like "SpamCop.net cannot block your e-mail" .... "SpamCop.net does not recommend the use of the SpamCopDNSBL in a "blocking fashion" ... How to post a question .... .... on and on ....
QUOTE(RFowler @ Sep 22 2006, 02:03 PM) *
I have nothing nice to say about Spamcop, so I will say nothing else.

I really don't have much nice to say about folks that don't bother to do any research before posting either ...

uu.net was world renowoned for not doing much to control spam .. mci isn't much of an improvement ....
JohnnyB
Thanks for the info Wazoo!

I will look into the FAQs and the PINs as you suggest, but for the record our info is based on what MCI is telling us. We can't email and they can't tell us why Spamcop is blocking us so that gets fustrating as it is an ongoing thing.

I hope the spammer and found and flogged!! mad.gif

JohnnyB
Wazoo
QUOTE(JohnnyB @ Sep 22 2006, 02:59 PM) *
I will look into the FAQs and the PINs as you suggest, but for the record our info is based on what MCI is telling us. We can't email and they can't tell us why Spamcop is blocking us so that gets fustrating as it is an ongoing thing.

You will find that SpamCop.net cannot and does not block your e-mil .... any blocking you see is from an ISP that has chosen to use the data in the SpamCopDNSBL (assuming no other mistakes in thier e-mail server configuration) .. which isn't in line with SpamCop.net's recommendations to begin with .. the point is, you can send all the e-mail you want .. it's only when that e-mail ends up at one of these particulat ISPs that you will see this 'problem' .. noting that the decision of what traffic is allowed on that receiving ISP's servers is up to that ISP ....
RFowler
>>>delisted automatically in approximately 14 hours.


Why do you wait 14 hours to delist?

From what uunet/mci is telling me, you guys are the ones who lack communication.

Of course I am upset......... you are blocking legit email for dozens of companies.

I appreciate you posting some help. I did read it will be delisted in 14 hours before your post, I did my own research so please dont suggest I am negligent.

But just telling me that hundreds of my emails, everyone of them legit communication with people who want information from us, like tracking numbers, communication with suppliers.... emailing my father to set up a golf game .... yada yada. Nothing that would be considered spam by anybody.... are going to be blocked for 14 hours?

So we are dead in the water for 14 hours because you guys have a beef with uunet/mci and refuse to tell them what they need to do to fix the problem??????

If you contact me, I will give you the information for mci.

I am tired of this and have been dealing with it for quite some time.

All that being said, I really appreciate your quick post, I am just frustrated.

Sincerely,

Robert

>>>You will find that SpamCop.net cannot and does not block your e-mil .... any blocking you see is from an ISP that has chosen to use the data in the SpamCopDNSBL

I am completely aware of this, I dropped my ISP at home because they use spamcop and were very unhelpful in resolving the problem about 2 years ago.

Was this message board here back then?
StevenUnderwood
QUOTE(RFowler @ Sep 22 2006, 04:32 PM) *
But just telling me that hundreds of my emails, everyone of them legit communication with people who want information from us, like tracking numbers, communication with suppliers.... emailing my father to set up a golf game .... yada yada. Nothing that would be considered spam by anybody.... are going to be blocked for 14 hours?

That will only be true if every one of the recipients servers is implementing the spamcop bl on their end.

If hundreds are being blocked, then you must be sending 10000's (in my experience) or to a very limited number of domains.

Also, that counter continues to count down only until the next piece of spam hits the spamtrap, then it starts over again. MCI needs to clean up it's system and stop sending bounces to the forged email addresses in messages.

Information has been posted here about the kinds of messages being seen from the server you mentioned. ALL of it is undeliverables hitting innocent (spamtrap) mailboxes.
RFowler
>>>That will only be true if every one of the recipients servers is implementing the spamcop bl on their end.

Ok, hundreds may be an exageration.

But, yes we 25 people here sending a few to a dozen emails an hour.

Over the course of the year, yes hundreds of emails denied because of the ISP's of people at the other using spamcop.

Not hard to believe when you are a successful ecommerce company with 10's of thousands of customers.

p.s. when have not sent a newsletter, or had an email advertising campaign since year 2000, because we hate spam too
StevenUnderwood
QUOTE(RFowler @ Sep 22 2006, 04:32 PM) *
>>>delisted automatically in approximately 14 hours.
Why do you wait 14 hours to delist?

A spamcop listing is a point system. If you get x number of points, your are listed for y number of hours. If during that countdown more reports come in during that time, both numbers get bigger.

Everything MCI needs to know is really on this page:

http://www.spamcop.net/bl.shtml?142.77.1.111

The most common causes of blocking systems not intending to spam
RFowler
>>>MCI needs to clean up it's system and stop sending bounces to the forged email addresses in messages.


They told me it was an issue with bounces too.

Now we are getting somewhere.

How many bounces are we talking about?

I was under the impression that bounces can be used in a legit way, is that true?
Wazoo
QUOTE(RFowler @ Sep 22 2006, 03:32 PM) *
>>>delisted automatically in approximately 14 hours.
Why do you wait 14 hours to delist?

A SpamCop FAQ entry .... look for the Title "What is on the list?"
QUOTE
From what uunet/mci is telling me, you guys are the ones who lack communication.

Whatever .... note once again, this is primarily a user-to-user support venue.
QUOTE
Of course I am upset......... you are blocking legit email for dozens of companies.

Repeat .. I am blocking nothing of yours ....
QUOTE
But just telling me that hundreds of my emails, everyone of them legit communication with people who want information from us, like tracking numbers, communication with suppliers.... emailing my father to set up a golf game .... yada yada. Nothing that would be considered spam by anybody.... are going to be blocked for 14 hours?

???? Yet again, I am not blocking your e-mail .. SpamCop.net is not blocking your e-mail ....
QUOTE
So we are dead in the water for 14 hours because you guys have a beef with uunet/mci and refuse to tell them what they need to do to fix the problem??????

???? check the SpamCop FAQ, same reference as above .... spew stops, IP address gets de-listed, everybody happy (?)
QUOTE
If you contact me, I will give you the information for mci.

Trust me, I have dealt with them (and uu.net before) many times personally .... why you would have to provide the data isn't necessary .. data is available publicly all over the place ... now how to get ahold of someone with an actual clue ... that's not pibliched anywhere ...
QUOTE
I am completely aware of this, I dropped my ISP at home because they use spamcop and were very unhelpful in resolving the problem about 2 years ago.

Was this message board here back then?

yes .. the newsgroups pre-date the Forum and they are still available .... back then, there were more Deputies, there was more data available on reported stuff .... a lot has happened over those two years, to include spammers ruining all kinds of things .....
StevenUnderwood
QUOTE(RFowler @ Sep 22 2006, 04:46 PM) *

>>>MCI needs to clean up it's system and stop sending bounces to the forged email addresses in messages.
They told me it was an issue with bounces too.

Now we are getting somewhere.

How many bounces are we talking about?

I was under the impression that bounces can be used in a legit way, is that true?

Spamcops listing (x I was talking about earlier) is based on a percentage of messages seen throughout the internet. Spamcop has a number of domains around the world that keep track of the numbers of connections coming from each IP address. Basically, Spamcop uses that number as the denominator, with the number of reports being the numerator. There is acutally a weighting system as well where spamtrap's have a higher value because they should never receive any spam because the only way they are found is by scrapping web sites.

A large enough PERCENTAGE of messages coming from that server are either hitting spam traps or are being reported as spam to get it listed.

Bounces to the sender address after accepting and receiving the message used to be acceptable, until spammers ruined it. Right now, on the domain I manage, we receive ~80% spam, all of it with forged addresses. The only way not to abuse other peoples email systems is to not send those messages.

The best way to do that (IMHO) is to reject the message during the SMTP transaction using blocklists. That way the sender knows the message did not get through and can use an alternate means of commiunication. If the server accepts the message, it should only send a bounce message after the original has been scanned for being spam. This will not eliminate bounces, but will greatly cut down on the occurance of the wrong people getting the bounce. This method also means that a sender may not know that their message did not get through because no filter is 100% effective.

P.S. Almost alll of this is in the FAQ
Wazoo
QUOTE(RFowler @ Sep 22 2006, 03:46 PM) *
How many bounces are we talking about?

enough to tip the math to get the IP address(es) listed .. once again, this data is in the SpamCop FAQ
QUOTE
I was under the impression that bounces can be used in a legit way, is that true?

This was the normal, acceptable thing until a few years ago ... then spammers figured a 'new' way to use the "trusted user" model the 'net' was developed under and screwed things up for everybody.
RFowler
>>>A large enough PERCENTAGE of messages

How could you possible know what the percentage is?

Where would you get the total traffic from?

I realize you are not doing this personally and it is all done with an algo of some sort.

Once again, I really appreciate the feedback..... and I am thrilled you now have this forum for people stuck in my situation.
Telarin
senderbase.org is one of the largest email traffic monitoring firms there is, and from personal experience, I can tell you that there numbers are reasonably accurate, even for small servers.
RFowler
>>>reasonably accurate

reasonably???

so possibly wrong then

from senderbase (thanks for the link by the way)

Volume Statistics for this IP
Magnitude Vol Change vs. Average
Last day 4.6 -63%
Last 30 days 4.1 -89%
Average 5.1

What is magnitude mean?

Where on that page for this IP does it say what the volume is?
Telarin
Accurate enough to determine an approximate spam:ham ratio. Certainly not accurate to the individual message, but I would say for most shared servers at least 2 significant digits, which is more than enough for the purposes spamcop uses it for.

There are also a number of factors other than percentage that spamcop takes into account, such as prior listing history, frequency of reports, etc... Only the developers know the exact algorithms used.

There is a link on the page that explains exactly what magnitude is. It is basically a logarithmic scale. A magnitude of 4.6 would be aproximately 10^4.6 or 40,000 messages per day.
Wazoo
QUOTE(RFowler @ Sep 22 2006, 04:26 PM) *
>>>reasonably accurate

reasonably???

so possibly wrong then

.....
What is magnitude mean?

Where on that page for this IP does it say what the volume is?

http://forum.spamcop.net/scwik/SenderBase

From the SpamCop FAQ here .. look for the entry Titled: SenderBase Magnitude explained ...
Wazoo
Received via PM, but .... Section 8 - SpamCop's System & Active Staff User Guide .... not much I can offer, as I am not one of the paid employees ....
QUOTE
As the primary abuse contact for MCI Canada, I'd like to request some useful information as to exactly what is hitting your Spamtraps from the server at 142.77.1.111

I offered up just a small sampling in a previous posting here ... that was primarily spamtrap hit data ....
Having to go back a bit on 'reported' spam .. (configuration changed in the interim perhaps?) .. yet the Subject lines look awfully familiar ....
CODE
Report History:
---------------------------------------------------
Submitted: Thursday, September 07, 2006 10:48:31 PM -0500:
Undeliverable mail: Please read
1912232436 ( 142.77.1.111 ) To: spamcop[at]imaphost.com
1912232435 ( 142.77.1.111 ) To: abuse[at]ca.mci.com
-----------------------------------------------------
Submitted: Thursday, September 07, 2006 10:48:20 PM -0500:
Undeliverable mail: Please read
1912231431 ( 142.77.1.111 ) To: spamcop[at]imaphost.com
1912231420 ( 142.77.1.111 ) To: abuse[at]ca.mci.com
-------------------------------------------------------
Submitted: Monday, September 04, 2006 10:01:23 AM -0500:
WARNING. Mail Delayed: Please read
1906416224 ( 142.77.1.111 ) To: spamcop[at]imaphost.com
1906416212 ( 142.77.1.111 ) To: abuse[at]ca.mci.com
--------------------------------------------------------
Submitted: Monday, September 04, 2006 9:58:29 AM -0500:
WARNING. Mail Delayed: Please read
1906413839 ( 142.77.1.111 ) To: spamcop[at]imaphost.com
1906413819 ( 142.77.1.111 ) To: abuse[at]ca.mci.com
-------------------------

QUOTE
This system is configured as per SpamCop's recommendations. It 550 Rejects invalid users and will not bounce messages with the sole exception of User-selected Vacation messages (which don't bounce, but autorespond with the initial subject line. This is not spam). The latter is functionality required by our clients.

Something else is going on then, as neither the spamtrap hit data or the older reported stuff seems to jive with a flat-out rejection ....
QUOTE
SpamCop has repeatedly listed this while providing almost no information as to why, despite several requests. Here is essentially what you've given us.

The three Deputies already handle a self-admitted 800-1800 e-mails a day. But, only they have data beyond what has been posted here. There may be a question as to what was asked, how it was asked, did it come from a role account, things like that ....???
QUOTE
And via the deputies email you've provided 3 header snippets and nothing else. Which is hardly enough to determine a problem exists with MCI Canada's server config. From what little information has been provided MCI has been able to confirm that at least the last two header snippets were from Vacation Autoresponders, which cannot be used to relay UCE as they do not include the Body of the message, but only the Subject.

I have no idea what's being discussed 'here' .... my first 'evidence' post contained six items ....but the question remains as to how an "Out-of-Office" response could end up being directed to a spamtrap, other than the server "Replying" to an e-mail that was using a forged From: / Reply-To: address line .... which again, doesn't tie into the above description of "no bounces, etc."
QUOTE
Barring detailed information of abuse received that indicates messages other than vacation autoresponders, this MCI Canada server cannot be considered a source of UCE.

Should you be able to provide additional information, please forward it to me. I would distinctly like to prevent this system being listed in SpamCop's RBL for UCE.

Again, as a volunteer, I have no access to the data you're looking for other than what's already been posted here.

Typically, with a continuous stream of spamrap hits, usually the IP address wil also be picked up at http://psbl.surriel.com/ .. however ....
QUOTE
The PSBL database server is experiencing hardware problems. The database is being moved over to another system. Apologies for the inconvenience.

PM sent to advise of this response here ....
StevenUnderwood
QUOTE
This system is configured as per SpamCop's recommendations. It 550 Rejects invalid users and will not bounce messages with the sole exception of User-selected Vacation messages (which don't bounce, but autorespond with the initial subject line. This is not spam). The latter is functionality required by our clients.

I have just proven to myself this is NOT the case. Please explain this:

QUOTE
C:\Documents and Settings\Steven>telnet 142.77.1.111 25
220 mail.net ESMTP 5.0.1
helo underwood.spamcop.net
250 mail.net host name is unknown underwood.spamcop.net
mail from:<underwood[at]spamcop.net>
501 Incorrect Address Format (typo on my part)
mail from:<underwood[at]spamcop.net>
250 underwood[at]spamcop.net sender accepted
rcpt to:<12345tester67890[at]mci.com>
571 12345tester67890[at]mci.com Relaying denied (good)
rcpt to:<12345tester67890[at]ca.mci.com>
250 12345tester67890[at]ca.mci.com will relay to a client address(bad)
data
354 Enter mail, end with "." on a line by itself
This is a test. It should not end up at my spamcop address.
.
250 604636207 message accepted for delivery
quit
221 mail.net SMTP closing connection

Connection to host lost.

C:\Documents and Settings\Steven>


and worse: http://www.spamcop.net/sc?id=z1075979287z7...f5e5d69468c573z

I cancelled the report because I caused it, but the fact I received any message shows that if I had pput some other address in the place of my spamcop address, they would have received that bounce.

P.S. I am frustrated that I need to explain how to test a system to a company as large as MCI. Perhaps they should hire me as a consultant.
JohnnyB
One thing I know that the mail server does is it bounces messages back once a user's email box is full.

A support person at MCI told me a month ago that the service department had to make a change to the way the incoming and outgoing servers synced. This is what they said was causing the problem with the them being listed by SpamCop.

I have called a few of the companies that we are having problems sending emails to and talked to their IT people (monkeys I would prefer to call them) asking them to have us removed from the list. This was before reading the FAQs and discovering that the blocklist is just a guide for companies to use and that they can edit the list. Obviously these people are not reading any of the FAQs. mad.gif

I just hope a solution is found before we all go nuts... blink.gif

The idea of having in-house email is sounding better all the time.

I thank you guys for your input and I will keep reading the FAQs.

Thanks especially to the person who created this Forum!

JohnnyB
Telarin
When our company switched from ISP supported (I use the term very loosley) email to an in-house email server, all problems we had with BLs, etc, went away. A good rule of thumb is if your ISP tells you "we can't control what is on the blocklist" (and I'm not just referring to the spamcop blocklist here, they should be able to get problems fixed and their servers removed from almost any blocklist). Or if they tell you "We don't know what is wrong". Its a good sign it is time to shop for a new email provider, or to consider running your own mail server.

Anymore, you can pick up a copy of MS Small Business Server which includes Exchange, SQL, Fax Server, and a whole slew of other toys useful for a small business for something like $600 retail at most places that carry software. I do recommend that if you do this, you hire someone that is familiar with setting up Exchange, as even Exchange 2003 has a few "out-of-the-box" configuration errors that will need to be fixed or you will cause yourself problems. It even supports use of BLs (though only in a blocking fasion, not tagging).
AdamMaas
QUOTE

Received via PM, but .... Section 8 - SpamCop's System & Active Staff User Guide .... not much I can offer, as I am not one of the paid employees ....

I offered up just a small sampling in a previous posting here ... that was primarily spamtrap hit data ....
Having to go back a bit on 'reported' spam .. (configuration changed in the interim perhaps?) .. yet the Subject lines look awfully familiar ....
CODE
Report History:
---------------------------------------------------
Submitted: Thursday, September 07, 2006 10:48:31 PM -0500:
Undeliverable mail: Please read
1912232436 ( 142.77.1.111 ) To: spamcop[at]imaphost.com
1912232435 ( 142.77.1.111 ) To: abuse[at]ca.mci.com
-----------------------------------------------------
Submitted: Thursday, September 07, 2006 10:48:20 PM -0500:
Undeliverable mail: Please read
1912231431 ( 142.77.1.111 ) To: spamcop[at]imaphost.com
1912231420 ( 142.77.1.111 ) To: abuse[at]ca.mci.com
-------------------------------------------------------
Submitted: Monday, September 04, 2006 10:01:23 AM -0500:
WARNING. Mail Delayed: Please read
1906416224 ( 142.77.1.111 ) To: spamcop[at]imaphost.com
1906416212 ( 142.77.1.111 ) To: abuse[at]ca.mci.com
--------------------------------------------------------
Submitted: Monday, September 04, 2006 9:58:29 AM -0500:
WARNING. Mail Delayed: Please read
1906413839 ( 142.77.1.111 ) To: spamcop[at]imaphost.com
1906413819 ( 142.77.1.111 ) To: abuse[at]ca.mci.com
-------------------------


Something else is going on then, as neither the spamtrap hit data or the older reported stuff seems to jive with a flat-out rejection ....



As I noted, Out Of Office replies respond with the original Subject Line, which is not at odds with the data you've posted, but that doesn't make it spam.

QUOTE


The three Deputies already handle a self-admitted 800-1800 e-mails a day. But, only they have data beyond what has been posted here. There may be a question as to what was asked, how it was asked, did it come from a role account, things like that ....???



It came from my corporate email, with my .sig. I received some basic information, but not enough to determine whether or not an auto-responder was involved initially. Further investigation on MCI's side indicates that all three header snippets were almost assuredly from Vacation messages. They did not provide the requested Body information (which would NOT have compromised SpamCop's Spamtraps, but would indicate whether or not it was an Autoreply or actual spam). I tested this function myself to confirm that the body was not being included in the Autoreply.

QUOTE


I have no idea what's being discussed 'here' .... my first 'evidence' post contained six items ....but the question remains as to how an "Out-of-Office" response could end up being directed to a spamtrap, other than the server "Replying" to an e-mail that was using a forged From: / Reply-To: address line .... which again, doesn't tie into the above description of "no bounces, etc."



Read what I wrote again. The only way it could have happened is if said spam with a forged From: address hit a box set with an Out of Office autoreply. That is NOT a Bounce. And it is NOT UCE. Such Autoreplies are a required function of email for the Business World. If you are listing because of them, SpamCop needs to fix it's listing criteria. As this functionality cannot be used to spam anybody (Since the body isn't included in the Autoreply), and is required by MCI's clients for legitimate business reasons, MCI simply can't turn it off.

QUOTE


Again, as a volunteer, I have no access to the data you're looking for other than what's already been posted here.


Typically, with a continuous stream of spamrap hits, usually the IP address wil also be picked up at http://psbl.surriel.com/ .. however ....

PM sent to advise of this response here ....


142.77.1.111 is not listed at http://psbl.surriel.com/. It's not listed anywhere except SpamCop at last check (Friday, 22 Sept).

MCI is quite willing to fix our server if it is indeed broken. But SpamCop has not provided evidence that indicates that anything beyond an Autoreply is involved here. If SpamCop provides me with the necessary information which indicates an actual problem, I will get the system fixed.

Adam Maas
Internet Security Specialist
MCI Canada
adam.maas[at]ca.mci.com


QUOTE(StevenUnderwood @ Sep 22 2006, 08:20 PM) *

I have just proven to myself this is NOT the case. Please explain this:
and worse: http://www.spamcop.net/sc?id=z1075979287z7...f5e5d69468c573z

I cancelled the report because I caused it, but the fact I received any message shows that if I had pput some other address in the place of my spamcop address, they would have received that bounce.

P.S. I am frustrated that I need to explain how to test a system to a company as large as MCI. Perhaps they should hire me as a consultant.



Steven.

Thank you for this test. This has the information that I need, ca.mci.com is our local domain (and the domain the server lives in) and it appears that the server will relay (or bounce) for the local domains only. This could well be the issue that is causing the listings. This will be corrected. Once again, thank you, we had missed that possibility.
DavidT
Oy, what went wrong with the quoting in the previous post?

dt
Wazoo
QUOTE(DavidT @ Sep 25 2006, 09:43 AM) *
Oy, what went wrong with the quoting in the previous post?

Way too much quoted content included .... in the process, the number of [ q ] and [ / q ] don't match, so none of them got processed. had thoughts of editing it so it looked like someone knew what they were doing, but ... hard to get excited in helping someone after they've slapped me around, you know ???
AdamMaas
QUOTE(DavidT @ Sep 25 2006, 10:43 AM) *

Oy, what went wrong with the quoting in the previous post?

dt


I dropped an extra quote in there by accident and missed it when editing. Fixed.

Adam Maas
Internet Security Specialist
MCI Canada
agsteele
QUOTE(AdamMaas @ Sep 25 2006, 03:04 PM) *
The only way it could have happened is if said spam with a forged From: address hit a box set with an Out of Office autoreply. That is NOT a Bounce. And it is NOT UCE. Such Autoreplies are a required function of email for the Business World. If you are listing because of them, SpamCop needs to fix it's listing criteria. As this functionality cannot be used to spam anybody

Hi Adam!

You are right, in as much as many business people want to use Vacation/Out-of-Office messages. I think that there are many folk around who would query their value however.

Take my own experience... My Email address was forged by a spammer. The spam flood went out and in reply I received hundreds of vacation messages (sadly the spammer chose my address during the summer vacation period). So, as a result I had a mammoth task to address and our mail server had to handle the flood, we had to pay for bandwidth for the excess load etc. Each of these messages also carried the spammers advertising.

So it is a major problem. It can be addressed if the incoming flood of spam is stopped before arriving at the destination mailbox. That's why, I guess, many other ISPs like to use blocklists (including SpamCop's) to control the spew.

Andrew
AdamMaas
QUOTE(agsteele @ Sep 25 2006, 11:41 AM) *
You are right, in as much as many business people want to use Vacation/Out-of-Office messages. I think that there are many folk around who would query their value however.

Take my own experience... My Email address was forged by a spammer. The spam flood went out and in reply I received hundreds of vacation messages (sadly the spammer chose my address during the summer vacation period). So, as a result I had a mammoth task to address and our mail server had to handle the flood, we had to pay for bandwidth for the excess load etc. Each of these messages also carried the spammers advertising.

So it is a major problem. It can be addressed if the incoming flood of spam is stopped before arriving at the destination mailbox. That's why, I guess, many other ISPs like to use blocklists (including SpamCop's) to control the spew.

Andrew,

I do agree that it needs to be addressed. The first way is to ensure that only the actual vacation message is sent in the Autoreply (Sadly, less common than it should be, although MCI Canada does ensure this) which dissuades spammers from using that tactic to spam. The second is of course to prevent the spam from hitting the autoreplier in the first place, something that SpamCop seriously aids with, as do other solutions like Bayesian filtering.

I am a fan of the service that SpamCop supplies. While I've been somewhat aggressive in my post upthread, that's simply a case of frustration over not being able to get the information I need to solve the issue. Thankfully StevenUnderwood's post indicated a problem that had slipped by my testing and MCI is working from that angle.
StevenUnderwood
QUOTE(AdamMaas @ Sep 25 2006, 12:05 PM) *

Thankfully StevenUnderwood's post indicated a problem that had slipped by my testing and MCI is working from that angle.

BTW: My testing was not exhaustive as I had no idea what domains that server was supposed to accept. I found one that caused a problem, and stopped. You should of course verify for all domains.
RFowler
Unfortunately, the IP address in question here is once again ON THE SPAMCOP BLOCKLIST!!!!!!

However, I am glad to see that MCI and Spamcop are on the case.

Maybe now, we can get this problem solved forever.

Regards,

p.s. thanks Adam
DavidT
QUOTE(RFowler @ Sep 26 2006, 09:02 AM) *
Unfortunately, the IP address in question here is once again ON THE SPAMCOP BLOCKLIST!!!!!!

That's because it would appear that it's still sending crap to people who don't want it, whether those be "vacation messages" or not...here are two items reported by SpamCop users yesterday:

Submitted: Monday, September 25, 2006 9:28:44 AM -0700:
Undeliverable mail: Get rid of the pounds you hate

* 1937740131 ( 142.77.1.111 ) ( UUBE ) To: uube[at]devnull.spamcop.net

Submitted: Monday, September 25, 2006 7:38:55 AM -0700:
WARNING. Mail Delayed: Your 1oan Approval.

* 1937588034 ( 142.77.1.111 ) ( UUBE ) To: uube[at]devnull.spamcop.net

According to the SC system, it wasn't those reports that got the IP back into trouble, but rather spam trap hits (unless those UUBE items actually *do* correspond to spam trap hits, which I doubt, and which the powers-that-be haven't confirmed, have they?). Due to timing issues, it's possible that the issues have been resolved, but the SC reporting system states that "it will be delisted automatically in approximately 8 hours."

Mr. Mass can make all the distinctions he wants between o-o-o responses and UCE, but the messages are most certainly "unwanted" and as such, fall into the definition of spam, even if not into one of the more agregious categories. It appears that SpamCop has drawn a rather clear "line in the sand" regarding these messages, and many other "business-oriented" servers manage to stay off the SCBL....wonder what they're doing right?

DT
AdamMaas
QUOTE(DavidT @ Sep 26 2006, 01:34 PM) *

That's because it would appear that it's still sending crap to people who don't want it, whether those be "vacation messages" or not...here are two items reported by SpamCop users yesterday:

Submitted: Monday, September 25, 2006 9:28:44 AM -0700:
Undeliverable mail: Get rid of the pounds you hate

* 1937740131 ( 142.77.1.111 ) ( UUBE ) To: uube[at]devnull.spamcop.net

Submitted: Monday, September 25, 2006 7:38:55 AM -0700:
WARNING. Mail Delayed: Your 1oan Approval.

* 1937588034 ( 142.77.1.111 ) ( UUBE ) To: uube[at]devnull.spamcop.net

According to the SC system, it wasn't those reports that got the IP back into trouble, but rather spam trap hits (unless those UUBE items actually *do* correspond to spam trap hits, which I doubt, and which the powers-that-be haven't confirmed, have they?). Due to timing issues, it's possible that the issues have been resolved, but the SC reporting system states that "it will be delisted automatically in approximately 8 hours."

Mr. Mass can make all the distinctions he wants between o-o-o responses and UCE, but the messages are most certainly "unwanted" and as such, fall into the definition of spam, even if not into one of the more agregious categories. It appears that SpamCop has drawn a rather clear "line in the sand" regarding these messages, and many other "business-oriented" servers manage to stay off the SCBL....wonder what they're doing right?

DT


DavidT,

We currently have not closed the hole that Steven found, so this is likely the source of the bounces. The issue is being addressed but has proven somewhat more complicated than initially believed.

The Autoreply issue is most likely not the problem here, although it was the source of the hits that the Deputies provided to me.

Adam Maas
Internet Security Specialist
MCI Canada
DavidT
Thanks for your update, Adam. I *do* appreciate your willingness to engage here and work through this on behalf of your customers. The continuing battle against the ever-increasing onslaught of unwanted emails is something that we all care about here very much, and even though most of us are "end users," it's nice for admins to drop by and participate in the solutions.

DT
RFowler
>>>>Please do not write us to tell us that you have fixed the problem and ask for early delisting. The IP will delist automatically within 24 hours, if there are no new reports

That is the part of your FAQ that must really piss off people.

We are held hostage for 24 hours. Like the person who started this thread, he is dead in the water for a whole day.

....and constantly saying that it is not the fault of spamcop, and spamcop is not blocking email rings hollow when your business is screwed over for a day.

Extracted from the hikacked Topic/Discussion at http://forum.spamcop.net/forums/index.php?showtopic=7183 .... This post and the following have been split out from that Topic .. and seeing as how the previous Topic/Discussion that this poster started has been referenced a number of times, this split out stuff will be merged back into that existing Discussion ....
StevenUnderwood
QUOTE(RFowler @ Sep 28 2006, 10:43 AM) *

>>>>Please do not write us to tell us that you have fixed the problem and ask for early delisting. The IP will delist automatically within 24 hours, if there are no new reports

The server administrator can (if everything is setup properly), delist themselves after fixing the problem. They can only do this once, however, and too often the administrator tries to take the easy way out by delisting before fixing the problem.

THe 24 hours is there to be sure the problem is fixed. If more spam is reported as being sent within that 24 hours, the problem has NOT been fixed. And the 24 hours is a maximum.

At least the spamcop BL delists servers that are no longer spamming automatically. Some lists you will never get off of.
QUOTE(RFowler @ Sep 28 2006, 10:43 AM) *

....and constantly saying that it is not the fault of spamcop, and spamcop is not blocking email rings hollow when your business is screwed over for a day.
Well, the company I work for was being "screwed over" every day by ~80% spam (4400 out of 5700 total messages yesterday) before we started intercepting the garbage. You are known by the company you keep. The company you use to send your email is allowing spam to come from their servers. It is up to you whether to put up with it. It is them you should be complaining to.

In a typical setup, an email is created on your local machine and transferred to a mail server you are allowed to access. That mail server determines where to send the message, contacts that server, and transfer the message to be stored until the recipient picks it up. Nowhere in that scenario do you see spamcop able to intercept the message. It is the choice of the recipients server to use the spamcop list to help reduce the spam coming into the server.
Wazoo
QUOTE(RFowler @ Sep 28 2006, 09:43 AM) *
We are held hostage for 24 hours.

???? As stated, read more of the FAQ and toss some reality into the mix. "You" can send all the e-mail you want to. The SpamCopDNSBL only comes into play when you attempt to send any of that e-mail to an ISP that has chosen to use the data in the SpamCopDNSBL in a blocking fashion. This is not a 100% universal condition.

The "24 hours" is but one variable .. you seemed to have overlooked the word "within" and not played with the math involved at all ....

Putting your faith and trust into a system not guaranteed to work, world reknowned for "things going wrong" for the strangest of reasons ... kind of silly ...
QUOTE
Like the person who started this thread, he is dead in the water for a whole day.

On the other hand, it's actually hard to work up a whole lot of sympathy for a "business dead in the water" due to the spam-spew problems of a "free" ISP's lack of concern ..... yet also noting that the original poster's primary issue was already handled by using yet another 'free' e-mail service ....
QUOTE
....and constantly saying that it is not the fault of spamcop, and spamcop is not blocking email rings hollow when your business is screwed over for a day.

At this point, the only thing that seems to be valid ... get a clue .... data has been made available here, try to access it, then apply it ....
RFowler
>>>(4400 out of 5700 total messages yesterday) before we started intercepting the garbage. You are known by the company you keep.

You are not unique Mr. Underwood. We have the same problem here.

I block and delete the spam, it is not that great an issue.


I am known by the company I keep???????

I am on a mailserver with thousands of other companies, are you suggesting that I am to blame for spam because of some other unknown company? Or because MCI/UUNET (the backbone of the internet) made some error in the configuration of the mailserver?

We are somehow guilty by association?

This is the entire problem with spamcop. Instead of going after the root cause, spamcop lumps everybody together.
StevenUnderwood
QUOTE(RFowler @ Sep 28 2006, 12:02 PM) *

I am known by the company I keep???????

I am on a mailserver with thousands of other companies, are you suggesting that I am to blame for spam because of some other unknown company? Or because MCI/UUNET (the backbone of the internet) made some error in the configuration of the mailserver?

We are somehow guilty by association?

This is the entire problem with spamcop. Instead of going after the root cause, spamcop lumps everybody together.

If MCI/UUNET is providing your mail service, then yes, you are paying for the poor service you are getting. At one point, we used UUNET for our internet access (we run our ouw server) and left them when a large amount of the junk we were getting was from virus infected "neighbors" that they would not do anything about after many complaints.

It is not spamcop lumping everybody together. The provider has done that to make more money. If you want to be only affected by your own mail output, you need to have a dedicated IP for your mail. Spamcop only lists the IPs actually sending the spam. If a company has 100 mail servers, but only 1 is sending spam, only that IP address is listed. That server IS the root cause of the problem. There is nothing more granular that is not provided by the sender (i.e. easily forged).
RFowler
>>>If MCI/UUNET is providing your mail service, then yes, you are paying for the poor service you are getting.

Well, its not just the mailserver we use. Its dedicated web hosting and a T1 line too. We need to deal with a big player, not just a little ISP.

We do get good service.
StevenUnderwood
QUOTE(RFowler @ Sep 28 2006, 12:45 PM) *

We do get good service.

With the exception of your mail service being listed (1/3 of the services you list). If you get good service from them, ask them to fix the problem that keeps getting the server listed. Then you will have nothing to complain about and you will have helped the entire internet community.

You could get mail services from another source (including providing it yourself) while keeping your internet access and hosting with them. Then you wlll not be reliant on them keeping the server clean.

We get internet access from one company, have web hosting through another, and provide our own mail service employing another service for spam filtering.
RFowler
>>>If you get good service from them, ask them to fix the problem that keeps getting the server listed.

I think they are working on it now. It seems they did not have enough information before I brought this forum to their attention.

We can't switch. We have contracts in place. It could apparently (from reading this forum and doing research on spamcop in the web) happen to just about anyone.
StevenUnderwood
QUOTE(RFowler @ Sep 28 2006, 01:00 PM) *

We can't switch. We have contracts in place.

You need better lawyers looking at your contracts before you sign them.

Ours always add an out clause for not providing the service contracted.

QUOTE(RFowler @ Sep 28 2006, 01:00 PM) *

It could apparently (from reading this forum and doing research on spamcop in the web) happen to just about anyone.

Multiple or lenghthy listings can happen to anyone using a shared server where the administrator is not paying attention.
DavidT
QUOTE(RFowler @ Sep 28 2006, 10:00 AM) *
It could apparently (from reading this forum and doing research on spamcop in the web) happen to just about anyone.

...and lightning could strike "just about anyone" but that's far more likely if they're doing something stupid like standing out on a golf course or not taking appropriate precautions.

But seriously, if servers are properly configured and managed, then it's FAR less likely. The IP from which all of my hosted domains transmit email doesn't have so much as a *single* report hit in the SpamCop report database, so it's quite possible to "live clean" as far as SpamCop goes.

DT
RFowler
>>>You need better lawyers looking at your contracts before you sign them.


We don't want out of the contracts.

There is just one problem with MCI, and that is spamcop. That problem may be fixed, we will see.

I think you are a little obsessed with spam my friend.
StevenUnderwood
QUOTE(RFowler @ Sep 28 2006, 02:46 PM) *

I think you are a little obsessed with spam my friend.

I have seen the increased productivity when there is not a ton of spam to wade through on a daily basis both at work and at home.

At work, I actually get support calls about once a month when a single spam gets through asking what is wrong.

At home, I have reduced the spam I see in my inbox from about 125-150 per day before using spamcop to a couple a week simply adding spamcop email service into the mix to maybe one per month by dropping my most spammed account (which I held for ~12 years) and using primarily spamcop addresses.
RFowler
Ok, sure you are getting a lot less spam. But you are likely missing some real email too.

Here is some of the FAQ:

Q: Why me? A: It Happens to the best of us
It is annoying to have your email blocked. It is also annoying to have a backhoe interrupt email service.

However, until the blocking problem is resolved, you can email people through a web based email service (the most familiar web based email services are hotmail and yahoo).

After you have taken care of the immediate problem of being able to communicate with someone by email, the next step is to see what can be done so this inconvenience does not happen to you again.

The one thing you do not want to do is to complain to those correspondents who are using an email service that uses the SpamCop blocklist. They probably really like the reduction in spam!
--------------------------------------------------------------

That first line about the backhoe is a odd thing to say. It does nothing to help somebody who is blocked. Imagine how frustrating it would be to read that?

The last point is very self serving. Maybe complaining is a good idea because if they do not hear the complaint they will not look for a better block list.

That is my BIG PROBLEM with spamcop. You are likely blocking more real email than you are blocking spam. Have you ever considered that? It is the old "throwing out the baby with the bathwater" approach to spam.
Telarin
Spamcop lists IP addresses based on certain criteria. They are not going to change those criteria because you don't like them. The spamcop BL is NOT intended to be used for blocking by itself, in fact, spamcop itself recommends against that configuration. However, they have absolutely no control whatsoever over how an ISP chooses to use the list. If you have a problem with the way the SCBL is being used or misused, the people to complain to would be either:

A) The owner of the receiving server that is misusing the list of IP addresses,

or B ) The owner of the sending server that has allowed a misconfiguration or mismanagement issue to get it listed on the SCBL.

The thing not to do is come here simply to complain. It accomplishes absolutely nothing other than wasting your and others time. There is nothing anyone here can or wants to do to change the way the SCBL works. For what we use it for, it works exactly as expected and intended. We understand what gets listed (per the spamcop FAQ). We understand the pros and cons of using the list in a blocking manner versus a tagging manner. In fact, believe it or not, that very discussion has been had on this forum many many times. If you want to understand how and why the SCBL works, you might want to go back and read some of those many discussions.
StevenUnderwood
QUOTE(RFowler @ Sep 28 2006, 03:46 PM) *

Ok, sure you are getting a lot less spam. But you are likely missing some real email too.

I am not.

Work: I would prefer to be using a blocklist here because then the sender would know the message did not get through, but that was not my decision. At first, I scanned my Held Mail folder regularly and never found a valid message there. I check it a lot less frequently now. I have nobody in my personal whitelist. There are a couple of entries in our company-wide whitelist for major customers who have had problems getting through.

Home: I check my Held mail folder every time I check my Inbox (several times a day) and report that which is spam. I do have a few whitelisted addresses from when I have found messages in the Held mail folder.

I think it much more important to notify the sending party that there is a problem with delivery. That is why I support blocklists in general and the spamcop blocklist in particular. I found spamcop when searching for something I could do about spam as it was increasing (about 3-4 years ago now) and liked the fact that it attempts to list hosts while the spam is being sent and automatically stops the listing when the spam has stopped for a number of hours. I also liked that they send reports to the responsible ISP to alert them about the spamming.

The line about the backhoe is meant to indicate that email is not now, and never has been a service that can guarantee delivery of the message. Any server can drop the message at any time without notification. There is a member here who tells a story of msn email being delayed by months because of a hardware failure where the machine, with its mail queue, was removed from service for a while. When the machine was returned to service, it delivered those messages queued months earlier.
Wazoo
QUOTE(StevenUnderwood @ Sep 28 2006, 03:17 PM) *
There is a member here who tells a story of msn email being delayed by months because of a hardware failure where the machine, with its mail queue, was removed from service for a while. When the machine was returned to service, it delivered those messages queued months earlier.

The 'glory' days of having a (U.S.) @Home account .... before it disappeared, I believe the contest winner of having the 'oldest e-mail delived /today/' came in with something like 14 months betwqeen the time it was accepted at an @Home server and the day it was 'delivered' ..... my 'best' was only 11 months delay ....
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2009 Invision Power Services, Inc.