Blacklisted but not sure if problem is GoDaddy or Roadrunner

[barbiegal7 0]

I have been reading the forums for a couple of hours, so I hope I'm doing this correctly. I had surgery last week so I was slow on the uptake that I had stopped getting emails through my domain. The email is amazon[at]bgalcostumes.com and I use it strictly to receive orders and customer service emails through my Amazon seller account. I also use sales[at]bgalcostumes.com for web site requests and sales which is also bouncing; however, I realized anything [at]bgalcostumes.com is getting the bounce.

All of my [at]bgalcostumes.com get forwarded to my Roadrunner account. I don't access them directly. My Roadrunner email that collects them is working just fine, but anytime I try to send to the [at]bgalcostumes.com domain, I get the bounce. The domain is hosted through GoDaddy, and I found this topic:

http://forum.spamcop.net/forums/index.php?...&hl=godaddy

but can't really determine if it has anything to do with it.

According to the link, abuse[at]rr.com is the problem, so I'm assuming GoDaddy has nothing to do with it, but not sure.

I got a new computer last Tuesday from Best Buy, and the emails worked for awhile that day but then stopped. I ran Malwarebytes and received no errors. I don't use any mailing lists or send out anything to customers except responses to their questions. I used whatismyispaddress.com and found I am on two other lists. As of today, Spamcop says I am no longer on the BL, but I am still getting the bounces.

I have sent an email to Roadrunner as well and awaiting a reply.

-----Original Message-----

From: Mail Delivery System [mailto:Mail Delivery System]

Sent: Tuesday, July 31, 2012 4:57 PM

To: bgalwigs[at]roadrunner.com

Subject: Mail Delivery Failure

This message was created automatically by the mail system (ecelerity).

A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed:

>>> amazon[at]bgalcostumes.com (reading BANNER): 554 5.7.1 Service

>>> unavailable; Client host [75.180.132.120] blocked using

>>> urbl.hostedemail.com;

>>> http://www.spamcop.net/w3m?action=checkblo...=75.180.132.120

HEADERS:

Return-Path: <>

Received: from cdptpa-mxlb.mail.rr.com ([10.127.255.88])

by cdptpa-imta04.mail.rr.com with ESMTP

id <20120731235721174.PBGR12052[at]cdptpa-imta04.mail.rr.com>

for <bgalwigs[at]roadrunner.com>; Tue, 31 Jul 2012 23:57:21 +0000

Return-Path: <>

X-Cloudmark-Score: 0

X-RR-Connecting-IP: 10.127.120.51

Received: from [10.127.120.51] ([10.127.120.51:37382] helo=cdptpa-omtalb.mail.rr.com)

by cdptpa-iedge07.mail.rr.com (envelope-from <>)

(ecelerity 2.2.3.46 r()) with ESMTP

id 31/68-17744-1E078105; Tue, 31 Jul 2012 23:57:21 +0000

Received: from [127.0.0.1] ([local])

by cdptpa-omtalb.mail.rr.com (envelope-from <>)

(ecelerity 2.2.3.46 r()) with INTERNAL

id C4/F6-29356-1E078105; Tue, 31 Jul 2012 23:57:21 +0000

From: Mail Delivery System <>

To: bgalwigs[at]roadrunner.com

Subject: Mail Delivery Failure

Message-ID: <C4.F6.29356.1E078105[at]cdptpa-omtalb.mail.rr.com>

MIME-Version: 1.0

Content-Type: multipart/report; report-type=delivery-status;

boundary="E+1lPT0ueEOgeivgWVi8RQnyd5ySSgGLbotB1g=="

Date: Tue, 31 Jul 2012 23:57:21 +0000

I hope this was enough info.

[turetzsr 0]

Hi, barbiegal7!

...Wow, I think you did a very good, even "above and beyond," research job -- thank you very much for taking that time, especially so soon after your surgery!

...The key element in the information you provided is "http://www.spamcop.net/w3m?action=checkblo...=75.180.132.120." If the rejecting site is properly reflecting the problem, it is, indeed, Road Runner. I presume you got to that by following the link and clicking the "Trace IP" link that was offered -- that was exactly correct. If you also look at the page provided by clicking the "SenderBase Lookup" link, you will see that there are quite a few Road Runner servers that are blacklisted by various blacklists (hover over the text beneath the "DNSBL Listings" heading on each line).

...That you are still getting the bounces may reflect that the bouncing server is either not refreshing their copy of the SpamCop blacklist regularly (it changes constantly) or are not reflecting the latest information in the blacklist but rather "caching" the list it is rejecting. If you have an alternate means of contact, the person/ people to whom you are trying to send the e-mail might be advised to contact their service provider and request that they ensure their bounces reflect the current state of the SpamCop blacklist and that they whitelist you, if that service is offered, so that your e-mails do not get bounced while you work out this problem with Road Runner from your end.

...If you have any further questions about this (or anything else), please don't hesitate to post a follow-up here.

...Good luck!

[Derek T 0]

I got a new computer last Tuesday from Best Buy, and the emails worked for awhile that day but then stopped. I ran Malwarebytes and received no errors. I don't use any mailing lists or send out anything to customers except responses to their questions. I used whatismyispaddress.com and found I am on two other lists. As of today, Spamcop says I am no longer on the BL, but I am still getting the bounces.

May I echo Steve's appreciation of the work you have done.

Unfortunately that IP is back on the blacklist (0718 UTC). That IP is shared with many other RR customers so you are, in all likelihood, an 'innocent bystander'.

Not clear from what you wrote who actually gets your $USs. Whoever it is, that's whose case you should be on as they are not providing the service you are paying for

[barbiegal7 0]

Thank you, guys! I really wanted to do my homework as well as I could (I'm not too savvy at all this!) so I could get any help you experts could provide.

What's so strange to me is I have five direct roadrunner emails that are all working just fine. It's just those [at]bgalcostumes.com emails that I have forwarded to my [at]roadrunner.com email that are being blocked. So should I assume my direct Roadrunner emails have a different IP address than emails that are forwarded to me? Sorry if that's a dumb question.

I have not heard back from Roadrunner yet so may have to try to find a number to call. If I am, as you say, an "innocent bystander," is there any hope of getting off the BL?

Thank you for all your help! Oh, and my ISP is Roadrunner, though I do pay GoDaddy for that domain, but since the reports seem to be going to abuse[at]rr.com, then clearly, my beef is with Roadrunner. Argh.

Edited August 2, 2012 by barbiegal7

[Farelf 0]

Your [at]bgalcostumes.com mail goes through mx.b.hostedemail.com (64.98.36.4) which you share with 100 or more other domains but is clean and which sometimes doesn't want to hear from cdptpa-omtalb.mail.rr.com (75.180.132.120) which is not always clean (not all the time anyway - but mostly). Since your mail through [at]bgalcostumes.com evidently goes via cdptpa-omtalb.mail.rr.com some or all of the time (shared by goodness knows how many), that is a problem. Your problems should only be one-way: rr.com -> bgalcostumes.com/hostedemail.com.

Other business users on the forum may be able to suggest solutions to this little dilemma but it would seem to me that either

• you want a more dedicated service out of your premises, one you're not sharing with other rr users who are pumping out 3 million messages or more each day through that one cdptpa-omtalb.mail.rr.com server.
  
• you want hostedemail.com to give your rr messages a free pass through (whitelist them).
  

The first case would almost certainly mean more $$ - a static IP address that only you use - or some other premium/business-level solution as opposed to the "consumer-level" service it appears you currently have. Well - if it's already supposed to be a business-level service from rr.com you certainly have a beef with them (or with godaddy as reseller) because their server which you use(d) is very high-volume and probably impossible to keep 99% clean (or whatever the tolerance).

The second case, I don't even know is possible, hostedemail.com can't be expected to keep their servers clean if they give "free passes", they would probably have to look at a dedicated server for you and that would involve more $$ than might be justified by the business need. But, who knows? - your non-spamming credentials from hostedemail's viewpoint must look good - the domain bgalcostumes.com is not listed in either URIBL.com or SURBL.org blacklists.

Tools used in looking at the above, if they are of interest:

http://www.ipaddresslocation.org/email_lookup/check-email.php

http://centralops.net/co/DomainDossier.aspx

http://www.robtex.com/

http://multirbl.valli.org/lookup/

http://www.senderbase.org/

https://uribl.com/

http://www.surbl.org/

Edited August 2, 2012 by Farelf

[turetzsr 0]

<snip>

it would seem to me that either

• you want a more dedicated service out of your premises, one you're not sharing with other rr users who are pumping out 3 million messages or more each day through that one cdptpa-omtalb.mail.rr.com server.
  
• you want hostedemail.com to give your rr messages a free pass through (whitelist them).
  

The first case would almost certainly mean more $$ - a static IP address that only you use - or some other premium/business-level solution as opposed to the "consumer-level" service it appears you currently have. Well - if it's already supposed to be a business-level service from rr.com you certainly have a beef with them (or with godaddy as reseller) because their server which you use(d) is very high-volume and probably impossible to keep 99% clean (or whatever the tolerance).

The second case, I don't even know is possible, hostedemail.com can't be expected to keep their servers clean if they give "free passes", they would probably have to look at a dedicated server for you and that would involve more $$ than might be justified by the business need.

<snip>

... <blink> Were I barbiegal and were spending money, any money, for my e-mail service, I would not accept this, unless her contract with RR clearly allows them to be lackadaisical in its control of spam going out from the same servers through which hers is routed. If RR can't route my e-mail through one or more of their many servers that do not have this problem, I would move my business to a comparable provider that cares more.

[barbiegal7 0]

Thank you, Farelf, for your reply; unfortunately, I am not even close to being a big enough business to warrant a dedicated server. What's so strange is that I've had those [at]bgalcostumes.com emails being forwarded to me since 2007 and never had a minute's trouble. It just started a week ago, and I have no idea why.

What I'm afraid of is Roadrunner is ignoring me because, as far as their concerned, my main Roadrunner email addresses are working just fine. Anything coming from another email being forwarded is not their concern. If I try to go to GoDaddy, they are probably going to say that it's not THEIR issue since I can access the messages through web mail, like Hotmail or GMail, so if I can't get them through Roadrunner, then it's THEIR problem.

I'm starting to think I'm screwed other than just getting another ISP all together, and that's a pain in the arse, too.

If I'm going to approach Roadrunner about this, any thoughts on WHAT I should say to get them to realize that this is a RR problem, even though it's about forwarded addresses?

[turetzsr 0]

<snip>

If I'm going to approach Roadrunner about this, any thoughts on WHAT I should say to get them to realize that this is a RR problem, even though it's about forwarded addresses?

...Seems that the following three pieces of evidence together point clearly to RR:

• {copied from your original post, above 82328[/snapback]} A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed:
  >>> amazon[at]bgalcostumes.com (reading BANNER): 554 5.7.1 Service
  >>> unavailable; Client host [75.180.132.120] blocked using
  >>> urbl.hostedemail.com;
  >>> <a href="http://www.spamcop.net/w3m?action=checkblo...=75.180.132.120" target="_blank">http://www.spamcop.net/w3m?action=checkblo...=75.180.132.120</a>
  
• http://www.spamcop.net/sc?track=75.180.132.120:

  SpamCop v 4.6.2.001 © 1992-2012 Cisco Systems, Inc. All rights reserved.
  Parsing input: 75.180.132.120
  Reporting addresses:
  abuse[at]rr.com

• ping -n 1 -a 75.180.132.120

  Pinging cdptpa-omtalb.mail.rr.com [75.180.132.120] with 32 bytes of data:
  Reply from 75.180.132.120: bytes=32 time=82ms TTL=47
  Ping statistics for 75.180.132.120:
  Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
  Approximate round trip times in milli-seconds:
  Minimum = 82ms, Maximum = 82ms, Average = 82ms

...There is the possibility that one or two or all of these, especially the first, are incorrect but we can't tell readily tell that from here and so have to assume they are correct.

[Farelf 0]

...What's so strange is that I've had those [at]bgalcostumes.com emails being forwarded to me since 2007 and never had a minute's trouble. It just started a week ago, and I have no idea why. ...

Well you see that's where I get lost. On the evidence presented (and the research confirms it) the only blocking going on would be RR e-mails being blocked by bgalcostumes' mail exchange. Roadrunner is not having a problem with messages from bgalcostumes/hostedemail, it is the other way around. Anyways ...

That RR server cdptpa-omtalb.mail.rr.com (75.180.132.120) which was blocked by hostedemail.com (your bgalcostumes.com mail exchange host) certainly has appeared on the SCbl a few times. Recent report history you can throw at RR is listed below** (note they already know all about it - or they ignore the reports, their choice).

Steve T is a little more critical of RR than am I - 17 spam hits (as listed) out of maybe 9,000,000 messages transiting the server during the 3 days extracted is some 0.02% spam which is a low incidence - and it hasn't even dented the "Good" SenderBase reputation score of that server as further evidence of that.

You don't need to be on a cleaner server, you need to be on one just as clean but with less throughput so that the low spam incidence (fairly well unavoidable/to be expected with any "consumer-grade" ISP I would say), when it trips the SpamCop block list hair-trigger, only does so very occasionally. Alternatively/also, hostedmail should stop using the SCbl contrary to SC recommendations - but they are doing that with a purpose so they're not about to change, I guess.

**Reports

Submitted: Thursday, 2 August 2012 10:52:27 AM +0800:

re: Fwd:

5818280311 ( 75.180.132.120 ) To: abuse[at]rr.com

Submitted: Thursday, 2 August 2012 6:30:10 AM +0800:

re: re:

5818182528 ( 75.180.132.120 ) To: abuse[at]rr.com

Submitted: Thursday, 2 August 2012 6:15:03 AM +0800:

Re: RE:

5818174082 ( 75.180.132.120 ) To: abuse[at]rr.com

Submitted: Wednesday, 1 August 2012 10:43:10 PM +0800:

You have been sent an e'Card

5817927889 ( 75.180.132.120 ) To: abuse[at]rr.com

Submitted: Wednesday, 1 August 2012 8:05:45 PM +0800:

How To Regenerate And Revitalize Your Skin!

5817834110 ( 75.180.132.120 ) To: abuse[at]rr.com

Submitted: Wednesday, 1 August 2012 7:21:26 PM +0800:

Best Way To Regenerate And Revitalize Your Skin!

5817813555 ( 75.180.132.120 ) To: abuse[at]rr.com

Submitted: Wednesday, 1 August 2012 6:04:55 PM +0800:

ChristianSingles! You still single? You won't be for long!

5817774290 ( 75.180.132.120 ) To: abuse[at]rr.com

Submitted: Wednesday, 1 August 2012 12:13:06 PM +0800:

You have been sent an e'Card

5817571033 ( 75.180.132.120 ) To: abuse[at]rr.com

Submitted: Wednesday, 1 August 2012 11:57:47 AM +0800:

Someone has a Crush-on you

5817564237 ( 75.180.132.120 ) To: abuse[at]rr.com

Submitted: Tuesday, 31 July 2012 11:33:09 PM +0800:

RE: re:

5817222370 ( 75.180.132.120 ) To: abuse[at]rr.com

Submitted: Tuesday, 31 July 2012 10:24:14 AM +0800:

Someone has a Crush-on you

5816986909 ( 75.180.132.120 ) To: abuse[at]rr.com

Submitted: Tuesday, 31 July 2012 7:38:38 AM +0800:

[Norton AntiSpam] [spam] Kerry Stevenson want to suck some YOUR LOLLIPOP

5816898194 ( 75.180.132.120 ) To: abuse[at]rr.com

Submitted: Tuesday, 31 July 2012 7:19:08 AM +0800:

Fwd: re:

5816891324 ( 75.180.132.120 ) To: abuse[at]rr.com

Submitted: Tuesday, 31 July 2012 6:09:08 AM +0800:

You have been sent an e'Card

5816872231 ( 75.180.132.120 ) To: abuse[at]rr.com

Submitted: Tuesday, 31 July 2012 6:08:12 AM +0800:

You have been sent an e'Card

5816872551 ( 75.180.132.120 ) To: abuse[at]rr.com

Submitted: Tuesday, 31 July 2012 5:48:49 AM +0800:

Re: Hi!

5816866472 ( 75.180.132.120 ) To: abuse[at]rr.com

Submitted: Tuesday, 31 July 2012 5:41:14 AM +0800:

I'm a bit embarrassed to tell you this, but....

5816864488 ( 75.180.132.120 ) To: abuse[at]rr.com

[turetzsr 0]

<snip>

You don't need to be on a cleaner server, you need to be on one just as clean but with less throughput so that the low spam incidence (fairly well unavoidable/to be expected with any "consumer-grade" ISP I would say), when it trips the SpamCop block list hair-trigger, only does so very occasionally.

<snip>

...Huh? I thought that a server with a low total throughput and the same incidence of spam among that total throughput (in other words, where spam is a higher percentage of the total e-mail volume) would trip the threshold more often, not less! Did you mistype or is SpamCop's criteria counter-intuitive?

[Farelf 0]

...Huh? I thought that a server with a low total throughput and the same incidence of spam among that total throughput (in other words, where spam is a higher percentage of the total e-mail volume) would trip the threshold more often, not less! Did you mistype or is SpamCop's criteria counter-intuitive?

The "incidence" I was talking about is the proportional rate Steve - "some 0.02% spam which is a low incidence". 0.02% of a lower volume means less reports - or no reports at all for some periods of time since spam distribution over a controlled network on the small scale is (probably) not uniform (Poisson distribution maybe, but I digress).

Is this one of those "two peoples divided by a common language" things?

[SpamCopAdmin 0]

75.180.132.120 = cdptpa-omtalb.mail.rr.com is not currently on our list. It has been going on and off our list for about a week. It has been about 31 hours since the last spam was delivered. I don't know why the spam stopped.

The bottom line here is that anyone whose email is being handled by that server needs to complain to Road Runner every time they get a rejection email.

- Don D'Minion - SpamCop Admin -

- Service[at]Admin.SpamCop.net -

.

[Farelf 0]

Sorry, I've been obscure without meaning to be. No intention to appear contrary to Steve's or Don's advice.

Have assumed (taken as a given) that complaint should indeed be made to RR but trying particularly to point out re-listing can recur and is more likely than not with servers/hosts of such high capacity as that apparently provided to the O/P by RR. A different environment is indicated for a business user, to make disruption less likely. RR may be able to offer a less hectic server - a dedicated one is ideal but may be out of reach.

Also, still not clear to me that blocking is the the whole of the O/P's problem. Forwarding from her website domain via hostedemail.com to one of her RR mail accounts doesn't seem like an SCbl-moderated transaction to me. I am, of course, confused. But I'm used to that.

Yes, of course, complain to RR (and throw the evidence at them - the non-delivery notice and recent SC reports to them, but I now note there are none more recent than those I posted before) - BUT explore better solutions, with them, with anyone, at the same time. Inconvenience is one thing, lost orders is another.

[barbiegal7 0]

OMG! Reading these posts is like quantum physics for me - CONFUSED! LOL! But, I think I get the idea that RR is the major problem here. I will contact them again - since they have ignored my first request - and provide them with the reports that Farelf so graciously provided above.

Interestingly, as of today, I tried to send a test email again so I could get the bounce info to add to the email. Instead of a bounce, I received - nothing! No bounce but no return of the email either. Very strange....

[Farelf 0]

Yes, stick with it. There could be something besides the blocklist in play* but RR is the starting point to clear it up in any event. Also look/ask in any RR user forums for others having similar non-delivery and disappearing message problems around the same time.

*Another report, but not on the SCbl currently:

Submitted: Saturday, 4 August 2012 3:08:24 AM +0800:

Rob Hoo, you need to tell me what is meant by that: Image No. 823

5819463444 ( 75.180.132.120 ) To: abuse[at]rr.com