Jump to content
Sign in to follow this  
wightman.admin

[Resolved] spamcop db -> dns syncing

Recommended Posts

One of our mailservers had the misfortune to get listed yesterday. When I check the website it says the ip is no longer listed. When I query bl.spamcop.net it is still there. How long before the two systems are synced.

Thanks.

Scott Cunningham

Share this post


Link to post
Share on other sites
In the FAQ, links at the top of the page, Pinned item in each Forum section, tagged with a "read before posting" .... under the BL sections, is an entry NEW! SCBL "will be delisted in 0 hours" (now shown as 'in a short time') explained that is one attempt to explain.  Recall that it took just as long for it to show up as listed.

31948[/snapback]

When I check the IP it shows it as not being listed not "will be delisted".

http://www.spamcop.net/w3m?action=checkblo...216.110.227.151

Thanks

Share this post


Link to post
Share on other sites
When I check the IP it shows it as not being listed not "will be delisted".

http://www.spamcop.net/w3m?action=checkblo...216.110.227.151

Thanks

31950[/snapback]

That's exactly the same problem I'm having at the moment.

3 of my 4 servers were listed (quite legitimately, I might add, several of our clients got infected with zotob & were spewing spam *sigh* they were blocked & cleaned up within a few hours). When I checked the listings yesterday morning at 9:30 (GMT -0700) they were all set to be delisted within 3 hours. One was delisted on schedule. The other two never fell off the list (and the www.spamcop.net was down so I couldn't check their status). Now spamcop.net says they're not listed, but they're still in DNS (and these aren't just cached records, I did a lookup directly on blns20 to make sure)

The IPs in question are 142.32.11.116, and 142.32.11.109 (142.32.11.96 was delisted yesterday on schedule)

I'm content to wait a few hours, but I'm concerned that if they were supposed to come off 20+ hours ago, and haven't yet, then they might not at all? If there were additional reports on those machines, then I have more heads to break, but there shouldn't have been...

Thanks for any help anyone might be able to give.

(edited for clarity)

Edited by Wazoo

Share this post


Link to post
Share on other sites
Parsing input: 216.110.227.151

host 216.110.227.151 (getting name) = server01.gorrie.wightman.ca.

[report history]

ISP does not wish to receive report regarding 216.110.227.151

ISP does not wish to receive reports regarding 216.110.227.151 - no date available

Routing details for 216.110.227.151

[refresh/show] Cached whois for 216.110.227.151 : admin[at]wightman.ca

Using abuse net on admin[at]wightman.ca

abuse net wightman.ca = admin[at]wightman.ca, abuse[at]wightman.ca

Using best contacts admin[at]wightman.ca abuse[at]wightman.ca

Statistics:

216.110.227.151 not listed in bl.spamcop.net

More Information..

216.110.227.151 not listed in dnsbl.njabl.org

216.110.227.151 not listed in dnsbl.njabl.org

216.110.227.151 not listed in cbl.abuseat.org

216.110.227.151 not listed in dnsbl.sorbs.net

216.110.227.151 not listed in relays.ordb.org.

Perhaps if you opted to receive reports you'd know more!

Report History:

Submitted: Sunday, August 21, 2005 12:04:56 +0100:

=?iso-8859-1?Q?VIAGRR=E1-Really_Works_Good?=

    * 1492618105 ( 216.110.227.151 ) To: admin[at]wightman.ca

    * 1492618104 ( 216.110.227.151 ) To: abuse[at]wightman.ca

SpamCop was dopwn for a few hours for maintenance yesterday - that MAY have slowed propogation to the mirrors?

Share this post


Link to post
Share on other sites

Query sent upstream, but believe the answer is in fact the maintenance downtime from yesterday. The conjectured 6-8 hours turned into something quite a but longer, and as seen in the Announcements entry, the Parsing & Reporting system is running hard to catch up on the backlog.

Share this post


Link to post
Share on other sites
Query sent upstream, but believe the answer is in fact the maintenance downtime from yesterday.  [snip]

31954[/snapback]

Ok. Thank you for your quick reply. I read that message about maintenance, but couldn't figure out that the Parsing & Reporting system would have an effect on the delisting of IP addresses. I guess I'll wait for either more information or for the addresses to fall off the list.

Thanks again.

Share this post


Link to post
Share on other sites
Parsing input: 216.110.227.151

host 216.110.227.151 (getting name) = server01.gorrie.wightman.ca.

[report history]

ISP does not wish to receive report regarding 216.110.227.151

ISP does not wish to receive reports regarding 216.110.227.151 - no date available

Routing details for 216.110.227.151

{snip}

I've checked my SpamCop ISP account settings and all the settings are correct to accept reports. Is there someplace else I need to go to change that??

Share this post


Link to post
Share on other sites
I've checked my SpamCop ISP account settings and all the settings are correct to accept reports.  Is there someplace else I need to go to change that??

31959[/snapback]

Another one for 'upstream' Wazoo?

Share this post


Link to post
Share on other sites
I've checked my SpamCop ISP account settings and all the settings are correct to accept reports.  Is there someplace else I need to go to change that??

31959[/snapback]

I was assuming it was something you did when you received one of the reports, selecting something like "Issue Resolved" which usually shows up in the parse.

With the upgrade, we don't know what broke new and what was broke ;)

Share this post


Link to post
Share on other sites
Ok.  Thank you for your quick reply.  I read that message about maintenance, but couldn't figure out that the Parsing & Reporting system would have an effect on the delisting of IP addresses.  I guess I'll wait for either more information or for the addresses to fall off the list.

Thanks again.

31956[/snapback]

To reply to myself:

The issue is resolved. My IPs just came off the blacklist, now I just have to wait for the TTL to expire on people's DNS servers...

Thanks again for your help, everyone.

Share this post


Link to post
Share on other sites
To reply to myself:

The issue is resolved.  My IPs just came off the blacklist, now I just have to wait for the TTL to expire on people's DNS servers...

Thanks again for your help, everyone.

31968[/snapback]

My entry is gone too. Thanks guys :)

Share this post


Link to post
Share on other sites
I've checked my SpamCop ISP account settings and all the settings are correct to accept reports.  Is there someplace else I need to go to change that??

31959[/snapback]

OK, per Richard .... there was a spam complaint submitted. ISP handled that, selecting an option to "turn off further reports" .... In this case, this set a 24 hour flag against future reporting. Unfortunately, thus flag setting also apparently gets included in the "IP lookup function" so all queries resulted in showing the "does not wish to accept" message. Allowing time to pass, http://www.spamcop.net/sc?track=216.110.227.151 now lacks this bit of text. So this should explain why wightman.admin checked settngs and found no blockage flags, but "we" were seeing the referenced "refusal" message.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×