Jump to content
Sign in to follow this  
chibbard

SpamCop is bouncing my emails

Recommended Posts

Hi,

About three weeks ago, a few people trying to email me said that they were getting bounces back that their messages were undeliverable. The message bounce said that SpamCop had blacklisted the address or domain. However, I can't find any way that SpamCop is even associated with me. My ISP and domain host are also completely baffled how SC could be blocking these messages. Anyone know how to trace this? Thanks!

Here's the error message:

The following addresses had permanent fatal errors -----

<casey[at]compelling-cases.com>

(reason: 550-Message rejected because mail.cybermesa.com [198.59.109.2]

is blacklisted)

----- Transcript of session follows -----

... while talking to mail.compelling-cases.com.:

>>> DATA

<<< 550-Message rejected because mail.cybermesa.com [198.59.109.2] is

blacklisted

<<< 550 at bl.spamcop.net see Blocked - see

http://www.spamcop.net/bl.shtml?198.59.109.2

550 5.1.1 <casey[at]compelling-cases.com>... User unknown

<<< 503 valid RCPT command must precede DATA

Reporting-MTA: dns; mail.cybermesa.com

Received-From-MTA: DNS; [65.19.15.45]

Arrival-Date: Wed, 24 Aug 2005 13:53:07 -0600

Final-Recipient: RFC822; casey[at]compelling-cases.com

Action: failed

Status: 5.1.1

Remote-MTA: DNS; mail.compelling-cases.com

Diagnostic-Code: SMTP; 550-Message rejected because mail.cybermesa.com

[198.59.109.2] is blacklisted

Last-Attempt-Date: Wed, 24 Aug 2005 13:53:11 -0600

Share this post


Link to post
Share on other sites
Hi,

About three weeks ago, a few people trying to email me said that they were getting bounces back that their messages were undeliverable. The message bounce said that SpamCop had blacklisted the address or domain. However, I can't find any way that SpamCop is even associated with me. My ISP and domain host are also completely baffled how SC could be blocking these messages. Anyone know how to trace this?

<snip>

32234[/snapback]

Hi, chibbard,

...Either your ISP or your MSP (e-mail server provider) is blocking the e-mail and generating the message that the host (which is where the e-mail is coming from) is blacklisted! Sometimes, ISPs and MSPs generate misleading messages -- it may not be SpamCop that is the reason the messages are blocked.

...If you follow the link in the rejection message ("http://www.spamcop.net/bl.shtml?198.59.109.2"), you will see a note that this address is not blocked. However, this information is not real-time; also, the SpamCop block list is dynamic, so that this IP address might have been on the block list at the time the other person's e-mail arrived at your ISP or MSP but has since dropped off because there have been no further spam reports.

...Following the link on the bl.shtml page labeled "Trace IP," I note that the abuse address responsible for 198.59.109.2 "does not wish to receive reports regarding" the IP address -- this suggests to me that they are not much interested in stopping spam coming from that machine and so the person trying to send you her/his mail might wish to look into finding another provider.

Edited by turetzsr

Share this post


Link to post
Share on other sites
<<< 550 at bl.spamcop.net see Blocked - see

http://www.spamcop.net/bl.shtml?198.59.109.2

32234[/snapback]

At the time it was having the problem, did you follow the link above to see why it was listed? Specifically, the link labeled: Information about the reasons for listing (blocking) your mail server (198.59.109.2). Right now your systems are not listed. I see no actual old reports against your IP address which leads me to believe you were generating messages to the spamcop spam trap addresses. Right now I have no way to confirm this. You may want to read the web page you are directed to by the email error. There are several methods listed there that can get legitimate servers listed.

I see that you or your administrators are not interested in getting any spam reports about spam coming from your servers.

Parsing input: 198.59.109.2

host 198.59.109.2 (getting name) = mail.cybermesa.com.

[report history]

ISP does not wish to receive report regarding 198.59.109.2

ISP does not wish to receive reports regarding 198.59.109.2 - no date available

Routing details for 198.59.109.2

Report routing for 198.59.109.2: abuse[at]cybermesa.com

Share this post


Link to post
Share on other sites
<snip>

Right now your systems are not listed.

<snip>

I see that you or your administrators are not interested in getting any spam reports about spam coming from your servers.

32236[/snapback]

Hi, Steven,

...Am I correct that it is not clibbard's sending IP that is being blocked, but rather that of the person trying to send to her/him?

<snip>

About three weeks ago, a few people trying to email me said that they were getting bounces back that their messages were undeliverable.

<snip>

Share this post


Link to post
Share on other sites
Hi, Steven,

...Am I correct that it is not clibbard's sending IP that is being blocked, but rather that of the person trying to send to her/him?

<snip>

About three weeks ago, a few people trying to email me said that they were getting bounces back that their messages were undeliverable.

<snip>

32239[/snapback]

Yes, you are correct, I was thinking backward on that. The people controlling: mail.compelling-cases.com seem to be doing the blocking.

That's what I get for trying to fit responses between meetings :(

Share this post


Link to post
Share on other sites
Hi, Steven,

...Am I correct that it is not clibbard's sending IP that is being blocked, but rather that of the person trying to send to her/him?

<snip>

About three weeks ago, a few people trying to email me said that they were getting bounces back that their messages were undeliverable.

<snip>

32239[/snapback]

Title of this post does not seem to match the write-up, exactly. Then not explained is how the "error message" was captured.

My take: chibbard's ISP has started using the SpamCopDNSBL.

Some incoming e-mail got blocked. Time passed, questions asked, bunch of folks without a clue involved. Of course, answers are here, but ... by now, the critical data is missing. So best I can suggest is the usual reference to the Why am I Blocked? entry and the SpamCop FAQ here ... not to ignore the Pinned items and the existing Topics/Discussions ....

noting that there is another issue showing;

550 5.1.1 <casey <at> compelling-cases.com>... User unknown

not sure what to say about that ....

Share this post


Link to post
Share on other sites
<snip>

Here's the error message:

The following addresses had permanent fatal errors -----

<munged: casey [at] compelling-cases [dot] com>

    (reason: 550-Message rejected because mail.cybermesa.com [198.59.109.2]

is blacklisted)

<snip>

32234[/snapback]

Hi, chibbard,

...If your e-mail address is included in your post, you may want to munge (disguise) it. You can do that by clicking on the "Edit" button under your message, above, and changing the text to something like "[casey [at] compelling-cases [dot] com" or even just "<munged my e-mail addy>." Doing this will keep spiders from capturing your e-mail address to add to those used by spammers. Note that it's there three times!

Share this post


Link to post
Share on other sites

32239[/snapback]

noting that there is another issue showing;

550 5.1.1 <casey <at> compelling-cases.com>... User unknown

not sure what to say about that ....

32244[/snapback]

There is a sample or two, looks like many in the thread in Sightings.

Looks to me like backscatter and it looks like a fake bounce from some email client or a poorly setup server and is sending back to the from address and that is probably what got them listed.

And yes, I agree it looks strange the sample posted looks the same way.

http://groups.google.com/group/news.admin....f7daa94b4303f02

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×