Why is my mail server being blocked?

[JohnnyB]

My mail server is being blocked and the only reason that is listed is "email was sent to a spam trap".

My mail server is 142.77.1.111. Can someone please check it? The server belongs to an ISP so there are 1000's of people using it which means that ANYONE could have sent a spam.

Thanks in advance for any help!

JohnnyB

[RFowler]

I am on the same server and have the same problem.

[RFowler]

Anyone who can help us with this?

I talked to the ISP that owns this mail server (a very large North American telecom.... very large ..... HUGE) and they say that the people here at Spamcop are very uncooperative. Spamcop refuses to tell them what exactly is wrong with the server.

Why the heck would you set up this system and not have a mechanism in place to tell the ISP's how to fix any issues?????????

Is it not in everyone's best interest to fix these problems permanently???

I hate spam as much as the next guy but why am I (forget that,.... like origonal poster said..... thousands of us) having all mail blocked.

I have nothing nice to say about Spamcop, so I will say nothing else.

Please help me change my opinion.

Regards,

[Wazoo]

http://www.spamcop.net/w3m?action=checkblo...ip=142.77.1.111

142.77.1.111 listed in bl.spamcop.net (127.0.0.2)

If there are no reports of ongoing objectionable email from this system it will be delisted automatically in approximately 14 hours.

Causes of listing

System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop)

Additional potential problems

System administrator has already delisted this system once

Listing History

In the past 47.0 days, it has been listed 13 times for a total of 10.1 days

Other hosts in this "neighborhood" with spam reports

142.77.1.53 142.77.1.58 142.77.2.12 142.77.2.26

Report History:
--------------------------------------------------
Submitted: Thursday, September 21, 2006 11:14:26 PM -0500:
Undeliverable mail: general fewer
1932849642 ( 142.77.1.111 ) ( UUBE ) To: uube[at]devnull.spamcop.net
--------------------------------------------------
Submitted: Thursday, September 21, 2006 6:50:38 PM -0500:
WARNING. Mail Delayed: Get rid of the pounds you hate
1932600889 ( 142.77.1.111 ) ( UUBE ) To: uube[at]devnull.spamcop.net
----------------------------------------------------
Submitted: Thursday, September 21, 2006 6:39:17 PM -0500:
WARNING. Mail Delayed: Get rid of the pounds you hate
1932590046 ( 142.77.1.111 ) ( UUBE ) To: uube[at]devnull.spamcop.net
------------------------------------------------------
Submitted: Thursday, September 21, 2006 6:05:49 PM -0500:
WARNING. Mail Delayed: Obesity is dangerous, stop it
1932558590 ( 142.77.1.111 ) ( UUBE ) To: uube[at]devnull.spamcop.net
-------------------------------------------------------
Submitted: Thursday, September 21, 2006 5:55:19 PM -0500:
WARNING. Mail Delayed: Get rid of the pounds you hate
1932548680 ( 142.77.1.111 ) ( UUBE ) To: uube[at]devnull.spamcop.net
---------------------------------------------------------
Submitted: Wednesday, September 20, 2006 12:29:55 AM -0500:
Undeliverable mail: Cum splatter amateur girl
1929420593 ( 142.77.1.111 ) ( UUBE ) To: uube[at]devnull.spamcop.net 

Time to read the SpamCop FAQ here folks ... starting with the "Why am I Blocked?" entry (which has also been separately Pinned)

Check the parts like "SpamCop.net cannot block your e-mail" .... "SpamCop.net does not recommend the use of the SpamCopDNSBL in a "blocking fashion" ... How to post a question .... .... on and on ....

I have nothing nice to say about Spamcop, so I will say nothing else.

I really don't have much nice to say about folks that don't bother to do any research before posting either ...

uu.net was world renowoned for not doing much to control spam .. mci isn't much of an improvement ....

[JohnnyB]

Thanks for the info Wazoo!

I will look into the FAQs and the PINs as you suggest, but for the record our info is based on what MCI is telling us. We can't email and they can't tell us why Spamcop is blocking us so that gets fustrating as it is an ongoing thing.

I hope the spammer and found and flogged!! :angry:

JohnnyB

[Wazoo]

I will look into the FAQs and the PINs as you suggest, but for the record our info is based on what MCI is telling us. We can't email and they can't tell us why Spamcop is blocking us so that gets fustrating as it is an ongoing thing.

You will find that SpamCop.net cannot and does not block your e-mil .... any blocking you see is from an ISP that has chosen to use the data in the SpamCopDNSBL (assuming no other mistakes in thier e-mail server configuration) .. which isn't in line with SpamCop.net's recommendations to begin with .. the point is, you can send all the e-mail you want .. it's only when that e-mail ends up at one of these particulat ISPs that you will see this 'problem' .. noting that the decision of what traffic is allowed on that receiving ISP's servers is up to that ISP ....

[RFowler]

>>>delisted automatically in approximately 14 hours.

Why do you wait 14 hours to delist?

From what uunet/mci is telling me, you guys are the ones who lack communication.

Of course I am upset......... you are blocking legit email for dozens of companies.

I appreciate you posting some help. I did read it will be delisted in 14 hours before your post, I did my own research so please dont suggest I am negligent.

But just telling me that hundreds of my emails, everyone of them legit communication with people who want information from us, like tracking numbers, communication with suppliers.... emailing my father to set up a golf game .... yada yada. Nothing that would be considered spam by anybody.... are going to be blocked for 14 hours?

So we are dead in the water for 14 hours because you guys have a beef with uunet/mci and refuse to tell them what they need to do to fix the problem??????

If you contact me, I will give you the information for mci.

I am tired of this and have been dealing with it for quite some time.

All that being said, I really appreciate your quick post, I am just frustrated.

Sincerely,

Robert

>>>You will find that SpamCop.net cannot and does not block your e-mil .... any blocking you see is from an ISP that has chosen to use the data in the SpamCopDNSBL

I am completely aware of this, I dropped my ISP at home because they use spamcop and were very unhelpful in resolving the problem about 2 years ago.

Was this message board here back then?

[StevenUnderwood]

But just telling me that hundreds of my emails, everyone of them legit communication with people who want information from us, like tracking numbers, communication with suppliers.... emailing my father to set up a golf game .... yada yada. Nothing that would be considered spam by anybody.... are going to be blocked for 14 hours?

That will only be true if every one of the recipients servers is implementing the spamcop bl on their end.

If hundreds are being blocked, then you must be sending 10000's (in my experience) or to a very limited number of domains.

Also, that counter continues to count down only until the next piece of spam hits the spamtrap, then it starts over again. MCI needs to clean up it's system and stop sending bounces to the forged email addresses in messages.

Information has been posted here about the kinds of messages being seen from the server you mentioned. ALL of it is undeliverables hitting innocent (spamtrap) mailboxes.

[RFowler]

>>>That will only be true if every one of the recipients servers is implementing the spamcop bl on their end.

Ok, hundreds may be an exageration.

But, yes we 25 people here sending a few to a dozen emails an hour.

Over the course of the year, yes hundreds of emails denied because of the ISP's of people at the other using spamcop.

Not hard to believe when you are a successful ecommerce company with 10's of thousands of customers.

p.s. when have not sent a newsletter, or had an email advertising campaign since year 2000, because we hate spam too

[StevenUnderwood]

>>>delisted automatically in approximately 14 hours.

Why do you wait 14 hours to delist?

A spamcop listing is a point system. If you get x number of points, your are listed for y number of hours. If during that countdown more reports come in during that time, both numbers get bigger.

Everything MCI needs to know is really on this page:

http://www.spamcop.net/bl.shtml?142.77.1.111

The most common causes of blocking systems not intending to spam

[RFowler]

>>>MCI needs to clean up it's system and stop sending bounces to the forged email addresses in messages.

They told me it was an issue with bounces too.

Now we are getting somewhere.

How many bounces are we talking about?

I was under the impression that bounces can be used in a legit way, is that true?

[Wazoo]

>>>delisted automatically in approximately 14 hours.

Why do you wait 14 hours to delist?

A SpamCop FAQ entry .... look for the Title "What is on the list?"

From what uunet/mci is telling me, you guys are the ones who lack communication.

Whatever .... note once again, this is primarily a user-to-user support venue.

Of course I am upset......... you are blocking legit email for dozens of companies.

Repeat .. I am blocking nothing of yours ....

But just telling me that hundreds of my emails, everyone of them legit communication with people who want information from us, like tracking numbers, communication with suppliers.... emailing my father to set up a golf game .... yada yada. Nothing that would be considered spam by anybody.... are going to be blocked for 14 hours?

???? Yet again, I am not blocking your e-mail .. SpamCop.net is not blocking your e-mail ....

So we are dead in the water for 14 hours because you guys have a beef with uunet/mci and refuse to tell them what they need to do to fix the problem??????

???? check the SpamCop FAQ, same reference as above .... spew stops, IP address gets de-listed, everybody happy (?)

If you contact me, I will give you the information for mci.

Trust me, I have dealt with them (and uu.net before) many times personally .... why you would have to provide the data isn't necessary .. data is available publicly all over the place ... now how to get ahold of someone with an actual clue ... that's not pibliched anywhere ...

I am completely aware of this, I dropped my ISP at home because they use spamcop and were very unhelpful in resolving the problem about 2 years ago.

Was this message board here back then?

yes .. the newsgroups pre-date the Forum and they are still available .... back then, there were more Deputies, there was more data available on reported stuff .... a lot has happened over those two years, to include spammers ruining all kinds of things .....

[StevenUnderwood]

>>>MCI needs to clean up it's system and stop sending bounces to the forged email addresses in messages.

They told me it was an issue with bounces too.

Now we are getting somewhere.

How many bounces are we talking about?

I was under the impression that bounces can be used in a legit way, is that true?

Spamcops listing (x I was talking about earlier) is based on a percentage of messages seen throughout the internet. Spamcop has a number of domains around the world that keep track of the numbers of connections coming from each IP address. Basically, Spamcop uses that number as the denominator, with the number of reports being the numerator. There is acutally a weighting system as well where spamtrap's have a higher value because they should never receive any spam because the only way they are found is by scrapping web sites.

A large enough PERCENTAGE of messages coming from that server are either hitting spam traps or are being reported as spam to get it listed.

Bounces to the sender address after accepting and receiving the message used to be acceptable, until spammers ruined it. Right now, on the domain I manage, we receive ~80% spam, all of it with forged addresses. The only way not to abuse other peoples email systems is to not send those messages.

The best way to do that (IMHO) is to reject the message during the SMTP transaction using blocklists. That way the sender knows the message did not get through and can use an alternate means of commiunication. If the server accepts the message, it should only send a bounce message after the original has been scanned for being spam. This will not eliminate bounces, but will greatly cut down on the occurance of the wrong people getting the bounce. This method also means that a sender may not know that their message did not get through because no filter is 100% effective.

P.S. Almost alll of this is in the FAQ

[Wazoo]

How many bounces are we talking about?

enough to tip the math to get the IP address(es) listed .. once again, this data is in the SpamCop FAQ

I was under the impression that bounces can be used in a legit way, is that true?

This was the normal, acceptable thing until a few years ago ... then spammers figured a 'new' way to use the "trusted user" model the 'net' was developed under and screwed things up for everybody.

[RFowler]

>>>A large enough PERCENTAGE of messages

How could you possible know what the percentage is?

Where would you get the total traffic from?

I realize you are not doing this personally and it is all done with an algo of some sort.

Once again, I really appreciate the feedback..... and I am thrilled you now have this forum for people stuck in my situation.

[Telarin]

senderbase.org is one of the largest email traffic monitoring firms there is, and from personal experience, I can tell you that there numbers are reasonably accurate, even for small servers.

[RFowler]

>>>reasonably accurate

reasonably???

so possibly wrong then

from senderbase (thanks for the link by the way)

Volume Statistics for this IP

Magnitude Vol Change vs. Average

Last day 4.6 -63%

Last 30 days 4.1 -89%

Average 5.1

What is magnitude mean?

Where on that page for this IP does it say what the volume is?

[Telarin]

Accurate enough to determine an approximate spam:ham ratio. Certainly not accurate to the individual message, but I would say for most shared servers at least 2 significant digits, which is more than enough for the purposes spamcop uses it for.

There are also a number of factors other than percentage that spamcop takes into account, such as prior listing history, frequency of reports, etc... Only the developers know the exact algorithms used.

There is a link on the page that explains exactly what magnitude is. It is basically a logarithmic scale. A magnitude of 4.6 would be aproximately 10^4.6 or 40,000 messages per day.

[Wazoo]

>>>reasonably accurate

reasonably???

so possibly wrong then

.....

What is magnitude mean?

Where on that page for this IP does it say what the volume is?

http://forum.spamcop.net/scwik/SenderBase

From the SpamCop FAQ here .. look for the entry Titled: SenderBase Magnitude explained ...

[Wazoo]

Received via PM, but .... Section 8 - SpamCop's System & Active Staff User Guide .... not much I can offer, as I am not one of the paid employees ....

As the primary abuse contact for MCI Canada, I'd like to request some useful information as to exactly what is hitting your Spamtraps from the server at 142.77.1.111

I offered up just a small sampling in a previous posting here ... that was primarily spamtrap hit data ....

Having to go back a bit on 'reported' spam .. (configuration changed in the interim perhaps?) .. yet the Subject lines look awfully familiar ....

Report History:
---------------------------------------------------
Submitted: Thursday, September 07, 2006 10:48:31 PM -0500:
Undeliverable mail: Please read
1912232436 ( 142.77.1.111 ) To: spamcop[at]imaphost.com
1912232435 ( 142.77.1.111 ) To: abuse[at]ca.mci.com
-----------------------------------------------------
Submitted: Thursday, September 07, 2006 10:48:20 PM -0500:
Undeliverable mail: Please read
1912231431 ( 142.77.1.111 ) To: spamcop[at]imaphost.com
1912231420 ( 142.77.1.111 ) To: abuse[at]ca.mci.com
-------------------------------------------------------
Submitted: Monday, September 04, 2006 10:01:23 AM -0500:
WARNING. Mail Delayed: Please read
1906416224 ( 142.77.1.111 ) To: spamcop[at]imaphost.com
1906416212 ( 142.77.1.111 ) To: abuse[at]ca.mci.com
--------------------------------------------------------
Submitted: Monday, September 04, 2006 9:58:29 AM -0500:
WARNING. Mail Delayed: Please read
1906413839 ( 142.77.1.111 ) To: spamcop[at]imaphost.com
1906413819 ( 142.77.1.111 ) To: abuse[at]ca.mci.com
-------------------------

This system is configured as per SpamCop's recommendations. It 550 Rejects invalid users and will not bounce messages with the sole exception of User-selected Vacation messages (which don't bounce, but autorespond with the initial subject line. This is not spam). The latter is functionality required by our clients.

Something else is going on then, as neither the spamtrap hit data or the older reported stuff seems to jive with a flat-out rejection ....

SpamCop has repeatedly listed this while providing almost no information as to why, despite several requests. Here is essentially what you've given us.

The three Deputies already handle a self-admitted 800-1800 e-mails a day. But, only they have data beyond what has been posted here. There may be a question as to what was asked, how it was asked, did it come from a role account, things like that ....???

And via the deputies email you've provided 3 header snippets and nothing else. Which is hardly enough to determine a problem exists with MCI Canada's server config. From what little information has been provided MCI has been able to confirm that at least the last two header snippets were from Vacation Autoresponders, which cannot be used to relay UCE as they do not include the Body of the message, but only the Subject.

I have no idea what's being discussed 'here' .... my first 'evidence' post contained six items ....but the question remains as to how an "Out-of-Office" response could end up being directed to a spamtrap, other than the server "Replying" to an e-mail that was using a forged From: / Reply-To: address line .... which again, doesn't tie into the above description of "no bounces, etc."

Barring detailed information of abuse received that indicates messages other than vacation autoresponders, this MCI Canada server cannot be considered a source of UCE.

Should you be able to provide additional information, please forward it to me. I would distinctly like to prevent this system being listed in SpamCop's RBL for UCE.

Again, as a volunteer, I have no access to the data you're looking for other than what's already been posted here.

Typically, with a continuous stream of spamrap hits, usually the IP address wil also be picked up at http://psbl.surriel.com/ .. however ....

The PSBL database server is experiencing hardware problems. The database is being moved over to another system. Apologies for the inconvenience.

PM sent to advise of this response here ....

[StevenUnderwood]

This system is configured as per SpamCop's recommendations. It 550 Rejects invalid users and will not bounce messages with the sole exception of User-selected Vacation messages (which don't bounce, but autorespond with the initial subject line. This is not spam). The latter is functionality required by our clients.

I have just proven to myself this is NOT the case. Please explain this:

C:\Documents and Settings\Steven>telnet 142.77.1.111 25

220 mail.net ESMTP 5.0.1

helo underwood.spamcop.net

250 mail.net host name is unknown underwood.spamcop.net

mail from:<underwood[at]spamcop.net>

501 Incorrect Address Format (typo on my part)

mail from:<underwood[at]spamcop.net>

250 underwood[at]spamcop.net sender accepted

rcpt to:<12345tester67890[at]mci.com>

571 12345tester67890[at]mci.com Relaying denied (good)

rcpt to:<12345tester67890[at]ca.mci.com>

250 12345tester67890[at]ca.mci.com will relay to a client address(bad)

data

354 Enter mail, end with "." on a line by itself

This is a test. It should not end up at my spamcop address.

.

250 604636207 message accepted for delivery

quit

221 mail.net SMTP closing connection

Connection to host lost.

C:\Documents and Settings\Steven>

and worse: http://www.spamcop.net/sc?id=z1075979287z7...f5e5d69468c573z

I cancelled the report because I caused it, but the fact I received any message shows that if I had pput some other address in the place of my spamcop address, they would have received that bounce.

P.S. I am frustrated that I need to explain how to test a system to a company as large as MCI. Perhaps they should hire me as a consultant.

[JohnnyB]

One thing I know that the mail server does is it bounces messages back once a user's email box is full.

A support person at MCI told me a month ago that the service department had to make a change to the way the incoming and outgoing servers synced. This is what they said was causing the problem with the them being listed by SpamCop.

I have called a few of the companies that we are having problems sending emails to and talked to their IT people (monkeys I would prefer to call them) asking them to have us removed from the list. This was before reading the FAQs and discovering that the blocklist is just a guide for companies to use and that they can edit the list. Obviously these people are not reading any of the FAQs. :angry:

I just hope a solution is found before we all go nuts...

The idea of having in-house email is sounding better all the time.

I thank you guys for your input and I will keep reading the FAQs.

Thanks especially to the person who created this Forum!

JohnnyB

[Telarin]

When our company switched from ISP supported (I use the term very loosley) email to an in-house email server, all problems we had with BLs, etc, went away. A good rule of thumb is if your ISP tells you "we can't control what is on the blocklist" (and I'm not just referring to the spamcop blocklist here, they should be able to get problems fixed and their servers removed from almost any blocklist). Or if they tell you "We don't know what is wrong". Its a good sign it is time to shop for a new email provider, or to consider running your own mail server.

Anymore, you can pick up a copy of MS Small Business Server which includes Exchange, SQL, Fax Server, and a whole slew of other toys useful for a small business for something like $600 retail at most places that carry software. I do recommend that if you do this, you hire someone that is familiar with setting up Exchange, as even Exchange 2003 has a few "out-of-the-box" configuration errors that will need to be fixed or you will cause yourself problems. It even supports use of BLs (though only in a blocking fasion, not tagging).

[AdamMaas]

Received via PM, but .... Section 8 - SpamCop's System & Active Staff User Guide .... not much I can offer, as I am not one of the paid employees ....

I offered up just a small sampling in a previous posting here ... that was primarily spamtrap hit data ....

Having to go back a bit on 'reported' spam .. (configuration changed in the interim perhaps?) .. yet the Subject lines look awfully familiar ....

Report History:
---------------------------------------------------
Submitted: Thursday, September 07, 2006 10:48:31 PM -0500:
Undeliverable mail: Please read
1912232436 ( 142.77.1.111 ) To: spamcop[at]imaphost.com
1912232435 ( 142.77.1.111 ) To: abuse[at]ca.mci.com
-----------------------------------------------------
Submitted: Thursday, September 07, 2006 10:48:20 PM -0500:
Undeliverable mail: Please read
1912231431 ( 142.77.1.111 ) To: spamcop[at]imaphost.com
1912231420 ( 142.77.1.111 ) To: abuse[at]ca.mci.com
-------------------------------------------------------
Submitted: Monday, September 04, 2006 10:01:23 AM -0500:
WARNING. Mail Delayed: Please read
1906416224 ( 142.77.1.111 ) To: spamcop[at]imaphost.com
1906416212 ( 142.77.1.111 ) To: abuse[at]ca.mci.com
--------------------------------------------------------
Submitted: Monday, September 04, 2006 9:58:29 AM -0500:
WARNING. Mail Delayed: Please read
1906413839 ( 142.77.1.111 ) To: spamcop[at]imaphost.com
1906413819 ( 142.77.1.111 ) To: abuse[at]ca.mci.com
-------------------------

Something else is going on then, as neither the spamtrap hit data or the older reported stuff seems to jive with a flat-out rejection ....

As I noted, Out Of Office replies respond with the original Subject Line, which is not at odds with the data you've posted, but that doesn't make it spam.

The three Deputies already handle a self-admitted 800-1800 e-mails a day. But, only they have data beyond what has been posted here. There may be a question as to what was asked, how it was asked, did it come from a role account, things like that ....???

It came from my corporate email, with my .sig. I received some basic information, but not enough to determine whether or not an auto-responder was involved initially. Further investigation on MCI's side indicates that all three header snippets were almost assuredly from Vacation messages. They did not provide the requested Body information (which would NOT have compromised SpamCop's Spamtraps, but would indicate whether or not it was an Autoreply or actual spam). I tested this function myself to confirm that the body was not being included in the Autoreply.

I have no idea what's being discussed 'here' .... my first 'evidence' post contained six items ....but the question remains as to how an "Out-of-Office" response could end up being directed to a spamtrap, other than the server "Replying" to an e-mail that was using a forged From: / Reply-To: address line .... which again, doesn't tie into the above description of "no bounces, etc."

Read what I wrote again. The only way it could have happened is if said spam with a forged From: address hit a box set with an Out of Office autoreply. That is NOT a Bounce. And it is NOT UCE. Such Autoreplies are a required function of email for the Business World. If you are listing because of them, SpamCop needs to fix it's listing criteria. As this functionality cannot be used to spam anybody (Since the body isn't included in the Autoreply), and is required by MCI's clients for legitimate business reasons, MCI simply can't turn it off.

Again, as a volunteer, I have no access to the data you're looking for other than what's already been posted here.

Typically, with a continuous stream of spamrap hits, usually the IP address wil also be picked up at http://psbl.surriel.com/ .. however ....

PM sent to advise of this response here ....

142.77.1.111 is not listed at http://psbl.surriel.com/. It's not listed anywhere except SpamCop at last check (Friday, 22 Sept).

MCI is quite willing to fix our server if it is indeed broken. But SpamCop has not provided evidence that indicates that anything beyond an Autoreply is involved here. If SpamCop provides me with the necessary information which indicates an actual problem, I will get the system fixed.

Adam Maas

Internet Security Specialist

MCI Canada

adam.maas[at]ca.mci.com

I have just proven to myself this is NOT the case. Please explain this:

and worse: http://www.spamcop.net/sc?id=z1075979287z7...f5e5d69468c573z

I cancelled the report because I caused it, but the fact I received any message shows that if I had pput some other address in the place of my spamcop address, they would have received that bounce.

P.S. I am frustrated that I need to explain how to test a system to a company as large as MCI. Perhaps they should hire me as a consultant.

Steven.

Thank you for this test. This has the information that I need, ca.mci.com is our local domain (and the domain the server lives in) and it appears that the server will relay (or bounce) for the local domains only. This could well be the issue that is causing the listings. This will be corrected. Once again, thank you, we had missed that possibility.

[DavidT]

Oy, what went wrong with the quoting in the previous post?

dt