[Resolved] Blocked, please help!

[Andre B]

Hello,

My name is Andre, I'm from a Brazilian magazine called TN Petroleo.

I have been attempting to reach many of our clients and my mails bounce back, saying we have been black listed.

I think I know why that can have happened, but let me explain the situation. In our websites ( www.tnpetroleo.com.br and www.tbpetroleum.com.br ) we provide a service to our costumers that is a digital newsletter with news on the oil market and financial data. We send the newsletter twice a week, every monday and thursday.

To send the newsletter we use Outlook Express. We copy all e-mail adresses in CCO and send it. That might be the problem, but we don't know how to send the newsletter using other system, that wouldn't report us automatically as spammers.

I'd like to add that every single person that receives the newsletter have ASKED to be added to the list, and once one of our clients wish to unsubscribe, we do not send them the newsletter ever again. We respect our clients' privacy.

Now, I know we may have to prove our situation, so how can I do it? If it involves lots of technical details... well, we don't have an IT professional here, unfortunately, do you'd have to guide us.

Please unlist us. Today I was trying to contact new clients and had to ask their local subsidiaries to forward the e-mail to Houston, since I couldn't reach them. That's very embarassing.

Best regards,

Andre B.

[turetzsr]

Bom dia, Andre!

...There are some entries in the SpamCop FAQ (see link at top of page labeled "SpamCop FAQ") that I would suggest that you read:

• Why Am I Blocked?
  
• Has your email been blocked? (ISP, Mailing List Admin, Advertiser)
  
• Am I running mailing lists responsibly? Updated!
  

...In addition, please look at article Start Here - before you make your first Post to see what kind of information we volunteers need to help you further here.

...Finally, if there is anything in the FAQ that you do not understand, please return here to post follow-up questions and we shall try to help you.

...Good luck!

[dbiel]

The most important piece of info that is missing is the IP address that is being blocked. Without that there is nothing we can do here.

Using BCC (I think that is the same as CCO) is a good way of addressing and has no effect on the blocking lists. You do not want every recipient to see the addresses of every other recipient in the list

[Jeff G.]

If your email gives you guff about not having any TO addressees (my OE doesn't do this, but other readers' might), you can put your own address in the TO field.

[Miss Betsy]

Once you have read the Why Am I Blocked FAQ and given your IP address, you will find people here very helpful - particularly Wazoo, although he asks a lot of questions that if you are not an IT professional, seem to be irritating. However, if you work at it, he will give you very good advice.

Miss Betsy

[Andre B]

Thanks everyone for the replies!

The IP address that seems to be blacklisted is 216.173.237.164.

Once I have some free time I will read the FAQ again. About CCO being the same as BCC, yes that's the same. I always use that, so since it's not supposed to be a problem, I don't know what might be the reason for blocking our IP.

Anyway, if you have any further advice now that you have my IP number, please let me know.

Thank you again for your help.

Andre.

[Merlyn]

Looks like you are using a shared mail server so you are at the mercy of others abusing it. Here is an example of recent spam from that server:

http://psbl.surriel.com/evidence?ip=216.17...=Check+evidence

[Miss Betsy]

If you are using a shared server, then the person you need to be talking to is the admin of that server.

Unfortunately there are many servers in Brazil that send so much spam that some people just block everything from Brazil. If you cannot convince the server admin to do something about stopping the spam, you might consider changing your hosting company to a reputable host who does not allow spam.

Miss Betsy

[Jeff G.]

216.173.237.164 is not currently listed by the SCBL (I guess it expired). It "was found in 4 lists (of 255 tested)" per dr. jørgen mash's DNS database list checker drbcheck at http://moensted.dk/spam/?addr=216.173.237.164&Submit=Submit.

Report History is as follows:

Submitted: Sunday, November 06, 2005 08:16:50 -0500:

failure notice

    * 1548872610 ( 216.173.237.164 ) To: spamcop[at]imaphost.com

    * 1548872608 ( 216.173.237.164 ) To: [concealed user-defined recipient]

    * 1548872606 ( 216.173.237.164 ) To: abuse[at]sbcglobal.net

Submitted: Sunday, November 06, 2005 08:16:09 -0500:

failure notice

    * 1548872548 ( 216.173.237.164 ) To: spamcop[at]imaphost.com

    * 1548872546 ( 216.173.237.164 ) To: [concealed user-defined recipient]

    * 1548872545 ( 216.173.237.164 ) To: abuse[at]sbcglobal.net

Submitted: Friday, November 04, 2005 10:28:10 -0500:

failure notice

    * 1547491871 ( 216.173.237.164 ) To: abuse[at]sbcglobal.net

Submitted: Wednesday, November 02, 2005 09:22:49 -0500:

failure notice

    * 1545756456 ( 216.173.237.164 ) To: abuse[at]sbcglobal.net

Submitted: Saturday, October 29, 2005 13:53:04 -0400:

    * 1542723270 ( 216.173.237.164 ) To: spamcop[at]imaphost.com

    * 1542723268 ( 216.173.237.164 ) To: abuse[at]sbcglobal.net

Submitted: Tuesday, October 11, 2005 02:49:58 -0400:

    * 1527165504 ( 216.173.237.164 ) To: spamcop[at]imaphost.com

    * 1527165501 ( 216.173.237.164 ) To: abuse[at]sbcglobal.net

Submitted: Friday, October 07, 2005 12:14:15 -0400:

Undeliverable:

    * 1524108973 ( 216.173.237.164 ) To: abuse[at]sbcglobal.net

Submitted: Wednesday, September 14, 2005 09:48:44 -0400:

    * 1508011631 ( 216.173.237.164 ) To: abuse[at]sbcglobal.net

Submitted: Saturday, September 03, 2005 16:30:39 -0400:

    * 1501307636 ( 216.173.237.164 ) To: abuse[at]sbcglobal.net

Submitted: Saturday, September 03, 2005 00:11:23 -0400:

    * 1500885677 ( 216.173.237.164 ) To: abuse[at]sbcglobal.net

Submitted: Saturday, September 03, 2005 00:11:23 -0400:

    * 1500885877 ( 216.173.237.164 ) To: abuse[at]sbcglobal.net

Submitted: Saturday, September 03, 2005 00:10:29 -0400:

failure notice

    * 1500886364 ( 216.173.237.164 ) To: abuse[at]sbcglobal.net

Submitted: Saturday, September 03, 2005 00:10:27 -0400:

Mail Delivery Failure

    * 1500886910 ( 216.173.237.164 ) To: abuse[at]sbcglobal.net

Submitted: Friday, September 02, 2005 14:24:19 -0400:

failure notice

    * 1500624549 ( 216.173.237.164 ) To: abuse[at]sbcglobal.net

Submitted: Thursday, September 01, 2005 09:48:14 -0400:

failure notice

    * 1499852203 ( 216.173.237.164 ) To: abuse[at]sbcglobal.net

That server seems to be prone to sending backscatter in the form of misdirected bounces, which should be avoided by using 500-series errors during the SMTP transaction. Such misdirected bounces are now considered abusive and reportable by SpamCop per the "Messages which may be reported" section of On what type of email should I (not) use SpamCop? and the Misdirected bounces section of Why are auto-responders (and delayed bounces) bad?.

[Andre B]

I forwarded the bounced-back e-mail to my server admin and am now waiting for his response.

So far, he guarantees that 216.173.237.164 does not belong to our server. Which is odd.

Thanks for the replies so far even though I don't understand all of the technical details.

[Jeff G.]

Perhaps he knows 216.173.237.164 better as mail26a.sbc-webhosting.com, apparently a mailserver in SBC Communications' "E-Services WEb Hosting pool", formerly a part of Ameritech and possibly a Baby Bell and/or AT&T?

[Andre B]

Perhaps he knows 216.173.237.164 better as mail26a.sbc-webhosting.com, apparently a mailserver in SBC Communications' "E-Services WEb Hosting pool", formerly a part of Ameritech and possibly a Baby Bell and/or AT&T?

36374[/snapback]

What is odd is that it would then mean my mail server is from the US, right? Which is not the case.

Anyway, I'll post the bounced mail's message here, so maybe you can also help solve this puzzle.

Hi. This is the qmail-send program at mail26a.sbc-webhosting.com.

I'm afraid I wasn't able to deliver your message to the following addresses.

This is a permanent error; I've given up. Sorry it didn't work out.

<spearson[at]mavericktube.com>:

66.140.193.63 failed after I sent the message.

Remote host said: 571 - MAIL REFUSED - IP (216.173.237.164) is in RBL black list bl.spamcop.net

--- Below this line is a copy of the message.

Return-Path: <andre.barcelos[at]tnpetroleo.com.br>

Received: from mx39.stngva01.us.mxservers.net (204.202.242.107)

by mail26a.sbc-webhosting.com (RS ver 1.0.95vs) with SMTP id 3-0458193608

for <spearson[at]seacatcorp.com>; Fri, 18 Nov 2005 14:53:29 -0500 (EST)

Received: from relay02.dominal.com [200.150.150.12] (HELO smtp.dominal.com)

by mx39.stngva01.us.mxservers.net (mxl_mta-1.3.8-10p4) with SMTP id 8313e734.19134.264.mx39.stngva01.us.mxservers.net;

Fri, 18 Nov 2005 14:53:28 -0500 (EST)

Received: (qmail 11700 invoked by uid 510); 18 Nov 2005 19:53:25 -0000

Received: from andre.barcelos[at]tnpetroleo.com.br by relay02.dominal.com

Received: from unknown (HELO JomarI) (andre.barcelos[at]tnpetroleo.com.br[at]200.164.138.236)

by 0 with SMTP; 18 Nov 2005 19:53:24 -0000

Message-ID: <025901c5ec79$f1f1c9c0$8d00a8c0[at]JomarI>

From: =?iso-8859-1?B?QW5kcuk=?= <andre.barcelos[at]tnpetroleo.com.br>

To: <spearson[at]seacatcorp.com>,

<earike[at]seacatcorp.com>,

<mmpeng[at]wb.com.br>

Subject: TN Petroleo/Precision - D.O.T.

Date: Fri, 18 Nov 2005 17:54:47 -0200

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="=_reb-r72885951-t437E313A"

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2900.2180

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180

X-Processed-By: Rebuild v1.50-1

X-spam: [F=0.1887446153; heur=0.886(4000); stat=0.029; spamtraq-heur=0.500(2005110408)]

X-MAIL-FROM: <andre.barcelos[at]tnpetroleo.com.br>

X-SOURCE-IP: [200.150.150.12]

X-Loop-Detect:1

X-DistLoop-Detect:1

This is a multi-part MIME message.

--=_reb-r72885951-t437E313A

Content-Type: text/plain;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Dear Sirs,

How are you? It was a pleasure to meet you and Precision at the D.O.T. last=

week. Thanks for receiving us in your booth.

I'd like to inform you that the article you gave me is already going throug=

h revision. If it's approved, it should be translated to english and then s=

ent to you for revision. Our editorial team is already aware of that proced=

ure and we'll inform you once I have further news.

I hope Precision had many good business opportunities at the D.O.T.

Best regards,

Andr=E9 Barcelos

Phone: 55 21 3852-5762 Ext: 23

andre.barcelos[at]tnpetroleo.com.br

www.tbpetroleum.com.br

www.tnpetroleum.com.br (in portuguese)

--=_reb-r72885951-t437E313A

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">

<HTML><HEAD>

<STYLE></STYLE>

</HEAD>

So there goes. That was the e-mail which was blocked. Do you have any idea of what may have happened?

[Wazoo]

What is odd is that it would then mean my mail server is from the US, right? Which is not the case.

Anyway, I'll post the bounced mail's message here, so maybe you can also help solve this puzzle.

So there goes. That was the e-mail which was blocked. Do you have any idea of what may have happened?

36375[/snapback]

A few interesting twists involved, it would appear at first glance.

Your e-mail includes To: <spearson[at]seacatcorp.com> .... but the "rejection" data says that <spearson[at]mavericktube.com> was the attempted recipient. Possibility that this user forwards the e-mail from the To: account to this other server and thus ... it is not "your" server that found its way onto the SpamCpDNSBL, but it was (one of) this user's e-mail server that was listed.

As such, not much you can do, nothing your ISP can do. As the IP involved seems to have dropped off the BL, it may be possible to resend now, perhaps adding in this "problem" in this person's e-mail handling ...???

[Jeff G.]

This would be funny if it wasn't so sad. This is what appears to have happened, in approximate chronological order:

• Terri Carr or a predecessor at Maverick Tube Corporation established a Customer-ISP relationship with SouthWestern Bell (now a part of SBC Communications) and registered mavericktube.com and seacatcorp.com.
  
• S. Pearson established an email account spearson[at]mavericktube.com at mavericktube.com with a forwarding address of spearson[at]seacatcorp.com, presumably due to an Employee-Employer relationship.
  
• abuse[at]sbcglobal.net allowed 216.173.237.164 (mail26a.sbc-webhosting.com) to abuse the Internet (and SpamCop Reporters) to such an extent that 216.173.237.164 (mail26a.sbc-webhosting.com) got listed by the SCBL.
  
• You tried to email a message to spearson[at]seacatcorp.com.
  
• Your message went to your smarthost relay02.dominal.com.
  
• Your smarthost relay02.dominal.com sent your message on to seacatcorp.com's only mailserver name mail-fwd.sbc-webhosting.com.
  
• 216.173.237.164 (mail26a.sbc-webhosting.com), one of the mailservers in the farm serving mailserver name mail-fwd.sbc-webhosting.com, received your message, resolved the forward of spearson[at]seacatcorp.com to spearson[at]mavericktube.com, and tried to send the message on to 66.140.193.63 (one of mavericktube.com's mailservers mail1.mavericktube.com).
  
• 66.140.193.63 (mail1.mavericktube.com) rejected the message because 216.173.237.164 (mail26a.sbc-webhosting.com) was listed by the SCBL at the time.
  
• mail-fwd.sbc-webhosting.com sent you the bounce message you quoted from.
  
• You received the bounce message and guessed (incorrectly, it now appears) that there was a problem with your systems that caused the bounce message.
  
• You came here to ask what happened, and the above discussion ensued.
  

Unless 216.173.237.164 was express-delisted, this problem would have been affecting some of the email messages sent to spearson[at]seacatcorp.com (and probably lots of other addresses [at]seacatcorp.com) for at least 24 hours. Please ask Terri Carr or S. Pearson to yell at SBC for this (if they haven't already).

[Wazoo]

Good walk-through .. thanks for taking the time to type that up.

[Jeff G.]

You're welcome.

[Andre B]

Wow.

Thank you for your feedback. That was pretty good. I'm relieved to know there's nothing wrong with my mail server.

I'll be sure to tell my clients at Maverick Tube what happened.

Thank you very much for your trouble and your effort!!!!

Andre.

[Merlyn]

You're welcome.

36390[/snapback]

You're my hero :-)

[Jeff G.]

You're my hero :-)

36507[/snapback]

Aww, shucks! You're all welcome. I made that post so detailed because of the complicated reason for the problem, and because I wanted it to be able to help Andre, S. Pearson, Terri Carr, Maverick Tube, SeaCat, SBC, other SBC customers, and the Internet at large, as well as future posters who might be doubting the value of their complete error messages.