[Resolved] Poor Sender Base Score

[Pnutz]

Afternoon,

Anyone have any contacts over at Sender Base?

Email i sent to Support [at] Senderbase.org

I'm contacting you regarding our Domain lhfp.com and our reputation score for our mail server "mail.lhfp.com" (70.102.2.114 ) being listed as Poor.

We are currently and have not been listed on any known blacklists.

We employ a good level of Security by Running Mcafee AntiVirus On all desktops and Servers. Have GroupSheild running on our Exchange 2007 server. And have our SonicWall Fire wall configured to only allow SMTP traffic in and out of our Cisco Blocker appliance. No Client PC or server can directly send SMTP traffic to the internet.

I have also verified our Email settings with www.mxtoolbox.com for any open relay issues

We do have a correct Reverse DNS Entry setup as indicated by our senderbase query.

We are just unable to send email to any organization utilizing an IronPort or Cisco spam filter ( Which Ironically is the same one we use )

Bounce Message from Dell:

Christopher_Gruening[at]dell.com

#< #5.0.0 smtp; 5.4.7 - Delivery expired (message too old) 554-'ps-smtp2.us.dell.com\nConnections from this sending hostname mail.lhfp.com, IP address of: 70.102.2.114 are being rejected due to low SenderBase Reputation score (below -2) or due to bad DNS PTR record for your mail server. Please check your DNS PTR for 70.102.2.114. Forward and reverse DNS entries must match for 70.102.2.114. Your SenderBase organization: 2065936. See http://www.senderbase.org/ for more information.' (delivery attempts: 0)> #SMTP#

Bounce Message from Cisco:

kamatthe[at]cisco.com

[128.107.243.14] #<[128.107.243.14] #5.0.0 smtp; 5.1.0 - Unknown address error 550-'Connections from your IP address are being rejected due to a low SenderBase Reputation Score. Contact your IT support team, and have them review http://www.senderbase.org for more information.' (delivery attempts: 0)> #SMT

This is an urgent matter for our company and we would appreciate any immediate assistance with this.

Regards,

JohnPaul Nye

CCNA, MCSE+I

IT - Hardware Manager

Lincoln Heritage LLC.

9498 SW Barbur Blvd., Ste. 202

Portland, OR 97219

p: (503) 244-7755

[turetzsr]

Hi, JohnPaul

...Does any of the discussion in SpamCop Forum article "Senderbase listing, trying to make sense of it" help you at all?

[Pnutz]

...Does any of the discussion in SpamCop Forum article "Senderbase listing, trying to make sense of it" help you at all?

Wheeww... That was quite the Read. I will keep trying with my efforts to flag down a warm body over at Ironport and senderbase. Anyone know of a good Phone# to use for them other than what is listed on their site? I have tried 2 emails to support [at] senderbase.org but nothing yet.

[turetzsr]

Anyone know of a good Phone# to use for them other than what is listed on their site?

...Since you're a customer, could you use the same tactics as employed by contributor "billyreubin" in the aforementioned SpamCop Forum "thread" in his fourth paragraph?

[Pnutz]

...Since you're a customer, could you use the same tactics as employed by contributor "billyreubin" in the aforementioned SpamCop Forum "thread" in his fourth paragraph?

I have spoken with a Cisco Rep and do have a support ticket open but so far I have only been instructed to email support [at] senderbase I will follow up with my Cisco Rep tomorrow and update this thread.

[turetzsr]

I have spoken with a Cisco Rep and do have a support ticket open but so far I have only been instructed to email support [at] senderbase I will follow up with my Cisco Rep tomorrow and update this thread.

...Sounds good, thank you! <g>

[Farelf]

...I'm contacting you regarding our Domain lhfp.com and our reputation score for our mail server "mail.lhfp.com" (70.102.2.114 ) being listed as Poor. ...

Your old MX IP address (66.93.42.26) appears to still be active:

http://www.robtex.com/dns/lhfp.com.html

mx 1 mail.lhfp.com

294 days old

66.93.42.26

United States

66.92.0.0/15

Speakeasy Inc.

AS23504

Speakeasy Inc.

The PTR is still set:

C:\Documents and Settings\Admin>nslookup

...

> set type=ptr

> 66.93.42.26

...

Non-authoritative answer:

26.42.93.66.in-addr.arpa name = mail.lhfp.com

>

I have no idea how/why that affects you but I suspect it may be doing your SB reputation score no good [edit - that is, at least two different IP addresses point to mail.lhfp.com on rDNS lookup]. You probably need to contact Speakeasy.net to get that (old) record scrubbed.

HTH

[Pnutz]

Thanks All, I will contact Speakeasy and have them scrub our old rDNS Entry.

I was finally able to get a hold of someone over at Cisco Ironport and what was happening is a couple of our reporting servers had an incorrect HELO string. "Server.domain.local" and not "mail.lhfp.com" They were able to set my reputation score back to neutral while I made the fixes.

I went ahead and re-configured the FQDN name within the MS SMTP server config under IIS. Also I'm in the process of going thru and checking other devices as well that may send email (Copiers /w scan to email functionality) and make sure all have the correct HELO String.

JP

[turetzsr]

Hi, JP,

...Thanks for the update! It sounds like you now have a handle on things and had your main issue (poor SB reputation score) remedied, so I'll take the leap and mark this "thread" as "Resolved."