iContact emails: blacklisted by spamcop- help a newbie?

[1611mac]

First, thanks to all who respond.

I do web work for a company and they've asked me to help "fix" some email marketing issues. I don't know a lot about tracking down email problems.

They use iContact for an OPT-IN mail list (1600 subscribers). NO unsolicited emails have ever been sent out.

In going through the "bounced" report I cam across this:

5.0.0: 591 your host [[iP removed]] is blacklisted by bl.spamcop.net. No mail will be accepted

The line was received just as you see it.

1.) Why would the IP be removed? It is needed to track down problems, correct?

2.) Since iContact is being used, is it the iContact host that is blacklisted or the company server host? (How would they even know the company server host?)

As info, I entered the companies host ip into spam cop's blacklist check and it came up "negative."

Also, I am subscribed to the same list and I received the email with no problem. Here is a portion of the header. I entered the ip shown below [64.132.109.53] to spam cop ip check and it also came back "negative."

X-spam-Flag: NO

X-Envelope-From: bounces+399450.1017030004.1696380[at]icpbounce.com

Return-Path: <bounces+399450.1017030004.1696380[at]icpbounce.com>

Received: from drone061.ral.icpbounce.com (drone061.ral.icpbounce.com [64.132.109.53]) by mail8c40.carrierzone.com (8.13.6/8.13.1) with ESMTP id q6J8XGTY028043 for <greg[at]jump55.com>; Thu, 19 Jul 2012 04:33:18 -0400

[turetzsr]

Hi, 1611mac, welcome to the SpamCop Forum!

<snip>

In going through the "bounced" report I cam across this:

The line was received just as you see it.

1.) Why would the IP be removed? It is needed to track down problems, correct?

...It would be of use, yes, especially if there are multiple e-mail outgoing servers. And to reduce confusion, such as you seem to have experienced (based on your question, "is it the iContact host that is blacklisted or the company server host?"). <g>

2.) Since iContact is being used, is it the iContact host that is blacklisted or the company server host? (How would they even know the company server host?)

...It is the e-mail outgoing server.

<snip>

I entered the ip shown below [64.132.109.53] to spam cop ip check and it also came back "negative."

...If that is the IP address of the outgoing e-mail server, then there are (at least) two possible explanations for the apparent disconnect:

1. The error message could be incorrect in referring to SpamCop and it is either on a different BL or perhaps not on a public BL at all!
   
2. 24 hours may have elapsed since the last reported spam seen from that server and it has been removed from the SCBL.
   

[Farelf]

Looks like iContact.com is using (some of) icpbounce.com servers for outgoing. These are generally good - see http://www.senderbase.org/senderbase_queri...g=icpbounce.com

- but if you look through the pages (184 addresses and not necessarily the full complement) you see will the occasional IP address shown as being on the SCbl. SC lists for a maximum of 24 hours after spam stops, then the address times out of the blocklist. Looking at one of those listed right now (216.27.86.190 - http://www.spamcop.net/w3m?action=checkblo...p=216.27.86.190) I see that it has sent spam both to spam traps and to reporters. It is also reported "Other hosts in this "neighborhood" with spam reports" are 216.27.86.131 216.27.86.132 216.27.86.134 216.27.86.135 216.27.86.143 216.27.86.144 216.27.86.145 216.27.86.146 216.27.86.147 216.27.86.148 216.27.86.152 216.27.86.154 216.27.86.155 216.27.86.157 216.27.86.158 216.27.86.159 216.27.86.160 216.27.86.161 216.27.86.163 216.27.86.165 216.27.86.168 216.27.86.169 216.27.86.172 216.27.86.173 216.27.86.174 216.27.86.178 216.27.86.180 216.27.86.183 216.27.86.185

This looks like maybe low-volume stuff, pretty-much indistinguishable from "snowshoe" spam distribution in fact, though not necessarily deliberate, more likely a few bad addresses on some poorly-maintained newsletter distribution lists. Concerning 216.27.86.190 it is said "SpamCop users have reported system as a source of spam less than 10 times in the past week" and "In the past 77.0 days, it has been listed 4 times for a total of 3.3 days".

Those reports - from the submissions of each SC reporter in relation to 216.27.86.190 and presumably all of the others went to hostedsolutions.com and level3.net. Those are possibly a little too remote to dedicate much effort to keeping iContact.com's mail flowing and since multiple clients could the accessing the same hosts they may not even try. The SenderBase report (first link) shows iContact (Broadwick Corp./Preation Inc.) as a network using icpbounce.com hostnames. iContact could register with SC to receive notifications/reports in its own right which might improve its ability to react - http://www.spamcop.net/fom-serve/cache/94.html The SCbl (quickly on and quickly off) is really an early warning about the first instances of spam problems and the prospect of impending listing with others that might be slower to release. Refer http://multirbl.valli.org/dnsbl-lookup/ - 216.27.86.190 is already listed in one or two other serious blocklists.

I don't think iContact.com would be a favourite with SC users ("Our easy-to-use tools ... (for) sending messages and tracking opens and clicks." indeed!!!) but that's bye the bye. They don't seem to offer guaranteed deliverability (no-one can, actually, but many promise) so what sort of leverage their users might have to get them to address blocklisting more sedulously I don't know. On the positive side the icpbounce.com addresses all have "Good" SB Reputation Score ratings and that is not something maintained without real effort by someone, somewhere, to keep spam senders out and to fix any that seep in.

[petzl]

They use iContact for an OPT-IN mail list (1600 subscribers). NO unsolicited emails have ever been sent out.

In going through the "bounced" report I cam across this:

I entered the ip shown below [64.132.109.53] to spam cop ip check and it also came back "negative."

Seems a lot of reported as spam has been made for IP 64.132.109.53

Subjects are:

Jobs for Writers

$66K a month with NO website? (Seriously)

4:00 pm deadline

Aperture Health, Inc. Executes LOI to Acquire Doctors on Call

=?UTF-8?Q?=C2=A1Refresca_Tu_Verano!_Servicio_de_limpieza_y_mantenimiento_?= =...

Document Imaging and the Free SAP Content Server

Appointments Scheduled for You - Please RSVP

These likely to be approved email, or does someone have a compromised computer?

this subject looks to me like it maybe Portuguese (Brazil)

=?UTF-8?Q?=C2=A1Refresca_Tu_Verano!_Servicio_de_limpieza_y_mantenimiento_?= =...

If these subjects look OK there is something wrong with your opt-in.

Which should be Double Opt-In

which is where email is sent to those who are explicitly requesting it and confirming the email address to be their own.

This is usually done by responding to a confirmation email sent to the email address in question.

You need to do this if you have not done it. Occasionally you need to check again

[iContact Support]

First, thanks to all who respond.

I do web work for a company and they've asked me to help "fix" some email marketing issues. I don't know a lot about tracking down email problems.

They use iContact for an OPT-IN mail list (1600 subscribers). NO unsolicited emails have ever been sent out.

In going through the "bounced" report I cam across this:

The line was received just as you see it.

1.) Why would the IP be removed? It is needed to track down problems, correct?

2.) Since iContact is being used, is it the iContact host that is blacklisted or the company server host? (How would they even know the company server host?)

As info, I entered the companies host ip into spam cop's blacklist check and it came up "negative."

Also, I am subscribed to the same list and I received the email with no problem. Here is a portion of the header. I entered the ip shown below [64.132.109.53] to spam cop ip check and it also came back "negative."

Hello,

Yes those blacklist listings are for iContact's sending IP's. Our deliverability team handles these issues around the clock to ensure that service is not severely impacted. Typically spamcop listings for iContact only last a few hours thanks to our sending reputation. This is why the listing for our IP came up negative by the time you checked it.

If you have any other questions please don't hesitate to contact our excellent support team!

-iContact Support