Jump to content

SpamCop is bouncing my emails


chibbard

Recommended Posts

Posted

Hi,

About three weeks ago, a few people trying to email me said that they were getting bounces back that their messages were undeliverable. The message bounce said that SpamCop had blacklisted the address or domain. However, I can't find any way that SpamCop is even associated with me. My ISP and domain host are also completely baffled how SC could be blocking these messages. Anyone know how to trace this? Thanks!

Here's the error message:

The following addresses had permanent fatal errors -----

<casey[at]compelling-cases.com>

(reason: 550-Message rejected because mail.cybermesa.com [198.59.109.2]

is blacklisted)

----- Transcript of session follows -----

... while talking to mail.compelling-cases.com.:

>>> DATA

<<< 550-Message rejected because mail.cybermesa.com [198.59.109.2] is

blacklisted

<<< 550 at bl.spamcop.net see Blocked - see

http://www.spamcop.net/bl.shtml?198.59.109.2

550 5.1.1 <casey[at]compelling-cases.com>... User unknown

<<< 503 valid RCPT command must precede DATA

Reporting-MTA: dns; mail.cybermesa.com

Received-From-MTA: DNS; [65.19.15.45]

Arrival-Date: Wed, 24 Aug 2005 13:53:07 -0600

Final-Recipient: RFC822; casey[at]compelling-cases.com

Action: failed

Status: 5.1.1

Remote-MTA: DNS; mail.compelling-cases.com

Diagnostic-Code: SMTP; 550-Message rejected because mail.cybermesa.com

[198.59.109.2] is blacklisted

Last-Attempt-Date: Wed, 24 Aug 2005 13:53:11 -0600

Posted
Hi,

About three weeks ago, a few people trying to email me said that they were getting bounces back that their messages were undeliverable. The message bounce said that SpamCop had blacklisted the address or domain. However, I can't find any way that SpamCop is even associated with me. My ISP and domain host are also completely baffled how SC could be blocking these messages. Anyone know how to trace this?

<snip>

32234[/snapback]

Hi, chibbard,

...Either your ISP or your MSP (e-mail server provider) is blocking the e-mail and generating the message that the host (which is where the e-mail is coming from) is blacklisted! Sometimes, ISPs and MSPs generate misleading messages -- it may not be SpamCop that is the reason the messages are blocked.

...If you follow the link in the rejection message ("http://www.spamcop.net/bl.shtml?198.59.109.2"), you will see a note that this address is not blocked. However, this information is not real-time; also, the SpamCop block list is dynamic, so that this IP address might have been on the block list at the time the other person's e-mail arrived at your ISP or MSP but has since dropped off because there have been no further spam reports.

...Following the link on the bl.shtml page labeled "Trace IP," I note that the abuse address responsible for 198.59.109.2 "does not wish to receive reports regarding" the IP address -- this suggests to me that they are not much interested in stopping spam coming from that machine and so the person trying to send you her/his mail might wish to look into finding another provider.

Posted
<<< 550 at bl.spamcop.net see Blocked - see

http://www.spamcop.net/bl.shtml?198.59.109.2

32234[/snapback]

At the time it was having the problem, did you follow the link above to see why it was listed? Specifically, the link labeled: Information about the reasons for listing (blocking) your mail server (198.59.109.2). Right now your systems are not listed. I see no actual old reports against your IP address which leads me to believe you were generating messages to the spamcop spam trap addresses. Right now I have no way to confirm this. You may want to read the web page you are directed to by the email error. There are several methods listed there that can get legitimate servers listed.

I see that you or your administrators are not interested in getting any spam reports about spam coming from your servers.

Parsing input: 198.59.109.2

host 198.59.109.2 (getting name) = mail.cybermesa.com.

[report history]

ISP does not wish to receive report regarding 198.59.109.2

ISP does not wish to receive reports regarding 198.59.109.2 - no date available

Routing details for 198.59.109.2

Report routing for 198.59.109.2: abuse[at]cybermesa.com

Posted
<snip>

Right now your systems are not listed.

<snip>

I see that you or your administrators are not interested in getting any spam reports about spam coming from your servers.

32236[/snapback]

Hi, Steven,

...Am I correct that it is not clibbard's sending IP that is being blocked, but rather that of the person trying to send to her/him?

<snip>

About three weeks ago, a few people trying to email me said that they were getting bounces back that their messages were undeliverable.

<snip>

Posted
Hi, Steven,

...Am I correct that it is not clibbard's sending IP that is being blocked, but rather that of the person trying to send to her/him?

<snip>

About three weeks ago, a few people trying to email me said that they were getting bounces back that their messages were undeliverable.

<snip>

32239[/snapback]

Yes, you are correct, I was thinking backward on that. The people controlling: mail.compelling-cases.com seem to be doing the blocking.

That's what I get for trying to fit responses between meetings :(

Posted
Hi, Steven,

...Am I correct that it is not clibbard's sending IP that is being blocked, but rather that of the person trying to send to her/him?

<snip>

About three weeks ago, a few people trying to email me said that they were getting bounces back that their messages were undeliverable.

<snip>

32239[/snapback]

Title of this post does not seem to match the write-up, exactly. Then not explained is how the "error message" was captured.

My take: chibbard's ISP has started using the SpamCopDNSBL.

Some incoming e-mail got blocked. Time passed, questions asked, bunch of folks without a clue involved. Of course, answers are here, but ... by now, the critical data is missing. So best I can suggest is the usual reference to the Why am I Blocked? entry and the SpamCop FAQ here ... not to ignore the Pinned items and the existing Topics/Discussions ....

noting that there is another issue showing;

550 5.1.1 <casey <at> compelling-cases.com>... User unknown

not sure what to say about that ....

Posted
<snip>

Here's the error message:

The following addresses had permanent fatal errors -----

<munged: casey [at] compelling-cases [dot] com>

    (reason: 550-Message rejected because mail.cybermesa.com [198.59.109.2]

is blacklisted)

<snip>

32234[/snapback]

Hi, chibbard,

...If your e-mail address is included in your post, you may want to munge (disguise) it. You can do that by clicking on the "Edit" button under your message, above, and changing the text to something like "[casey [at] compelling-cases [dot] com" or even just "<munged my e-mail addy>." Doing this will keep spiders from capturing your e-mail address to add to those used by spammers. Note that it's there three times!

Posted

32239[/snapback]

noting that there is another issue showing;

550 5.1.1 <casey <at> compelling-cases.com>... User unknown

not sure what to say about that ....

32244[/snapback]

There is a sample or two, looks like many in the thread in Sightings.

Looks to me like backscatter and it looks like a fake bounce from some email client or a poorly setup server and is sending back to the from address and that is probably what got them listed.

And yes, I agree it looks strange the sample posted looks the same way.

http://groups.google.com/group/news.admin....f7daa94b4303f02

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...