Blocked but not blocked??

[HughSt]

Hi,

New to forum but I hope you can help.

A colleague uses Lyris to check his newsletter, the newsletter has our URL (www.meta-nlp.o.uk) contained within it.

When our colleague processes his newsletters the following report is given by Lyris:

"This report evaluates the test message (reproduced below)

that you recently sent from Lyris ListManager. ListManager

filters your message through spam Assassin, a popular anti-

spam program, to determine if it has characteristics typical of

unsolicited "spam" mail.

If your message fails a particular spam-detection test, spam

Assassin assigns it a certain number of points. After all of the

tests are complete, your points are summed and presented

as a total score. Lower scores are better -- they indicate that

your message has fewer traits common to junk mail. Ideally,

you want to get your message close to 0 points.

Some of spam Assassin's tests work the other way around: if

you pass them, they assign your message a certain number

of *negative* points. This helps reduce your overall score.

Your message's score: 2.511

If your score is greater than 5, we recommend that you revise

your message to conform better to industry anti-spam

criteria. Your score is comprised of points from the following

spam Assassin tests:

0.1 FORGED_RCVD_HELO Received: contains a forged

HELO

1.8 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a

relay in bl.spamcop.net

[blocked - see <

http://www.spamcop.net/bl.shtml?64.62.197.77>]

0.6 URIBL_SBL Contains an URL listed in the SBL

blocklist

[uRIs: meta-nlp.co.uk]

I have checked our IPAddress and MXaddress and cannot find any spam blockage. I would be grateful for any ideas of where to go next - I have emailed Lyris but no reply yet.

Many thanks

Hugh

[agsteele]

1.8 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a

relay in bl.spamcop.net

[blocked - see <

http://www.spamcop.net/bl.shtml?64.62.197.77>]

0.6 URIBL_SBL Contains an URL listed in the SBL

blocklist

You are correct that the IP address quoted is not in the SCBL and doesn't appear to have any reports recorded for it.

Sometimes, reports attribute a listing the SpamCop blocklist whereas the listing is in an entirely different BL and the narrative incorrectly cites SpamCop.

At this point SenderBase also confirms that the provided IP address is not listed in any blocklists at all.

Perhaps it was a temporary error.

Andrew

[dbiel]

Your message's score: 2.511

As you quoted below, that is a fairly low score and should not result in any message being blocked.

If your score is greater than 5, we recommend that you revise

your message to conform better to industry anti-spam

criteria. Your score is comprised of points from the following

spam Assassin tests:

0.1 FORGED_RCVD_HELO Received: contains a forged

HELO

I would check you mail headers and make sure your servers are using valid "HELO" entries.

1.8 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a

relay in bl.spamcop.net

[blocked - see <

http://www.spamcop.net/bl.shtml?64.62.197.77>]

This one is a bit more confusing. The link displays

64.62.197.77> is not a routeable IP address

0.6 URIBL_SBL Contains an URL listed in the SBL

blocklist

[uRIs: meta-nlp.co.uk]

The phrase "SBL" is a bit confusing here as it generally applies to The Spamhaus Block List which does not contain URL's. It uses IP addresses. So it would appear that it is refer to the entire spam Assassin phrase "URIBL_SBL" The following quote and link may be helpful

spam URI Realtime BlockLists are a relatively recent technique and SpamAssassin 3.0 supports a relatively small number of SURBLs. SURBLs are configured much like RBLs. SpamAssassin 2.63 can use a different plug-in, described later. Details on SURBLs can be found at http://www.surbl.org.

[HughSt]

You are correct that the IP address quoted is not in the SCBL and doesn't appear to have any reports recorded for it.

Sometimes, reports attribute a listing the SpamCop blocklist whereas the listing is in an entirely different BL and the narrative incorrectly cites SpamCop.

At this point SenderBase also confirms that the provided IP address is not listed in any blocklists at all.

Perhaps it was a temporary error.

Andrew

Thanks for your reply Andrew . The Ip address is that of Lyris! not ours. The siutaion is on-going for the last 2 months on checks carried out on 2 seperate newsletter.

Rgrds

Hugh

[agsteele]

Thanks for your reply Andrew . The Ip address is that of Lyris! not ours. The siutaion is on-going for the last 2 months on checks carried out on 2 seperate newsletter.

Of course, your own IP could be listed (although not mentioned in the report provided). If you would like to provide your own mail server IP I'm sure someone will put it through the system and see if anything else shows up.

But at this point, with the information provided so far this is not a SpamCop BL listing.

Andrew

[HughSt]

Of course, your own IP could be listed (although not mentioned in the report provided). If you would like to provide your own mail server IP I'm sure someone will put it through the system and see if anything else shows up.

But at this point, with the information provided so far this is not a SpamCop BL listing.

Andrew

Thanks again for the rapid response IPAddress 74.52.55.232 MX Addressess 74.52.67.242 & 69.93.124.50 Thanks

Hugh

[agsteele]

Thanks again for the rapid response IPAddress 74.52.55.232 MX Addressess 74.52.67.242 & 69.93.124.50

None of these IPs are currently listed.

The first two IPs have no recent reports at all.

69.93.124.50 has had a very small number of reports (3 in total) and so infrequent that the IP would not have been listed. (The reports related to three misdirected bounces in June and August).

As an aside, the two reports from August appear to originate from your end with the subject "Considered UNSOLICITED BULK EMAIL from you".

If you, or anyone on your system, is bouncing spam back to the supposed sender then this could lead to your IP being listed. It hasn't yet, as far as I can tell, but could do so. Bouncing spam is not advised since most spam comes with a forged sender so the Email gets bounced back either to an innocent party or, worse, to a spamtrap and then causes almost instant listing.

HTH

For now, there is no evidence that you are currently or have recently been listed in the SCBL.

Andrew