frazier Posted November 1, 2006 Share Posted November 1, 2006 I have done some searching. I have found my way here. No small feat, since on spam cop's web site there is absolutely no links to ANY of these forums or anything else, for that matter. I have to think that's purposeful, too many people might lodge complaints. I am also clueless, get over it. Deal with it instead of being pompous (I did read lots of the forums before this post). Here's MY story. I own six or so domains, all hosted though dreamhost.com [my lever of cluelessness? I haven't progressed past programming in simple html] E-mail from my latest site (headers below), set up to promote my musical group, is being blocked... by spam cop. This is hard to understand, because in the two months the site has been up, I've sent a grand total 34 (count them, THIRTY FOUR TOTAL) e-mails, mostly to my band mates, and spam COP BLOCKS THEM. None of my other site's mail get blocked! How the hell does this happen? I read that if you just wait 24 hours, the block comes off. Big freaking deal, how the hell does it go on in the first place?? 34 freaking e-mails!! Dreamhost tells me that it isn't just my latest site, but that spamcop blocks mail from ALL of dreamhost's sites. As I said before, none of my mail from my other sites is being blocked, so I'd like to know how and what is going on? Here are the headers from one of the blocked e-mails: ~~~~~~~~~~~~~~~~ Return-Path: <> X-Original-To: frazier[at]memoryleakmusic.com Delivered-To: m8428014[at]postalmail-a1.dreamhost.com Received: by postalmail-a1.dreamhost.com (Postfix) id 4C11D8B4F; Fri, 22 Sep 2006 20:35:14 -0700 (PDT) Date: Fri, 22 Sep 2006 20:35:14 -0700 (PDT) From: MAILER-DAEMON[at]postalmail-a1.dreamhost.com (Mail Delivery System) Subject: Undelivered Mail Returned to Sender To: frazier[at]memoryleakmusic.com MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary="2045985B3.1158982514/postalmail-a1.dreamhost.com" Message-Id: <20060923033514.4C11D8B4F[at]postalmail-a1.dreamhost.com> Content-Description: Notification Content-Type: text/plain This is the Postfix program at host postalmail-a1.dreamhost.com. I'm sorry to have to inform you that your message could not be be delivered to one or more recipients. It's attached below. For further assistance, please send mail to <postmaster> If you do so, please include this problem report. You can delete your own text from the attached returned message. The Postfix program <ppanyon[at]pgcc.edu>: host locutus.pgcc.edu[66.240.9.132] said: 554 5.7.1 208.97.132.78: blacklisted by real-time blacklist bl.spamcop.net (in reply to RCPT TO command) Content-Description: Delivery report Content-Type: message/delivery-status Reporting-MTA: dns; postalmail-a1.dreamhost.com X-Postfix-Queue-ID: 2045985B3 X-Postfix-Sender: rfc822; frazier[at]memoryleakmusic.com Arrival-Date: Fri, 22 Sep 2006 20:35:01 -0700 (PDT) Final-Recipient: rfc822; ppanyon[at]pgcc.edu Action: failed Status: 5.0.0 Diagnostic-Code: X-Postfix; host locutus.pgcc.edu[66.240.9.132] said: 554 5.7.1 208.97.132.78: blacklisted by real-time blacklist bl.spamcop.net (in reply to RCPT TO command) Received: from [192.168.0.4] (c-69-138-255-219.hsd1.md.comcast.net [69.138.255.219]) by postalmail-a1.dreamhost.com (Postfix) with ESMTP id 2045985B3; Fri, 22 Sep 2006 20:35:01 -0700 (PDT) Mime-Version: 1.0 Message-Id: <p06230901c13a5be25296[at][192.168.0.4]> Date: Fri, 22 Sep 2006 23:35:00 -0400 To: joe[at]memoryleakmusic.com, ppanyon[at]pgcc.edu From: Frazier <frazier[at]memoryleakmusic.com> Subject: Practice Content-Type: text/plain; charset="us-ascii" ; format="flowed" <x-flowed>Actually, I can't make practice on Monday, previous commitment. Wed is good though... at Joe's? </x-flowed> ~~~~~~~~~~~~~~~~ So, do any of you vaunted experts have any clue how this happens. More importantly how can I get this to STOP? Frazier [not a troll, but feed me anyway] Link to comment Share on other sites More sharing options...
StevenUnderwood Posted November 1, 2006 Share Posted November 1, 2006 Spamcop does not do the blocking, the receiving server does, as is their right. There is information in the SpamCop FAQ linked at the top of every page. Look for "Why am I blocked". 208.97.132.78 not currently listed in bl.spamcop.net It is also not on any of the most popular lists. There are no user reports visible within the last month from that IP address. Some probable reasons for the listing (if it was spamcop): http://www.spamcop.net/bl.shtml?208.97.132.78 If you use the search at the top of the page and enter dreamhost, you will see several people with the same issue. Dreamhost either does not control their spammers, or is allowing misdirected bounces to be sent from their servers. Link to comment Share on other sites More sharing options...
DavidT Posted November 1, 2006 Share Posted November 1, 2006 on spam cop's web site there is absolutely no links to ANY of these forums or anything else, for that matter. Hmm...let's test that hypothesis....I'm starting at: http://www.spamcop.net (You didn't happen to go to "spamcop.com" instead, did you? That site has nothing to do with the *real* SpamCop.) Then I clicked on "Help" and there were plenty of links, including to these forums. (I did read lots of the forums before this post). OK, that's good....but was it random reading, or did you manage to hit the important messages, such as "Start Here - before you make your first Post" or "Going to make your first post here?" or "Want to post about your email being blocked?" It doesn't really sound as if you did. So, do any of you vaunted experts have any clue how this happens. More importantly how can I get this to STOP? Actually, the simple answer is to find a better web hosting provider. It seems that their servers are configured in such a way that they send "after the fact" undeliverable notices, aka "backskatter" which is often sent to innocent victims whose addresses happen to be forged on the "From:" line of incoming spam. This results in mail going out to "spamtrap" addresses, which is probably why the Dreamhost IPs wind up getting listed on the SCBL. Here's a link to a recent topic here about that: http://forum.spamcop.net/forums/index.php?showtopic=6928 So, until Dreamhost changes the way they handle undeliverable incoming messages, you'll see this happening on an off, no matter how few messages you send, because the outgoing IP in your messages is shared with hundreds of other domains/users on your shared server. So, if I were you, I'd quickly shop around for a new host that rejects undeliverable messages *during* the incoming session....here's a link to a FAQ about this: http://www.spamcop.net/fom-serve/cache/329.html (it's also about autoresponders, but misdirected bounces is the part I'm talking about) BTW, about your band's website (a "Baby Boomer" band)....I have a free tip....you *really* need to convert all those "WAV" files to MP3s ASAP! Some of them are over 60 megs....HOLY COW! You can get a freeware (or shareware -- I use dBpowerAMP at: http://www.dbpoweramp.com) converter and quickly shrink those files down to less than 10% of their original size...I just compressed the first "Can't do that" on your site down to about 2.5 megs. Send me a PM if you have any questions about that. Peace, DT Link to comment Share on other sites More sharing options...
Wazoo Posted November 1, 2006 Share Posted November 1, 2006 I have done some searching. I have found my way here. No small feat, since on spam cop's web site there is absolutely no links to ANY of these forums or anything else, for that matter. I have to think that's purposeful, too many people might lodge complaints Strange ... the Help link takes me right to a page with a list of stuff and places ... yes, I do wish I could fix/change that page, but ... the point is, it's readily available. I am also clueless, get over it. Deal with it instead of being pompous (I did read lots of the forums before this post). I'm not sure then why the Lounge was chosen for a BL Help issue. Noting that the Subject Line entered also leaves a lot to be desired .... Simply noting facts would be seen as far from "being pompous" ... Here's MY story. I own six or so domains, all hosted though dreamhost.com So right off, the usual appearance there is that you are sharing ither resources with other Dreamhost users. E-mail from my latest site (headers below), set up to promote my musical group, is being blocked... by spam cop. One doesn't normally 'send' e-mail 'from a web-site' .... Blocking is not done by SpamCop.net ... any blocking action is performed by the receiving ISP. This is hard to understand, because in the two months the site has been up, I've sent a grand total 34 (count them, THIRTY FOUR TOTAL) e-mails, mostly to my band mates Interesting, in that it appears that the e-mail server at that IP address has been 'turned off' .... http://www.senderbase.org/search?searchString=208.97.132.78 Volume Statistics for this IP Magnitude Vol Change vs. Average Last day ........ 0.0 .. -100% Last 30 days .. 0.2 .. -100% Average ........ 3.4 Back when it was 'working' .. per the SpamCop FAQ found 'here' .. the entry titled SenderBase's "Magnitude" Explained that server had built up an 'average' of approximately 4 or 5 thousand e-mails a day .... your 34 e-mails simply wouldn't be 'visible' .... and spam COP BLOCKS THEM. None of my other site's mail get blocked! How the hell does this happen? I read that if you just wait 24 hours, the block comes off. Big freaking deal, how the hell does it go on in the first place?? 34 freaking e-mails!! Hard to guess at just what you did read in here, based on the fact that you have missed so many of the basic principles of how this all works. SpamCop.net blocks nothing, the SpamCopDNSBL is based on the IP address of the spewing server, nothing to do with "your e-mail address or Domain name" .... Based on data seen at the sam SenderBase page referenced above; # of domains controlled by this network owner ... 738 Addresses in dreamhost.com used to send email .... Showing 1 - 50 out of 84 What makes you so sure that "all" of your e-mail is handled by that same server? Dreamhost tells me that it isn't just my latest site, but that spamcop blocks mail from ALL of dreamhost's sites. As I said before, none of my mail from my other sites is being blocked, so I'd like to know how and what is going on? Dreamhost apparently hasn't got a clue either .... specific facys & details are provided in the above references and call-outs. So, do any of you vaunted experts have any clue how this happens. More importantly how can I get this to STOP? That's why the FAQ was created .... give it a try, please .... With this post, Topic is being moved to the BL Help Forum section, as that's the subject matter under discussion. Link to comment Share on other sites More sharing options...
frazier Posted November 1, 2006 Author Share Posted November 1, 2006 Spamcop does not do the blocking, the receiving server does, as is their right. There is information in the SpamCop FAQ linked at the top of every page. Look for "Why am I blocked". I tried that, and after a while had about 8 different open pages of FAQs, forums, discussion, etc. It was just *too* much. I'm a baby boomer musician, and none of this was really clear 208.97.132.78 not currently listed in bl.spamcop.net It is also not on any of the most popular lists. There are no user reports visible within the last month from that IP address. Yep, I got the same thing when I put those numbers in... assuming I was right in my choice of numbers. Nevertheless, out of 10 e-mails sent to my friend, three of them got bounced. I have sent the URL link to this entire discussion to the support team at Dreamhost, we'll see what they come back with. Perhaps... Frazier Link to comment Share on other sites More sharing options...
agsteele Posted November 1, 2006 Share Posted November 1, 2006 Yep, I got the same thing when I put those numbers in... assuming I was right in my choice of numbers. Nevertheless, out of 10 e-mails sent to my friend, three of them got bounced. It would really help to see the exact bounce message. That might give a clue as to the source of the problem. Sometimes ISPs use the term SpamCop as a shorthand for some-blocklist-somewhere. So, you find SpamCop taking the rap for another service. Sometimes the listing was only short-term and by the time you come along to check everything has cleared so you can't see any evidence of having been listed. In either of these scenarios nobody here can really help you further. Only the SpamCop admins have access to the extinct data. In that case you can take it up with deputies[at]spamcop.net Andrew Link to comment Share on other sites More sharing options...
DavidT Posted November 1, 2006 Share Posted November 1, 2006 Regarding Dreamhost and bad bounces....although I posted a link to a discussion from August that had evidence of misdirected bounces coming from a Dreamhost server, I just tried sending to a bogus address at your domain, and it was properly rejected *during* the SMTP session with my ISP, so it's very possible that Dreamhost has corrected that problem (assuming that it existed) sometime recently, perhaps even after those problems you had with bouncing messages. This would explain why things look "clean" now, but there were problems a while ago. DT Link to comment Share on other sites More sharing options...
frazier Posted November 1, 2006 Author Share Posted November 1, 2006 Regarding Dreamhost and bad bounces....although I posted a link to a discussion from August that had evidence of misdirected bounces coming from a Dreamhost server, I just tried sending to a bogus address at your domain, and it was properly rejected *during* the SMTP session with my ISP, so it's very possible that Dreamhost has corrected that problem (assuming that it existed) sometime recently, perhaps even after those problems you had with bouncing messages. This would explain why things look "clean" now, but there were problems a while ago. DT ~~~~~~~~~~~~~ They're trying, here's their response to all of this: We are continuing to make modifications to our mail configuration to provide an eventual permanent solution to this problem. This is not an easy process, because we are not being blocked in Spamcop due to original spam -- we are being intermittently blocked due to bounced mail (when someone e-mails you, and an over-quota bounce is sent, Spamcop considers this spam) forwards (when DreamHost customers forward mail to an external account and then submit a spam complaint for spam that may have been forwarded through our servers, this counts against us), and autoresponders, which they also consider spam. We're trying to find a balance between still offering extra email services (such as forwards and autoresponders, and even standard things like over-quota bounces) while fine-tuning things so that Spamcop doesn't trigger on our IPs so often. In the meantime we do not recommend that you forward mail to Spamcop-protected addresses, and download it directly from our servers. Also, when a Spamcop block does crop up, you can still mail to Spamcop-protected addresses by sending via webmail, which sends on a separate set of IPs. Finally, if your recipient has control over the blacklists they use, you may wish to suggest that they utilize other blacklists that do not block quite so liberally for non-original spam. While backscatter certainly is a problem and we're working to minimize it as much as possible, we don't believe throwing out buckets of legitimate email in the process is the answer. Thank you for your patience while we continue to address this problem. Link to comment Share on other sites More sharing options...
DavidT Posted November 1, 2006 Share Posted November 1, 2006 That sounds like a reasonable answer from Dreamhost. Looking at the recent reports for that other IP address (cited in the other topic I linked above), I'm wondering if perhaps there's a SpamCop user who receives mail at a Dreamhost-hosted domain who hasn't configured their "mailhosts" and who therefore is accidentally reporting Dreamhost, after their mail is forwarded to another off-server location. Perhaps you can PM me and I'll try to give them enough info to go to the Deputies with, so that the recent reports can be inspected, and Dreamhost can be exonerated, if appropriate. Also, be sure to come back and post here as quickly as possible if you think your IP has been blocked again. DT Link to comment Share on other sites More sharing options...
turetzsr Posted November 1, 2006 Share Posted November 1, 2006 That sounds like a reasonable answer from Dreamhost. <snip> ...Not the following part! <g><snip> [Answer from Dreamhost:] While backscatter certainly is a problem and we're working to minimize it as much as possible, we don't believe throwing out buckets of legitimate email in the process is the answer. <snip> Link to comment Share on other sites More sharing options...
DavidT Posted November 1, 2006 Share Posted November 1, 2006 Depends upon one's perspective. I just did some checking of six additional Dreamhost IPs mentioned back in that August topic as 'Other hosts in this "neighborhood" with spam reports' and it does indeed look as if Dreamhost has gotten a handle on most of their backscatter....at least from all but one of those hosts. Sounds like they're actively trying to solve their problem. But I saw additional evidence on one of the servers of what looks like another SpamCop reporting user whose lack of proper mailhost config is giving them undeserved black marks. I'm willing to give them the benefit of the doubt, even though I initially was leery of them. Besides....these folks: http://dreamhost.com/aboutus-profiles.html look like nice people, AFAICT. ;-) DT Link to comment Share on other sites More sharing options...
StevenUnderwood Posted November 1, 2006 Share Posted November 1, 2006 It would really help to see the exact bounce message. That might give a clue as to the source of the problem. Sometimes ISPs use the term SpamCop as a shorthand for some-blocklist-somewhere. Andrew: This was provided in the very first post. Link to comment Share on other sites More sharing options...
agsteele Posted November 2, 2006 Share Posted November 2, 2006 Andrew: This was provided in the very first post. Sorry, missed the relevant stuff in the middle of all the headers etc Andrew Link to comment Share on other sites More sharing options...
petzl Posted November 6, 2006 Share Posted November 6, 2006 ~~~~~~~~~~~~~ They're trying, here's their response to all of this: We are continuing to make modifications to our mail configuration to provide an eventual permanent solution to this problem. This is not an easy process, because we are not being blocked in spam-cop due to original spam. If one considers email important it is best NOT automatically to accept an ISP's! SpamCop offer a continuously improving worlds best standard in email accounts, "SpamCop Email" Reality is if a email system is being bounced by SpamCop members SCBL it is because the ISP handling email is blatantly incompetent. Bounces to email addresses are added to the SCBL score through members (free and Paid) reporting Joe jobs to which an abuse report is sent to that ISP If an ISP is idiotic enough to mindlessly send bounces from spammers many of those bounces will hit SpamCops spamtraps after an overdose of hits SpamCop will list that server releasing when the spam stops. Other blocklists aside from our SCBL will also list ISP's (many are major ones like ALO, MSN) sending bounces and spam to spamtraps also. Often secret blocklists are set up by ISP's who do nothing but "bit-bin" email from systems hitting their spamtraps without notification. Getting removed from these blocklists is almost impossible ALL listings on our SCBL have attempted to send a report to ISP concerned (This is not guaranteed to ISP's who are spam friendly and found to divulge personal details of SpamCop Members). Normal spam reported by members, SpamCop will only block a computer that is sending that spam IF your ISP has it's system competantly set up. If you find your computer blocked by our SCBL it means either a user of it is sending spam or your computer has been hacked! In which case, aside from sending spam, all information on it is available to any thug who wants it (things like where you live, when you are or are not home, phone number, Bank/credit card details, etc, etc) This all said makes the SCBL the most accurate and best blocklist to use as it stops spam AS it is being sent not after. Spammers use millions/billions of email addresses which take days to send. SpamCop can block it in seconds releasing IP when spam stops being reported. Again if ISP is competantly set-up it is only the individual computer that is blocked. A big plus in using our SCBL is that aside from the bluster, it makes ISP's become aware and compliant making the Internet much much more secure To avoid being hacked and turned into a zombie my Signature suggests freeware protection Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.