RE: Exchange 2007 IP Block List
I Google'd it and clicked the Help button on that screen. My IP Block List Providers are SpamHaus and SpamCop. Are you seeing that when one of them says an IP host is a spammer, it's automatically added to the IP Block List? Because in the process of troubleshooting, I had checked this particular IP address at both of those sites. Neither of them listed it... -Original Message- From: Michael B. Smith [mailto:[EMAIL PROTECTED] Sent: Tuesday, October 14, 2008 11:26 AM To: MS-Exchange Admin Issues Subject: RE: Exchange 2007 IP Block List Inquiring minds want to know: where did you dig around? :-) The IP Block List is populated by the IP Block List Providers that you specify one line down in the Anti-Spam configuration. Regards, Michael B. Smith, MCITP:SA,EMA/MCSE/Exchange MVP My blog: http://TheEssentialExchange.com/blogs/michael Link with me at: http://www.linkedin.com/in/theessentialexchange -Original Message- From: John Hornbuckle [mailto:[EMAIL PROTECTED] Sent: Tuesday, October 14, 2008 10:03 AM To: MS-Exchange Admin Issues Subject: Exchange 2007 IP Block List After several months of using Exchange 2007, I just became aware of the fact that IP addresses are automatically added to the IP Block List. Shame on me, I guess; I never realized that happened. This morning I got a call from a sysadmin for an organization that was unable to send mail to one of my users, and in troubleshooting I found them on the block list along with a bunch of other addresses that I never added. I'm digging around, though, and am coming up short on info about how, exactly, this happens. Under what circumstances does an IP get automatically added to that list? I notice that the automatically-added addresses have expiration dates/times. How long is an address blocked for that's put on the list automatically? Is that configurable? John Hornbuckle MIS Department Taylor County School District 318 North Clark Street Perry, FL 32347 www.taylor.k12.fl.us ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja~ ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja~ ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja~
RE: Exchange 2007 IP Block List
Thanks--that helped. It led me to this: http://technet.microsoft.com/en-us/library/aa998344(EXCHG.80).aspx What happened initially was that someone on the sender's side sent out a mass e-mail (not spam--but a message with numerous recipients). My server kicked it back to the sender. The sender then tried several more times to send the message, which probably bumped up their SRL rating to the point where their server's IP was blocked altogether. At that point, messages sent from them were rejected with a 5.7.1 message saying something to the effect of "you don't have permission to send to this address." -Original Message- From: Webster [mailto:[EMAIL PROTECTED] Sent: Tuesday, October 14, 2008 11:22 AM To: MS-Exchange Admin Issues Subject: RE: Exchange 2007 IP Block List > -Original Message- > From: John Hornbuckle [mailto:[EMAIL PROTECTED] > Subject: Exchange 2007 IP Block List > > After several months of using Exchange 2007, I just became aware of the > fact that IP addresses are automatically added to the IP Block List. > Shame on me, I guess; I never realized that happened. This morning I > got a call from a sysadmin for an organization that was unable to send > mail to one of my users, and in troubleshooting I found them on the > block list along with a bunch of other addresses that I never added. > > I'm digging around, though, and am coming up short on info about how, > exactly, this happens. Under what circumstances does an IP get > automatically added to that list? I notice that the automatically-added > addresses have expiration dates/times. How long is an address blocked > for that's put on the list automatically? Is that configurable? William Lefkovics', et al in The Complete Reference Microsoft Exchange Server 2007, page 540: Note: In addition to the manually entered IP addresses or ranges, IP Block Lists also get populated dynamically by the Sender Reputation filter... Webster ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja~ ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja~
RE: Exchange 2007 IP Block List
Verified and reported. Generally a document refresh happens every 6 to 8 weeks. Regards, Michael B. Smith, MCITP:SA,EMA/MCSE/Exchange MVP My blog: http://TheEssentialExchange.com/blogs/michael Link with me at: http://www.linkedin.com/in/theessentialexchange -Original Message- From: John Hornbuckle [mailto:[EMAIL PROTECTED] Sent: Tuesday, October 14, 2008 12:19 PM To: MS-Exchange Admin Issues Subject: RE: Exchange 2007 IP Block List By the way... That article states that the SRL block threshold defaults to 9. However, this page: http://technet.microsoft.com/en-us/library/bb124510(EXCHG.80).aspx Says it defaults to 7, and it was 7 on my server (and I've never changed it). -Original Message- From: John Hornbuckle [mailto:[EMAIL PROTECTED] Sent: Tuesday, October 14, 2008 12:11 PM To: MS-Exchange Admin Issues Subject: RE: Exchange 2007 IP Block List Thanks--that helped. It led me to this: http://technet.microsoft.com/en-us/library/aa998344(EXCHG.80).aspx What happened initially was that someone on the sender's side sent out a mass e-mail (not spam--but a message with numerous recipients). My server kicked it back to the sender. The sender then tried several more times to send the message, which probably bumped up their SRL rating to the point where their server's IP was blocked altogether. At that point, messages sent from them were rejected with a 5.7.1 message saying something to the effect of "you don't have permission to send to this address." -Original Message- From: Webster [mailto:[EMAIL PROTECTED] Sent: Tuesday, October 14, 2008 11:22 AM To: MS-Exchange Admin Issues Subject: RE: Exchange 2007 IP Block List > -Original Message- > From: John Hornbuckle [mailto:[EMAIL PROTECTED] > Subject: Exchange 2007 IP Block List > > After several months of using Exchange 2007, I just became aware of the > fact that IP addresses are automatically added to the IP Block List. > Shame on me, I guess; I never realized that happened. This morning I > got a call from a sysadmin for an organization that was unable to send > mail to one of my users, and in troubleshooting I found them on the > block list along with a bunch of other addresses that I never added. > > I'm digging around, though, and am coming up short on info about how, > exactly, this happens. Under what circumstances does an IP get > automatically added to that list? I notice that the automatically-added > addresses have expiration dates/times. How long is an address blocked > for that's put on the list automatically? Is that configurable? William Lefkovics', et al in The Complete Reference Microsoft Exchange Server 2007, page 540: Note: In addition to the manually entered IP addresses or ranges, IP Block Lists also get populated dynamically by the Sender Reputation filter... Webster ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja~ ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja~ ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja~ ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja~
RE: Exchange 2007 IP Block List
By the way... That article states that the SRL block threshold defaults to 9. However, this page: http://technet.microsoft.com/en-us/library/bb124510(EXCHG.80).aspx Says it defaults to 7, and it was 7 on my server (and I've never changed it). -Original Message- From: John Hornbuckle [mailto:[EMAIL PROTECTED] Sent: Tuesday, October 14, 2008 12:11 PM To: MS-Exchange Admin Issues Subject: RE: Exchange 2007 IP Block List Thanks--that helped. It led me to this: http://technet.microsoft.com/en-us/library/aa998344(EXCHG.80).aspx What happened initially was that someone on the sender's side sent out a mass e-mail (not spam--but a message with numerous recipients). My server kicked it back to the sender. The sender then tried several more times to send the message, which probably bumped up their SRL rating to the point where their server's IP was blocked altogether. At that point, messages sent from them were rejected with a 5.7.1 message saying something to the effect of "you don't have permission to send to this address." -Original Message- From: Webster [mailto:[EMAIL PROTECTED] Sent: Tuesday, October 14, 2008 11:22 AM To: MS-Exchange Admin Issues Subject: RE: Exchange 2007 IP Block List > -Original Message- > From: John Hornbuckle [mailto:[EMAIL PROTECTED] > Subject: Exchange 2007 IP Block List > > After several months of using Exchange 2007, I just became aware of the > fact that IP addresses are automatically added to the IP Block List. > Shame on me, I guess; I never realized that happened. This morning I > got a call from a sysadmin for an organization that was unable to send > mail to one of my users, and in troubleshooting I found them on the > block list along with a bunch of other addresses that I never added. > > I'm digging around, though, and am coming up short on info about how, > exactly, this happens. Under what circumstances does an IP get > automatically added to that list? I notice that the automatically-added > addresses have expiration dates/times. How long is an address blocked > for that's put on the list automatically? Is that configurable? William Lefkovics', et al in The Complete Reference Microsoft Exchange Server 2007, page 540: Note: In addition to the manually entered IP addresses or ranges, IP Block Lists also get populated dynamically by the Sender Reputation filter... Webster ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja~ ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja~ ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja~
RE: Exchange 2007 IP Block List
Huh. Learn something new every day (I don't have photographic memory like B'Bear!). Regards, Michael B. Smith, MCITP:SA,EMA/MCSE/Exchange MVP My blog: http://TheEssentialExchange.com/blogs/michael Link with me at: http://www.linkedin.com/in/theessentialexchange -Original Message- From: John Hornbuckle [mailto:[EMAIL PROTECTED] Sent: Tuesday, October 14, 2008 12:11 PM To: MS-Exchange Admin Issues Subject: RE: Exchange 2007 IP Block List Thanks--that helped. It led me to this: http://technet.microsoft.com/en-us/library/aa998344(EXCHG.80).aspx What happened initially was that someone on the sender's side sent out a mass e-mail (not spam--but a message with numerous recipients). My server kicked it back to the sender. The sender then tried several more times to send the message, which probably bumped up their SRL rating to the point where their server's IP was blocked altogether. At that point, messages sent from them were rejected with a 5.7.1 message saying something to the effect of "you don't have permission to send to this address." -Original Message- From: Webster [mailto:[EMAIL PROTECTED] Sent: Tuesday, October 14, 2008 11:22 AM To: MS-Exchange Admin Issues Subject: RE: Exchange 2007 IP Block List > -Original Message- > From: John Hornbuckle [mailto:[EMAIL PROTECTED] > Subject: Exchange 2007 IP Block List > > After several months of using Exchange 2007, I just became aware of the > fact that IP addresses are automatically added to the IP Block List. > Shame on me, I guess; I never realized that happened. This morning I > got a call from a sysadmin for an organization that was unable to send > mail to one of my users, and in troubleshooting I found them on the > block list along with a bunch of other addresses that I never added. > > I'm digging around, though, and am coming up short on info about how, > exactly, this happens. Under what circumstances does an IP get > automatically added to that list? I notice that the automatically-added > addresses have expiration dates/times. How long is an address blocked > for that's put on the list automatically? Is that configurable? William Lefkovics', et al in The Complete Reference Microsoft Exchange Server 2007, page 540: Note: In addition to the manually entered IP addresses or ranges, IP Block Lists also get populated dynamically by the Sender Reputation filter... Webster ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja~ ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja~ ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja~
RE: Exchange 2007 IP Block List
Inquiring minds want to know: where did you dig around? :-) The IP Block List is populated by the IP Block List Providers that you specify one line down in the Anti-Spam configuration. Regards, Michael B. Smith, MCITP:SA,EMA/MCSE/Exchange MVP My blog: http://TheEssentialExchange.com/blogs/michael Link with me at: http://www.linkedin.com/in/theessentialexchange -Original Message- From: John Hornbuckle [mailto:[EMAIL PROTECTED] Sent: Tuesday, October 14, 2008 10:03 AM To: MS-Exchange Admin Issues Subject: Exchange 2007 IP Block List After several months of using Exchange 2007, I just became aware of the fact that IP addresses are automatically added to the IP Block List. Shame on me, I guess; I never realized that happened. This morning I got a call from a sysadmin for an organization that was unable to send mail to one of my users, and in troubleshooting I found them on the block list along with a bunch of other addresses that I never added. I'm digging around, though, and am coming up short on info about how, exactly, this happens. Under what circumstances does an IP get automatically added to that list? I notice that the automatically-added addresses have expiration dates/times. How long is an address blocked for that's put on the list automatically? Is that configurable? John Hornbuckle MIS Department Taylor County School District 318 North Clark Street Perry, FL 32347 www.taylor.k12.fl.us ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja~ ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja~
RE: Exchange 2007 IP Block List
> -Original Message- > From: John Hornbuckle [mailto:[EMAIL PROTECTED] > Subject: Exchange 2007 IP Block List > > After several months of using Exchange 2007, I just became aware of the > fact that IP addresses are automatically added to the IP Block List. > Shame on me, I guess; I never realized that happened. This morning I > got a call from a sysadmin for an organization that was unable to send > mail to one of my users, and in troubleshooting I found them on the > block list along with a bunch of other addresses that I never added. > > I'm digging around, though, and am coming up short on info about how, > exactly, this happens. Under what circumstances does an IP get > automatically added to that list? I notice that the automatically-added > addresses have expiration dates/times. How long is an address blocked > for that's put on the list automatically? Is that configurable? William Lefkovics', et al in The Complete Reference Microsoft Exchange Server 2007, page 540: Note: In addition to the manually entered IP addresses or ranges, IP Block Lists also get populated dynamically by the Sender Reputation filter... Webster ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja~
