Re: [mailop] Spamhaus and Vultr

[Lyle Giese via mailop]

Based on reading Spamhaus's page(referenced below), they will slowly 
block ALL Vultr ip address space from using the Spamhaus public 
mirrors.  Doesn't matter what the reverse IP address is.


But signing up for Spamhaus DQS free service, you merely change your 
configuration after getting a free DQS key from Spamhaus.


If you are querying their zen database, you have configured queries to 
use 'zen.spamhaus.org'. You change that to 
'your_DQS_key.zen.dq.spamhaus.net'


Lyle Giese

On 5/12/24 09:44, J Doe via mailop wrote:

Hi mailop,

I noticed that Spamhaus has posted a notice that after May 22nd, 
people and/or businesses making use of Vultr for their infrastructure 
will need to transition to a different way of querying the 
blocklists[1].  The post mentions that Vultr’s default reverse IP 
assignment masks who is querying the blocklists.


In my scenario, I have my own recursive, validating resolver running 
on my mail server on a Vultr instance and it has a reverse DNS name 
that is not the default one that Vultr assigns and I query: 
zen.spamhaus.org.


Do I still need to make changes ?

I am uncertain from the blog posting if this refers to people making 
use of the resolver that Vultr provides or if it extends to all of 
Vultr’s IP space (ie. all cloud instances).


Thanks,

- J

Links


[1]  See: 
https://www.spamhaus.org/resource-hub/email-security/if-you-query-the-legacy-dnsbls-via-vultr-move-to-spamhaus-technologys-free-data-query-service/#why-can't-vultr-users-query-the-public-blocklists


___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Microsoft 365 IP addresses listed on Spamcop

[Lyle Giese via mailop]

The suggestion to bug Microsoft are correct, I would also bug the 
support team at the receiving end of this.



From the SpamCop.net website:




The SCBL aims to stop most spam while not blocking wanted email. This is 
a difficult task. It is not possible for any blocking tool to avoid 
blocking wanted mail entirely. Given the power of the SCBL, SpamCop 
encourages use of the SCBL in concert with an actively maintained allow 
list of wanted email senders. SpamCop encourages SCBL users to tag and 
divert email, rather than block it outright. Most SCBL users consider 
the amount of unwanted email successfully filtered to make the risks and 
additional efforts worthwhile.



The SCBL is aggressive and often errs on the side of blocking mail. When 
implementing the SCBL, provide users with the information about how the 
SCBL and your mail system filter their email. Ideally, they should have 
a choice of filtering options. Many mailservers operate with blocking 
lists in a "tag only" mode, which is preferable in many situations.




SpamCop admits to being aggressive and sometimes errors on the side of 
blocking mail.  Based on SpamCop's policies, I would suggest that the 
receiving side of this equation should use the SpamCop listing as part 
of a spam scoring system rather than use SpamCop as a blocking RBL.


Lyle Giese

On 2/15/24 01:32, Christopher Hawker via mailop wrote:

Hello all,

I am attempting to send mail from a M365 tenancy, however, we are 
seeing issues with it being filtered due to the address appearing on 
bl.spamcop.net.


/"Decision Engine classified the mail item was rejected because of
IP Block (from outbound normal IP pools) -> 550 mail from
40.107.107.97 refused, see http://www.spamcop.net - Your mail
provider is blocked because is sending SPAM."/

If there is anyone on-list from Microsoft, could you please take a 
look? It's causing issues 🙁


Thanks,
Christopher Hawker

___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] zen.spamhaus.org

[Lyle Giese via mailop]

Are you/your company a subscriber to Spamhaus?

If you abuse free access, this can happen.

See for further information:

https://www.spamhaus.org/organization/dnsblusage/

Lyle Giese

On 2/6/24 14:50, Odhiambo Washington via mailop wrote:
Today morning I woke up to all emails being rejected as I was using 
zen.spamhaus.org  in my dnslists.
Almost all incoming emails - even from gmail.com  - 
were being rejected.

Did I maybe miss something?

--
Best regards,
Odhiambo WASHINGTON,
Nairobi,KE
+254 7 3200 0004/+254 7 2274 3223
 In an Internet failure case, the #1 suspect is a constant: DNS.
"Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-)
[How to ask smart questions: 
http://www.catb.org/~esr/faqs/smart-questions.html]


___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Question of SPF record

[Lyle Giese via mailop]

There are multiple ways to define multiple ip addresses in SPF. But you 
need first to contact IONOS support and find how what they use for 
outgoing ip addresses and I would bet you that they already know what 
you should put in your SPF record.


Lyle Giese

On 2/5/23 18:13, H via mailop wrote:

I have a domain with multiple email addresses hosted by Ionos. I have found 
that outgoing emails can come from a range of Ionos email IPs.

I have created a TXT record for my domain containing one IP4 address but 
outgoing emails seem to be sent from different IP4 addresses. As an example I 
now have:

v=spf1 a mx ip4:74.208.4.194 ~all

I know I can add at least one more ip4 address using the same format but I am 
not sure exactly what the Ionos email ip range might be so:

- Is there a way of saying eg. ip4:72.20.8.*

- Or should I delete the ip4 component and instead add:

include:mydomain.tld (corrected of course)

Suggestions appreciated!

Thanks.

___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Recommendations for host with good IP reputation or use external SMTP?

[Lyle Giese via mailop]

I personally have good luck with IONOS hosting for $10/month.  When I 
first started I had problems with AT&T but I was able to resolved and 
since it's been quiet.


I see a lot of crap plus pop3/smtp/imap login attempts from Digital 
Ocean for what it's worth.


I have my actual mail server at home and use the host instance as a 
smart host to relay email in and out bound.


Lyle

On 10/30/22 18:35, Ian Evans via mailop wrote:

I've been hosting my site and small postfix server (me and the missus
are the only accts) on Digitalocean since 2013.

Recently emails sent to a friend have started being rejected by
Vadesecure, which is used by their domain. That's really the only
problem I've had with deliveries in all this time. DO admits their IP
reputation sucks and so won't intervene with vadesecure on behalf of
my IP.

My friend is literally the only acct I have problems sending to and I
realize I could just use this gmail account, but this has become more
of project because I just want my self-hosted email server to be 100%.

I'm new to this list, so is there a thread in the archives that might
discuss VPS hosts with clean IPs? Is it better to use an external SMTP
provider whose whole biz is having clean IPs?

Thanks for any pointers.
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Email.it contact

[Lyle Giese via mailop]

whois for email.it references vipnet.it.  whois for vipnet.it references 
more info is availible at https://web-whois.nic.it


That shows email addresses for technical and admin contacts for vipnet.it

Lyle Giese


On 3/19/21 4:37 AM, Lindani Hlabangana via mailop wrote:

Good day,

Would anyone have a contact for email.it ?, we have 
tried abuse and postmaster with no response.


*
*

*Kind regards*



Lindani Hlabangana
Deliverability Operations Specialist

Dublin, Ireland

ltshaba...@groupon.com 

Displaying Groupon.gif


___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] [External] SURBL.org mirror broken

[Lyle Giese via mailop]

Fixed.

Lyle

On 2/23/21 11:12 AM, Kevin A. McGrail via mailop wrote:


On 2/22/2021 6:41 PM, Lyle Giese via mailop wrote:
38.124.232.194 is answering correctly. .193 is still malfunctioning 
and b.surbl.org is showing 34.124.232.193 as one of the A record.



Thanks.  I bcc'd the email yesterday and will follow-up.
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] [External] SURBL.org mirror broken

[Lyle Giese via mailop]

38.124.232.194 is answering correctly. .193 is still malfunctioning and 
b.surbl.org is showing 34.124.232.193 as one of the A record.


Thanks!

Lyle Giese

LCR Computer Services, Inc.

On 2/22/21 5:22 PM, Kevin A. McGrail via mailop wrote:
Lyle, that's the mirror my firm runs and we "fixed" a networking issue 
which likely broke this.


Can you query from 38.124.232.194?  I'll ask them to update 
b.surbl.org to include 38.124.232.194 instead of .193.


Thanks for raising the red flag on this.

Regards,
KAM

On 2/22/2021 4:48 PM, Lyle Giese via mailop wrote:
I found that one of their dns mirrors is broken.  38.124.232.193 is 
listed as one of 4 ip addresses for b.surbl.org.  It appears to not 
be functioning at this time.


dig @38.124.232.193 surbl-org-permanent-test-point.com.multi.surbl.org

Fails.

I went to the surbl.org website and their links to their mail lists 
claim no public mailing lists available, but that is what the website 
claims is their preferred communication method.  I don't need to hear 
from them directly, but this mirror appears to be broken and it 
either needs to be fixed or removed as an A record for b.surbl.org


Thanks,

Lyle Giese

LCR Computer Services, Inc.


___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

[mailop] SURBL.org mirror broken

[Lyle Giese via mailop]

I found that one of their dns mirrors is broken.  38.124.232.193 is 
listed as one of 4 ip addresses for b.surbl.org.  It appears to not be 
functioning at this time.


dig @38.124.232.193 surbl-org-permanent-test-point.com.multi.surbl.org

Fails.

I went to the surbl.org website and their links to their mail lists 
claim no public mailing lists available, but that is what the website 
claims is their preferred communication method.  I don't need to hear 
from them directly, but this mirror appears to be broken and it either 
needs to be fixed or removed as an A record for b.surbl.org


Thanks,

Lyle Giese

LCR Computer Services, Inc.


___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Microsoft antispam

[Lyle Giese via mailop]

I just looked at the dns entries for foddi.net. The A and  records 
for mx1.mail.foddi.net has a TTL of 120 seconds. For many mail providers 
that indicates a dynamic IP address.  It's been my experience that 12 
hrs is minimum(some prefer 24 hrs) TTL's on these records.


Lyle Giese

LCR Computer Services, Inc.


On 2/5/21 2:23 AM, Ale via mailop wrote:

Hello,

sorry if i ask something that's has already asked like a zillion times 
before.


I've setup a new mail server a month ago with an IPv4 that was already 
on Microsoft blacklist. Plus, i did a few mistakes and i tried to send 
some emails not properly configured with my domain.


I've setup my server only for testing and personal usage. I'm using 
exim4 with debian and I've changed only a few things, so I've just a 
basic configuration now.


I contacted Microsoft and I've got my IP unblocked, but still I see 
that on few outlook/hotmail accounts my email go on junk folder. I can 
send properly on every other domain.


My question is: if my server is properly configured, and i don't send 
ANY spam mail to anyone, there is the possibility that in the future 
my domain will get a greater sending score and my emails go to the 
inbox folder?


I ask to you because i think that you have a lot of experience and 
maybe you have a clue about how Microsoft antispam system works. 
Moreover I'm using a test server and i could easily change IP and 
domain, but i would like to keep the one i have now if possible.


thanks

Ale


___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] [E] AT&T sending messages to spam

[Lyle Giese via mailop]

AT&T outsourced their customer email services to Yahoo after Ameritech 
had outsourced their email to prodigy(many years ago and why you see the 
mx records pointing to prodigy.net).  Yahoo was purchased by what is now 
Verizon Media.  There is an active project ongoing to move email off to 
AT&T.  But it's been a multi-year project.  I know, I work as an IT 
consultant and here in the Chicago area, there are many of my customers 
still using ameritech.net email accounts.  Bellsouth.net is in the same 
shape.  Moved to Yahoo and now being moved to AT&T owned services.


When customers are moved off of Yahoo to AT&T, suddenly their Outlook 
doesn't work.  AT&T is using OAuth and if you have an old version of 
Outlook(2016 is considered old and doesn't support OAuth), you have to 
get a secure mail key to use instead of your normal password to access 
your email via Outlook.



Lyle

On 12/4/20 4:54 PM, Scott Mutter via mailop wrote:

Who is hosting mail for bellsouth.net  ?

bellsouth.net .          10571 IN      MX     
 10 ff-ip4-mx-vip2.prodigy.net .
bellsouth.net .          10571   IN      MX     
 10 al-ip4-mx-vip2.prodigy.net .
bellsouth.net .          10571   IN      MX     
 10 al-ip4-mx-vip1.prodigy.net .
bellsouth.net .          10571   IN      MX     
 10 ff-ip4-mx-vip1.prodigy.net .


Is bellsouth's mail handled by Verizon?  That'd be weird.

Have to assume that bellsouth.net 's email is 
being handled by AT&T, since bellsouth's MX records and AT&T's MX 
records are the same


att.net .                14400 IN      MX      5 
ff-ip4-mx-vip2.prodigy.net .
att.net .                14400   IN      MX      5 
al-ip4-mx-vip1.prodigy.net .
att.net .                14400   IN      MX      5 
ff-ip4-mx-vip1.prodigy.net .
att.net .                14400   IN      MX      5 
al-ip4-mx-vip2.prodigy.net .




On Fri, Dec 4, 2020 at 3:53 PM Marcel Becker 
> wrote:



On Fri, Dec 4, 2020 at 12:13 PM Scott Mutter via mailop
mailto:mailop@mailop.org>> wrote:

Anybody from AT&T able to contact me off list concerning an
issue with messages sent from our server (192.158.238.23) to
AT&T related email addresses and being delivered into their
spam folder?


That highly depends on which domain you are sending to. Most
consumer domains are not hosted by ATT but by us.

Also remember that there are other reasons why emails might be
delivered to an individual's spam folder, which have nothing to do
with your reputation.

Cheers,
Marcel


___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] How to reply to this list?

[Lyle Giese via mailop]

On 2020-10-16 12:42, Alan Hodgson via mailop wrote:

On Fri, 2020-10-16 at 12:51 +, Larry Struckmeyer via mailop wrote:


Using Outlook thru O365 attempts to reply to a message in this list 
result in the reply being addressed to the address of the person 
being replied to and not the list.


What is the correct way to reply to a message on this list?

Thanks for your help.



Type in the list address, I guess. Or use a better mail client (one 
that understands the List-Post: header).



Try reply all and see if that picks up the list email address.

Lyle Giese


___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Bellsouth.net contact?

[Lyle Giese via mailop]

ATT doesn't like Linode.  I know I have a server there and have not been 
able to get ATT to clear their inhouse rbl entry.



Lyle Giese

LCR Computer Services, inc.


On 2020-07-20 14:22, Mark Fletcher via mailop wrote:

Hi All,

I think bellsouth.net  is throttling the 
groups.io  server at 66.175.222.12 (timeouts either 
on connect or after we've sent the message, but not always). I've gone 
through the normal channels, but there's been no response. Is there 
anyone here with them?


Thanks,
Mark

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] AT&T Block - abuse_...@abuse-att.net still valid?

[Lyle Giese via mailop]

Don't know if ATT looks at this but I know they used to.  The TTL for 
the A record for server.divebums.com is 900 seconds.  If checking this 
parameter, it was recommended that this be at least 12 hrs or 43,200 
seconds.  The theory was that 900 seconds indicated it was on a dynamic 
ip address.


Good luck!

Lyle Giese

LCR Computer Services, Inc.

On 2020-02-26 15:25, Scott Mutter via mailop wrote:
I know this will come as a complete and absolute shock to most 
everyone here.


It's been 15 days since I originally posted this on this list.  I was 
told to wait about a week to let them "weed" out all of the clutter 
AT&T likely gets from this abuse address... so I waited 2 weeks.


The shocking part... it's still blocked.  And I haven't received a 
peep from AT&T other than the canned response I got on February 10th 
(16 days ago).


So basically all I've done is wasted 16 days waiting for a response or 
resolution.


And yet people wonder why I have zero faith in the way any of these 
"big" mail providers address disputes to their clandestine 
blacklisting and blocking process.


Am I suppose to wait another decade or two for a response or 
resolution from AT&T regarding this?


For what it's worth - the IP address in this particular case 
is 192.158.224.5 - I would very much love for someone to tell me what 
is wrong with this IP address and why AT&T is blacklisting it.  What 
services do you all recommend to go to to check the reputation of a 
mail server's IP address?  I've been using Senderscore, Senderbase, 
Proofpoint, Symantec, Spamhaus, Spamcop - this IP address comes up 
clean at all of those places - but I guess those aren't good sources 
to double check with?


I'm open to suggestions on how I'm suppose to handle this and what I 
need to do to resolve this.  Apparently checking the IP's reputation 
at those sites isn't good enough.  And apparently sending an email to 
abuse_...@abuse-att.net  is not good 
enough.




On Tue, Feb 11, 2020 at 9:50 AM Scott Mutter via mailop 
mailto:mailop@mailop.org>> wrote:


Anybody from AT&T able to check a couple of abuse tickets for me?

AT&T is blocking one of our servers, I sent messages on February
8th and February 10th to abuse_...@abuse-att.net
 but have not heard anything back
- other than the canned response - and the IP is still blocked.

The rejection notice says to email abuse_...@abuse-att.net
 but I'm not sure if that is still
valid.

Ticket numbers are:

020820-180048-39537-00
021020-164333-46154-00

I suppose it's possible that AT&T is just inundated with abuse
requests - but maybe there is a better way to weed out the valid
requests from the invalid requests.

If abuse_...@abuse-att.net  is no
longer valid, then perhaps the rejection notice needs to be updated.


___
mailop mailing list
mailop@mailop.org 
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop