I'm on a blocklist! HELP!

Recently, an abuse desk rep asked what to do when customers were complaining about being assigned an IP address located on a blocklist. Because not every blocklist actually affects mail delivery it’s helpful to identify if the listing is causing a problem before diving in and trying to resolve the issue.

  1. Find out whether mail is actually being blocked, or whether the customer just went to one of the jumbo economy blacklist checker sites.
  2. If no mail is being blocked, it’s not an issue.
  3. If mail is being deferred (Yahoo…) it’s not the same issue as being blocked, and likely isn’t worth pursuing.
  4. If mail is being blocked, don’t take the customers word for why. If they got an email rejected by, say, Earthlink for some reason and then went to the blacklist checker and discovered that they’re listed on FIVETEN, they might grab onto that listing like a rabid terrier when it’s really an irrelevant rathole.
  5. Start with the rejection message. If it has a URL in it, that’s all you need to start with.
  6. If not, see if it’s consistent – does test mail get rejected. If not, it’s either a transient issue or it’s a content-based block rather than an IP based block, and hence not your problem.
  7. If there’s no URL in the rejection, contact the entity that blocked the mail, perhaps.
  8. Make a good judgement call about whether it’s worth caring. If it’s just one guy in his Mom’s basement blocking mail then it’s not worth the time or energy to care about the issue.
  9. If this is really business-critical for the customer then they should talk to a decent consultant rather than relying on their abuse desk for assistance.

Related Posts

They’re not blocking you because they hate you.

Really. They’re blocking you because you’re doing something that is triggering their blocking mechanisms.
This has happened over and over and over again. Some political or activist website sends out an email that gets blocked by some large ISP and the political site turns it into a giant crisis that means the ISP hates them or is trying to shut them up or is trying to silence their message.
Except that’s not what is going on. The folks at the large ISPs who handle blocking and incoming mail are incredibly smart and conscientious . They take their jobs seriously. They, both personally and corporately, want their customers (the end recipients) to receive the email they want. Additionally, they do not want to deliver mail that the recipients did not ask to receive.
In almost no cases is the block a particular activist site encounters a result of the ISP not liking the content of the email. If an activist site is being blocked it’s due to complaints or reputation or something that ISPs measure and block on. Some person at the ISP didn’t read your email, decide they didn’t like what you had to say and then block that email. That email was blocked because something related to that email triggered the thresholds for blocking.
Of course, as with everything online, there are caveats. In this case it’s that the above statements really only hold true for large ISPs in free countries. There are some countries in the world that do block email based on content, and that is dictated by the government. Likewise, some small ISPs will block based on the guy in charge not liking the email.
Generally, though, if an activist site is being blocked by a large ISP in the US or other free countries it is because their mailings are somehow not complying with that ISPs standards. Instead of starting an email campaign or blog campaign to shame the ISP for suppressing speech, it is much more productive to actually contact the ISP in question and find out what went wrong.

Read More

Greylisting: that which Yahoo does not do

Over the last couple days multiple people have asserted to me that Yahoo is greylisting mail. The fact that Yahoo itself asserts it is not using greylisting as a technique to control mail seems to have no effect on the number of people who believe that Yahoo is greylisting.
Deeply held beliefs by many senders aside, Yahoo is not greylisting. Yahoo is using temporary failures (4xx) as a way to defer and control mail coming into their servers and their users.
I think much of the problem is that the definition of greylisting is not well understood by the people using the term. Greylisting generally refers to a process of refusing email with a 4xx response the first time delivery is attempted and accepting the email at the second delivery attempt. There are a number of ways to greylist, per message, per IP or per from address. The defining feature of greylisting is that the receiving MTA keeps track of the messages (IP or addresss) that it has rejected and allows the mail through the second time the mail is sent.
This technique for handling email is a direct response to some spamming software, particularly software that uses infected Windows machines to send email. The spam software will drop any email in response to a 4xx or 5xx response. Well designed software will retry any email receiving a 4xx response. By rejecting anything on the first attempt with a 4xx, the receiving ISPs can trivially block mail from spambots.
Where does this fit in with what Yahoo is doing? Yahoo is not keeping track of the mail it rejects and is not reliably allowing email through on the second attempt. There are a couple reasons why Yahoo is deferring mail.

Read More

Yahoo and Spamhaus

Yahoo has updated and modified their postmaster pages. They have also put a lot of work into clarifying their response codes. The changes should help senders identify and troubleshoot problems without relying on individual help from Yahoo.
There is one major change that deserves its own discussion. Yahoo is now using the SBL, XBL and PBL to block connections from listed IP addresses. These are public blocklists run by Spamhaus. Each of them targets a different type of spam source.
The SBL is the blocklist that addresses fixed spam sources. To get listed on the SBL, a sender is sending email to people who have never requested it. Typically, this involves email sent to an address that has not opted in to the email. These addresses, known as spamtraps, are used as sentinel addresses. Any mail sent to them is, by definition, not opt-in. These addresses are never signed up to any email address lists by the person who owns the email address. Spamtraps can get onto a mailing list in a number of different ways, but none of them involve the owner of the address giving the sender permission to email them.
Additionally, the SBL will list spam gangs and spam supporters. Spam supporters include networks that provide services to spammers and do not take prompt action to remove the spammers from their services.
The XBL is a list of IP addresses which appear to be infected with trojans or spamware or can be used by hackers to send spam (open proxies or open relays). This list includes both the CBL and the NJABL open proxy list. The CBL list machines which appear to be infected with spamware or trojans. The CBL works passively, looking only at those machines which actively make connections to CBL detectors. NJABL lists machines that are open proxies and open relays.
The Policy Block List (PBL) is Spamhaus’ newest list. Spamhaus describes this list as

Read More