Client emails being blocked

[Serra]

I'm having a problem and I'm not sure I understand where the issue is. I have a client who is sending email from an IP address that is currently blacklisted (it is a dynamic IP at a hotel).

The client logs in using SMTP AUTH and sends mail just fine. They are also receiving mail just fine. However, when the mail goes to bellsouth, bellsouth rejects the mail saying that they are on a black list.

My server is not blacklisted, the IP that bellsouth is showing is the IP address that they are sending mail FROM.

Where exactly is the issue here? Is it in Exim, their Outlook or Bellsouth?

 

[SageBrian]

interesting.
I just started getting a few blocked emails to bellsouth/att myself.

I put in a request with them to remove it and ask what put me in a blacklist.

I wonder if they are updating their system is it's a little too sensitive? Or maybe a glitch?

 

[Rickvz]

If I try to telnet into port 25 on the ATT mailserver from my dedicated server it is returning the 550 Error and does the same if I try from my local computer. We've been blocked since Friday morning and are still waiting to hear from them after filling out the form to have it unblocked.

 

[Serra]

I've really taken a close look at my server and what has been going to bellsouth. In the last month, we have sent 528 emails to bellsouth.net. I can't see how anyone sending so few emails could be flagged as a spammer.

I have three clients that send the most email to bellsouth. I've set the setting on the server "Send outgoing mail from accounts ip address instead of the main ip address" and put them on their own IP. If it was one of them that got me blocked, then at least it will prevent them from blocking the whole server next time.

No response back from the unblock form, but I'm fairly upset that mail is being blocked. I get one, if any emails, from AOL's feedback loop a month about mail that was sent to them, so I know there isn't any spam going out from my server. I've got a fairly tight server, mail wise, so to be blocked is just not right.


Also, I verified that there weren't any forwarders forwarding spam. I have one grandma who hardly gets any mail with a forwarder to bellsouth.

 

[Rickvz]

Yeah, I spent a while looking at my server as well and we have had 230 messages sent in the last month to bellsouth.net addresses. There are 43 bellsouth.net addresses on a mailing list that we send out once a week (and have sent out for months with no problem). I have one forwarder set to a bellsouth.net address and saw no spam being forwarded (as it is an account that is not published anywhere and generally used only in-house.)

A few other folks in the HG forums have had the problem and I have posted there (as GvilleRick.) It is irritating to me to have the mail blocked since we have a few chairpersons for church committees that use bellsouth and we can't send them any information. I've had no problems at all with blacklists since getting the dedicated server (other than having to get the IP unblocked by AOL when we first set up the server.)

 

[sparek-3]

Unfortunately, the only people that can tell you why Bellsouth is blocking your server are the people at Bellsouth. I've never dealt with Bellsouth's abuse department, but I do know that a lot of the larger corporations believe they are the bosses of the Internet and they don't necessarily have to respond to an abuse inquiry or respond in a timely manner.

It is possible that your IP did not send any spam to Bellsouth but it got caught up in a block of IPs that Bellsouth did detect as sending out spam. Again, Bellsouth would be the only people that could tell you this for sure. And I know that it is not easy getting information from them.

 

[Serra]

A few other folks in the HG forums have had the problem and I have posted there (as GvilleRick.)

Cool, know who you are then from HG.

It is irritating to me to have the mail blocked since we have a few chairpersons for church committees that use bellsouth and we can't send them any information.

I've changed my exim setting to send mail out on the IP of the account, not the shared IP and that has freed up a bunch of problem clients. I suggest you do the same, just put the church on a dedicated IP, if they aren't already. Its not really possible or cost effective to put everyone on a dedicated IP, but if you move anyone with a high volume of bellsouth emails over to one, that will be a big help.

 

[Rickvz]

I have one account on a separate IP and tried sending to a bellsouth address through that account after changing it to send through the IP. It was blocked as well. Looks like BellSouth has blocked a range of IP addresses. Really is a pain.

 

[yurster]

I'm having the same issue

Only with AT&T and it's subsidiaries. I have multiple tickets open with AT&T...no luck so far. I'm also having our data center contact them since ultimately they own the blocked IP address.

 

[Serra]

I have one account on a separate IP and tried sending to a bellsouth address through that account after changing it to send through the IP. It was blocked as well. Looks like BellSouth has blocked a range of IP addresses. Really is a pain.

Edit: No, it does appear that all of my IPs are blocked as well.

 

[Rickvz]

That is odd. The message I sent did go out from the separate IP. The header of the bounce had the IP for the domain I sent from. There are more and more folks posting in the HG forum with similar problems. I'm hoping that HG and The Planet can get something done about it soon.

 

[Serra]

I'm getting reports that some customers are able to send mail, but I have no proof. Its very strange. I've put in a ticket at TP to see if they can do anything.

If Bellsouth doesn't get this fixed, then I'll have major issues.

 

[asmithjr]

How do you change your main sending IP address?
I tried /etc/mailips
IP: hostname


Yes, interestingly enough, I have 4 servers and NONE of them can send to bellsouth.net and using their reporting tools get you know where.

 

[Serra]

I'm not sure you can change the shared IP's sending address without changing the server IP, which is a bad idea.

What I did was I check the box in exim config that allows sites to send email via their own IPs, then tested those.

I got this from TP:

Dear Customer,

It appears that ATT is blocking a large number of our IP ranges. We are unsure of the cause at this time, however we are in contact with them and working to resolve this issue as soon as possible. We apologize for the inconvenience and appreciate your patience. We will update you when we have further information.

 

[asmithjr]

ok so I give, I tried modifying the exim.conf to change the remote_smtp to use another interface and it still uses the host IP address:

bellsouth.net is blocking all emails, not sure why as they are not returing anythng but the emails.

I tried using the cpanel /etc/mailips and /etc/mail_reverse_dns changes and still see all email go out from the main IP address.

Has anyonw been sucessful changing the main IP address that exim uses to send email.

PS: sendiing less than 200 email per month from a server should never constitute a ban, especially without any support from the other end. this is why I am looking for a work around.

 

[Serra]

You can't change the shared IP sending for exim without changing the main server IP shared address (at least, I've never seen it done, I've search a bunch on that idea). Doing so, will really screw you with propagation delays, so basically, there isn't any way to change it.

 

[Serra]

Now unblocked.

Update: The block has been lifted. I'm sending email again.

 

[asmithjr]

I got email from bellsouth earlier today telling me it is corrected but not yet for 1 out of 4 servers, the one with the least sends to bellsouth for the month.

 

[Rickvz]

I resubmitted the form this morning with a different email address (after not hearing anything since submitting on Friday) and got a reply a few hours later saying it was no longer blocked. I am able to send now and resent a mailing list message which went to all 43 bellsouth addresses with no bounces. It would be interesting to know what happened but I doubt that they will say anything publicly.

 

[Serra]

Lets just hope they don't do it again.