Increase in 550 RBL bouncebacks when email TO our server

[starchild2012]

In the last week, I've had multiple complaints from multiple clients saying people email THEM are getting their mails bounced back to them when our server blocks the mail due to 550 RBL junk mail status of the sending server.

Servers even include google ips.

Has anyone else seen a sudden rise in these?

Are sites like spamhaus etc hardening up? Has there been some kind of attack?

Or, has there been some other kind of update within WHM or MailScanner FE?

It's very weird.

Thanks.

 

[cPRex]

Hey there! I haven't heard of similar behavior on my end, although that doesn't mean it's not happening.

Do you have an entry from the mail logs (/var/log/exim_mainlog) that shows this happening?

 

[starchild2012]

Hey there! I haven't heard of similar behavior on my end, although that doesn't mean it's not happening.

Do you have an entry from the mail logs (/var/log/exim_mainlog) that shows this happening?

yes, we've since disabled the spamhaus RBL option.

 

[cPRex]

Are things working well after you made that change?

 

[oempire]

We have seen a large increase in this aswell. Because gmail and Microsoft iOS have been listed.

here’s some logs, it doesn’t say which rbl though



550 "JunkMail rejected - mail-wr1-f54.google.com [x.x.x.x]:39658 is in an RBL: "

 

[ITHKBO]

You could extract all IP'S and than run a comparison against the google.com responsible listing at spamhaus.

The Spamhaus Project - SBL

www.spamhaus.org

Listing method can be used for the other bigtech as well.

Unfortunately removal can only be done by a company representative so *if* it is indeed spamhaus blocking it legitimately you need to allow the current registered IP's or completely disable Spamhaus which is not really recommended. Always a bit ironic that Google, Microsoft, Apple always demand relations to register for anti junkmail programs and alert services but there own department is seldom reachable.

 

[edeersg]

I had a similar problem on my servers. When receiving messages from some senders like Google/Microsoft, blocking messages on RBL. The strange thing is that some sender IPs are not included in any blacklist.

To partially solve, we put Google/Microsoft IPs in RBL whitelist option (Exim Configuration Manager > RBLs > Whitelist: IP addresses that should not be checked against RBLs) and removed CloudFlare and Google resolvers.

An example of the error:

550 "JunkMail rejected - mail-pl1-f169.google.com [209.85.214.169]:38779 is in an RBL: "

If you check the IP (209.85.214.169) in Mxtoolbox it is listed in SORBS, but only SPAMHAUS and SPAMCOP are enabled on the server.

We continue to receive from other provider blocks with the same error message. We have to keep supplying the "RBLs" whitelist. I still haven't found a solution.

 

[edeersg]

Just to let you know that we were able to resolve the issue here on our servers by changing the resolv.conf. We use our data center nameservers instead of public DNSs.

 

[tekops]

We are having same issue across thousands of domains we host. google IPs and Microsoft IPs are being blocked. When we check spamhaus or other RBL services, the IPs are not actually listed. We have lost customers over the issue.

 

[cPRex]

@tekops - can you check the contents of /etc/resolv.conf on your server and confirm your datacenter's IPs are being used there?

 

[starchild2012]

... we turned off RBL: zen.spamhaus.org in exim settings and this "fixed" it for us. Not ideal, but it works.

And yes, /etc/resolv.conf points to our own datacenter ips

 

[jlucho]

I have the same problem and I am using CloudFlare 1.1.1.1 resolvers
so the problem is in cloudflare??

If I use the goole 8.8.8.8 resolvers, will it be solved? although with these, the RBL does not work

 

[cPRex]

It is best to use the resolvers provided by your datacenter or hosting provider. If you aren't sure what those are, they'll be able to provide that information quickly if you contact them.

 

[rfarah]

We have the same issue, mostly I will disable Spamcop for now, this is not ideal since we will increase the spam on our customers but many customers are complaining about losing businesses

 

[0884094]

We are having the same issue now, on multiple domains. Google, Yahoo and Microsoft verified-good SMTP IP's are being blocked and emailed rejected.

We are fixing by disabling RBL's (which is the cPanel default, it seems).

We already did have the checkbox ticked: Exempt servers in the Greylisting “Common Mail Providers” list from RBL checks
However we'd disabled Greylisting a long time ago, so not sure if that prevents it from still working, and not sure if they're keeping those common provider lists updated.

Error examples:

550: 'JunkMail rejected - sonic318-20.consmr.mail.ne1.yahoo.com
[66.163.186.82]:46183 is in an RBL: Error:
open resolver; https://www.spamhaus.org/returnc/pub/3.251.104.236'

Error Icon
Message blocked
Your message to REDACTED has been blocked. See technical details below for more information.
The response from the remote server was:
550 "JunkMail rejected - mail-yb1-f179.google.com [209.85.219.179]:33333 is in an RBL: "

 

[cPRex]

@0884094 - after disabling the RBLs, does that take care of things?