Increase in 550 RBL bouncebacks when email TO our server

Operating System & Version
CloudLinux v8.5.0
cPanel & WHM Version
102.0.12

starchild2012

Member
Jul 24, 2012
21
2
53
cPanel Access Level
Root Administrator
In the last week, I've had multiple complaints from multiple clients saying people email THEM are getting their mails bounced back to them when our server blocks the mail due to 550 RBL junk mail status of the sending server.

Servers even include google ips.

Has anyone else seen a sudden rise in these?

Are sites like spamhaus etc hardening up? Has there been some kind of attack?

Or, has there been some other kind of update within WHM or MailScanner FE?

It's very weird.

Thanks.
 
Last edited by a moderator:

oempire

Member
Sep 6, 2014
12
1
53
cPanel Access Level
Root Administrator
We have seen a large increase in this aswell. Because gmail and Microsoft iOS have been listed.

here’s some logs, it doesn’t say which rbl though



550 "JunkMail rejected - mail-wr1-f54.google.com [x.x.x.x]:39658 is in an RBL: "
 
Last edited by a moderator:

ITHKBO

Member
Jun 23, 2020
22
29
13
Netherlands
cPanel Access Level
Root Administrator
You could extract all IP'S and than run a comparison against the google.com responsible listing at spamhaus.

Listing method can be used for the other bigtech as well.

Unfortunately removal can only be done by a company representative so *if* it is indeed spamhaus blocking it legitimately you need to allow the current registered IP's or completely disable Spamhaus which is not really recommended. Always a bit ironic that Google, Microsoft, Apple always demand relations to register for anti junkmail programs and alert services but there own department is seldom reachable.
 
  • Like
Reactions: cPRex

edeersg

Registered
May 12, 2022
2
2
3
Brazil
cPanel Access Level
Root Administrator
I had a similar problem on my servers. When receiving messages from some senders like Google/Microsoft, blocking messages on RBL. The strange thing is that some sender IPs are not included in any blacklist.

To partially solve, we put Google/Microsoft IPs in RBL whitelist option (Exim Configuration Manager > RBLs > Whitelist: IP addresses that should not be checked against RBLs) and removed CloudFlare and Google resolvers.

An example of the error:

550 "JunkMail rejected - mail-pl1-f169.google.com [209.85.214.169]:38779 is in an RBL: "

If you check the IP (209.85.214.169) in Mxtoolbox it is listed in SORBS, but only SPAMHAUS and SPAMCOP are enabled on the server.

We continue to receive from other provider blocks with the same error message. We have to keep supplying the "RBLs" whitelist. I still haven't found a solution.
 

tekops

Member
Jun 2, 2011
5
0
51
We are having same issue across thousands of domains we host. google IPs and Microsoft IPs are being blocked. When we check spamhaus or other RBL services, the IPs are not actually listed. We have lost customers over the issue.
 

jlucho

Well-Known Member
Aug 5, 2006
91
1
158
I have the same problem and I am using CloudFlare 1.1.1.1 resolvers
so the problem is in cloudflare??

If I use the goole 8.8.8.8 resolvers, will it be solved? although with these, the RBL does not work