Email blocked by SORBS

Forums › IT Pro and developers › Email blocked by SORBS

martyyn

1971 posts

Uber Geek

ID Verified

Subscriber

#177082 21-Jul-2015 13:13

I've been trying to email someone today but it's been returned with the following error:

Technical details of permanent failure:
Google tried to deliver your message, but it was rejected by the server for the recipient domain theirdomain.co.nz by theirdomain.co.nz. [108.166.164.132].

The error that the other server returned was:
550-"JunkMail rejected - mail-wi0-f178.google.com [209.85.212.178]:36816 is in
550-an RBL, see Currently Sending Spam See:
550 http://www.sorbs.net/lookup.shtml?209.85.212.178"

I use Google Apps for my work email and they use shared US hosting for theirs. There is plenty on the web about SORBS blocking Gmail accounts but not much on how it works.

So my question is where does SORBS come into the delivery process for email ?

If I send my email through Google's servers and the recipient is using their hosts settings, where does SORBS come in ? They have contacted their hosts who say there are no errors on their servers and SORBS is nothing to do with them.

Various searches on GZ seem to say it's with the ISP. They are on VF and have recently had UFB installed with a few issues along with way with them being connected, disconnected and then reconnected again with their payments going to their old account and not the new one.

Cheers

Inphinity

2780 posts

Uber Geek

#1348356 21-Jul-2015 13:50

Their mail provider is utilising SORBS databases as part of their anti-spam procedures, and one or more of Google's mail servers is currently listed as having generated spam. To allow the message to transit successfully, either Google need to get their mail server(s) delisted, or the mail host receiving the message needs to be configured to accept the mail despite SORBS listing of the IP. The latter is unlikely, the former will likely occur at some stage.

martyyn

1971 posts

Uber Geek

ID Verified

Subscriber

#1348361 21-Jul-2015 14:05

Great, thanks Inphinity.

I've spoken to them about it and they say they've contacted their hosts previously as this isn't the first time someone using Gmail has been rejected. They see no SORBS settings on either their WHM or CPanel but have added me to their SpamAssassin white list. Their hosts told them there is no issue with their servers but surely someone is setting SORBS if my friends don't have access to it in WHM/Cpanel.

I just tried one of their other emails (on the same domain) and it worked as I had a different gmail ip.

I wonder if it's time they stumped up for a proper email host rather than the cheap US hosting.

mattwnz

20141 posts

Uber Geek

#1348364 21-Jul-2015 14:13

martyyn: Great, thanks Inphinity.

I've spoken to them about it and they say they've contacted their hosts previously as this isn't the first time someone using Gmail has been rejected. They see no SORBS settings on either their WHM or CPanel but have added me to their SpamAssassin white list. Their hosts told them there is no issue with their servers but surely someone is setting SORBS if my friends don't have access to it in WHM/Cpanel.

I just tried one of their other emails (on the same domain) and it worked as I had a different gmail ip.

I wonder if it's time they stumped up for a proper email host rather than the cheap US hosting.

It isn't anything to do with their email host, it is the spam databases(which are third party) that have google blacklisted. In reality it is actually Googles problem (your email provider), as they obviously have people on their network spamming. The amount of indian SEO spam I get from gmail accounts, this doesn't surprise me. So they really need to fix the spamming problem, which will remove the blacklisting. Whitelisting Google, just because they are one of the biggest email providers isn't really s solution either, as why should they get special treatment. I have found Google / Gmail has been getting blacklisted a lot recently. I found the same problem emailing a realesate agent a few days ago, who uses some big NZ based email provider. They also blamed googles servers. So it has nothing to do with with the host of the person you are sending to. They could remove the blacklist databases, but then their servers would get a lot of spam coming through, so it is a no win situation for them.

martyyn

1971 posts

Uber Geek

ID Verified

Subscriber

#1348376 21-Jul-2015 14:31

Ok, I registered with SORBS and followed the process to delist the IP to see what would happen. It showed the listings considered as spam which were all 0573@gmail.com and 679C@gmail.com type accounts, so that would be the spammers I assume. It also told me I wasn't authorised to delist the IP which I suppose was to be expected.

So SORBS is used by their hosts before passing the email on to the recipient, who can then filter further using SpamAssassin. Is that correct ?

mattwnz

20141 posts

Uber Geek

#1348444 21-Jul-2015 17:10

martyyn: Ok, I registered with SORBS and followed the process to delist the IP to see what would happen. It showed the listings considered as spam which were all 0573@gmail.com and 679C@gmail.com type accounts, so that would be the spammers I assume. It also told me I wasn't authorised to delist the IP which I suppose was to be expected.

So SORBS is used by their hosts before passing the email on to the recipient, who can then filter further using SpamAssassin. Is that correct ?

I don't think you can do anything, you have to contact google/gmail, and they have to contact SORBS, as it is the IP owner that has to fix it. If they are still spamming, then it will just get blacklisted again anyway. The system is supposed to work by the owners of IPs keeping their IPs clean, but with a free email service, they may not have the resources or staff to do this, and probably no incentive for them either.

1101

3122 posts

Uber Geek

#1349705 22-Jul-2015 10:19

I don't think you can do anything, you have to contact google/gmail, and they have to contact SORBS, as it is the IP owner that has to fix it. .

Yep, all you can do is wait it out.

Some Blacklist databses & 3rd party spam filtering services take the attitude they will filter spam no matter what , & really dont care if
alot of valid email gets rejected because they blocked whole ISP's & email service providers
In fact, one spam filter service actually states this on their website :-)

mattwnz

20141 posts

Uber Geek

#1349772 22-Jul-2015 13:06

1101:

I don't think you can do anything, you have to contact google/gmail, and they have to contact SORBS, as it is the IP owner that has to fix it. .

Yep, all you can do is wait it out.

Some Blacklist databses & 3rd party spam filtering services take the attitude they will filter spam no matter what , & really dont care if
alot of valid email gets rejected because they blocked whole ISP's & email service providers
In fact, one spam filter service actually states this on their website :-)

I have noticed that some also charge the IP owner to get a listing delisted quicker. But some of those types shouldn't be getting used. I don't know why there needs to be so many of these blacklisting organisations.

Equinox IT

Cloud spending continues to surge globally, but most organisations haven’t made the changes necessary to maximise the value and cost-efficiency benefits of their cloud investments. Download the whitepaper From Overspend to Advantage now.

raytaylor

4014 posts

Uber Geek

Trusted

#1350092 22-Jul-2015 22:02

The blacklisting organisations all have different ways of judging spam and will of course have different reputations with mail server administrators. Just like how computer technicians all have a favorite antivirus (avg, norton etc) mail admins have a favorite blacklist.

Anyhow we have a process where if you are on some of the sorbs lists, our server will outright block your incoming message. Other lists will allow it through but append SPAM: to the subject so the recipient can do what they like with the message using outlook filtering rules.

In your case, i think the sorbs list will be used as the first filter before the message is accepted and passed through to spamassassin, after which it is finally delivered to the end user.

And its quite common to see a google outbound server getting onto the sorbs list - especially when they start sending from a block of new ip addresses.

Ray Taylor

There is no place like localhost

Spreadsheet for Comparing Electricity Plans Here

dimsim

848 posts

Ultimate Geek

Trusted

Lifetime subscriber

#1350214 23-Jul-2015 09:40

I used to use 2/3 different lists now just use the barracuda list - I've found that to be the most reliable. www.barracudacentral.org

martyyn

1971 posts

Uber Geek

ID Verified

Subscriber

#1350223 23-Jul-2015 09:48

raytaylor:
In your case, i think the sorbs list will be used as the first filter before the message is accepted and passed through to spamassassin, after which it is finally delivered to the end user.

Yep, this appears to be it in a nutshell. They contacted their hosts a second time who 'suggested' this was the case but didn't admit to it. It's no surprise they try to catch everything before being passed to their clients but if it was me I would like to be able to work it out with SpamAssassin or similar. My guess is the US hosts can't afford to take any risks with clients not knowing what they are doing.

Thanks everyone.

Ragnor

8218 posts

Uber Geek

Trusted

#1352283 27-Jul-2015 09:13

Have you configured SPF and DKIM for your domain in Google Apps? Most anti spam systems will look at those before reverting to a ip/smtp blacklist.

martyyn

1971 posts

Uber Geek

ID Verified

Subscriber

#1362075 10-Aug-2015 13:26

Ragnor: Have you configured SPF and DKIM for your domain in Google Apps? Most anti spam systems will look at those before reverting to a ip/smtp blacklist.

Sorry I completely forgot to reply to this.

It seems I had missed a step when I set it all up. I had neither the SPF, nor DKIM records in my domains CPanel and my Google Apps setup wasn't set to be authenticating the email. I must have completely missed it when I did it all originally :(