Exchange NDRs since changing ISP

Forums › IT Pro and developers › Exchange NDRs since changing ISP

ictgeeknz

255 posts

Ultimate Geek

Trusted

#24402 23-Jul-2008 09:26

Hi everyone,

Some of my users are getting NDRs since we changed ISP and got a new static IP.

#554 Service unavailable; Client host [60.234.130.3X] blocked using dul.dnsbl.sorbs.net; Dynamic IP Addresses See: http://www.sorbs.net/lookup.shtml?60.234.130.3X

I submitted a ticket to SORBS to have the IP address removed from the database list, but got this:

"I've analyzed the following IP space, based on the text of your request:

60.234.130.3X/32

Not all the IP space you requested can be delisted at this time."

HELP?!? Next step(s)?

freitasm

BDFL - Memuneh
67048 posts

Uber Geek

Administrator

Trusted

Geekzone

Lifetime subscriber

#150556 23-Jul-2008 09:30

Welcome to the madness of using third party lists to control spam. Those guys have no idea of how they affect business, otherwise they would make it easier for people to report problems in their lousy databases.

Try using another SMTP server as a smarthost. Your provider's for example? I've done that, but I've noticed once that even my provider's SMTP server was in a blacklist.

amanzi

961 posts

Ultimate Geek

Trusted

#150624 23-Jul-2008 13:08

ictgeeknz: Hi everyone,

Some of my users are getting NDRs since we changed ISP and got a new static IP.

#554 Service unavailable; Client host [60.234.130.3X] blocked using dul.dnsbl.sorbs.net; Dynamic IP Addresses See: http://www.sorbs.net/lookup.shtml?60.234.130.3X

I submitted a ticket to SORBS to have the IP address removed from the database list, but got this:

"I've analyzed the following IP space, based on the text of your request:

60.234.130.3X/32

Not all the IP space you requested can be delisted at this time."

HELP?!? Next step(s)?

Where did the X come from in the IP address? Did you just type that in the original post to hide the IP address?

I would make sure that your server definitely hasn't been configured as an open relay by accident - http://www.abuse.net/relay.html

I don't usually like relaying smtp through a smart host, but that should also get around the problem as Mauricio noted. (assuming the smart host isn't blocked.)

Fraktul

836 posts

Ultimate Geek

Trusted

#150632 23-Jul-2008 13:27

If only a /32 is listed in their response then perhaps there is addressing adjacent which is not on the sorbs ****list which you can ask your ISP to assign you. Changing IP address is a few hours of pain - dealing with sorbs.....best of luck.

PenultimateHop

637 posts

Ultimate Geek

Trusted

#150636 23-Jul-2008 13:42

Looks like it's time for me to comment on this again.

If you are using any form of "less than business/carrier" grade Internet service, relay your outgoing mail through your ISP.

Your IP address is quite correctly listed in the SORBS DUL - which is a list of residential/dynamic IP addresses. Many people use these blacklists to bounce (not a good idea IMHO) or score/tag (much better) mail received from these addresses as spam.

Why? Because the majority of email originated directly from a DSL IP address is worm or spam traffic from compromised machines acting as zombie drones.

If you want your mail to have a better chance[1] of getting through and not being marked as spam or bounced, relay through your ISP's mailservers; or use a proper business Internet connection[2] where the IPs are *not* listed in DUL. It is highly, highly, unlikely that you'll be able to get SORBS to remove your IP address from the DUL since it is effectively correctly marked right now[3].

[1] This of course assumes your ISP's mailservers are reliable, not blacklisted, etc.
[2] Generally expensive, and not a lot of ISPs set their business products up correctly - i.e. static IPs grouped away from residential services, and registered as such in the appropriate RIR database so that blacklists can identify them correctly.
[3] For the record, I don't really like the way SORBS and friends work, and I really don't like that they push their view on how operators should run their network (e.g. making you change reverse DNS entries to match what they want) by effectively holding you hostage - although that's really the fault of people who use blacklists to bounce mail, which is a bad idea.

ictgeeknz

255 posts

Ultimate Geek

Trusted

#150708 23-Jul-2008 17:39

Thank you to everyone who contributed to this thread today - most helpful.