Re: Why are you screwing with my mail?

Posted to .mail & spamcop;  f/ups to spamcop

James Caldwell wrote:
Newsgroups: spamcop.mail

This is the wrong ng for your post.  spamcop.mail is a group which was
for people to interact about their spamcop mail accounts, which service
is described here http://www.spamcop.net/ces/individuals.shtml  SpamCop
Email System for Individuals

You are not posting about a spamcop mail issue, but about a spamcop
blocklist effect.  Your recipient chose to use the SCbl and as a result
your mail's transmission to them was rejected.  Rejection of mail during
the transaction is a healthier effect than some other effects of
spamfilters which result in mail being lost.

I'm posting this to a general discussion group spamcop and making f/ups
to there.

Subject: Why are you screwing with my mail?

The SCbl is a blocklist described here.  http://www.spamcop.net/bl.shtml
SpamCop Blocking List

SpamCop doesn't block anything or screw with anyone's mail.  It is a
parsing and reporting system, the maintainer of the SCbl, and also
provides a mail service for filtering and tagging spam.  Your recipient
rejected your mail as a method of their spam control.  Your mail was
rejected by your recipient's server because your EL earthlink output
server was listed in the SCbl for abusive server behavior.  More about
that later.

>     SMTP error from remote mailer after RCPT TO:<[email protected]>:
>     host mx-4.iquest.net [206.246.180.54]: 553 Blocked - see
> http://www.spamcop.net/bl.shtml?209.86.89.70

That is a nicely informative information from the iquest server which is
telling you that the EL server's IP caused the mail to be rejected
because the EL IP was blocklisted in the SCbl spamcop blocklist.

> ------ This is a copy of the message, including all the headers.

Those headers aren't very helpful.  They just say that your user IP
which is a mindspring one gave the mail to the EL server.  The problem
is with the EL server which is blocklisted.

Here's the current story on that EL IP

209.86.89.70 listed in bl.spamcop.net
it will be delisted automatically in approximately 17 hours.
users have reported system as a source of spam
has been listed for less than 24 hours.
Other hosts in this "neighborhood" with spam reports
209.86.89.63 209.86.89.64 209.86.89.65 209.86.89.66 209.86.89.92

<209.86.89.63 209.86.89.64 209.86.89.65 209.86.89.92 not listed>

209.86.89.66 listed in bl.spamcop.net
will be delisted automatically in approximately 20 hours.
has sent mail to SpamCop spam traps in the past week
users have reported system as a source of spam
has been listed for less than 24 hours.

Both of those, .70 and .66, are EL output servers.  Generally the SC
parser avoids naming a server as a spamsource if there is a user IP
behind it.  Generally in the case of servers getting listed it is not
for 'spam' per se, but some other abusive server behavior which is
spamcop reportable.  The most common server behaviors which are spamcop
reportable are misdirected bounces and challenges.  EL isn't configured
for doing misdirected bounces, but it is definitely configured to
perform challenges.

That challenge behavior has been pointed out to EL as abusive many many
many times in the past.  I am an EL subscriber, and I have personally
told EL about the problem of allowing users to configure to perform
challenges to suspect mail -- numerous times in the EL support ng/s.  In
addition, whenever EL accepts a report about their servers performing
abusive actions they find out about it.

The problem is that EL's default medium spamblocker identifies known
spam.  That isn't a problem.  However, the user can optionally configure
to high spamblocker.  When they do, the new default condition is to
challenge the items which are not known spam and are not whitelisted.
EL's known spam filter is 'leaky' -- resulting in spam getting past the
known and into the Suspect folder.

Spam From is bogus and is likely to be the addy of a spamcop reporter or
a spamcop spamtrap.  When the EL server sends a challenge to the spamcop
reporter or the spamtrap, it is reportable.  That reporting results in
the EL server becoming spamcop blocklisted.

That spamcop blocklisting causes your mail to get rejected.  It is as
'simple' as that.  Your provider is manufacturing abusive emails.  You
are trying to use the server which has being reported as abusive.  Your
recipient is using the SCbl to guard against spam and other abusive mail
and your mail has become 'collateral damage' as a result of your
recipient's spam strategies and modern day blocklisting of challenging
servers.

EL subscribers should be complaining to EL about running servers which
get themselves blocklisted and which causes problems with their mail
delivery.



-- 
Mike Easter
kibitzer, not SC admin