Re: why our server got listed?

Oleg Bulyzhin wrote:
> I do. I need that damn header. I've got reply from spamcop official -
> server was listed cause of spamcop parser failure - trojaned machine
> of
> our client sent mail to spamtrap, but our server got listed instead
> of that client.

That's good news.  It is much much better for a user IP behind the
server to get named as source than the server.  However, it would be
even better if you secured your problematic spewing proxy/trojan user
IPs, and example of which I named earlier.

The parser is designed to not name a server relaying for its user if it
can chain the parse back to a user IP behind the server.  It is not
desirable for servers to be listed for user IP behavior behind because
of the collateral damage caused by the server listing.

> So we have problem with mail delivery (about 2 days already),
> diagnostic of it was unclear, excluding possible reasons yeilds
> paradoxical result: only reason (beside an error) why our server may
> get listed is ...
> standard compliance! Funny, isn't it?

Somewhere earlier I thought you were explaining why it was necessary to
send DSN failures to bogus Froms.  I'm thinking you have a
backscattering server.

If the listing was caused /entirely/ by a server getting named by the
parser tripping by prematurely breaking the chain error, then the deputy
will 'fix' that.  If the listing were caused by a combination of chain
errors which should have sourced a user IP and backscatter which should
have named the server, then I expect that s/he would let the backscatter
reports stand.  If the 'removal' of the mistaken report counts resulted
in the server's delisting, then that would be good for you.  If the
server can get itself listed by too much backscatter in addition to a
bad parse for something else, then you still have a problem.

-- 
Mike Easter
kibitzer, not SC admin