Re: Trying to find out cause of blacklisting

James wrote:

> Thanks for your reply.  The reason given was indeed a spamtrap, but
> I'm just trying to figure out what the problem is.

If it was only spamtraps, that's kinda nasty.  Sometimes a deputy will
'characterize' an item for you, but s/he won't give you the whole
enchilada like you would have for a reporter's evidence linked report.
Currently a link to evidence about 208.8.16.10 rDNS ns1.pil.net would be
sent to james <at> pil.net which I presume is you.

The SCbl delisting is so fresh that some sources say that it is still
listed, but the most reliable source, the web lookup says that it
actually isn't.

dns 10.16.8.208.bl.spamcop.net
Canonical name: 10.16.8.208.bl.spamcop.net
Addresses:
  127.0.0.2

says it's listed

http://www.spamcop.net/w3m?action=blcheck&ip=208.8.16.10
208.8.16.10 not listed in bl.spamcop.net

says it's not -- which is the most uptodate.

It is also listed in a blocklist I'm not familiar with called 'solid' -- 
but I don't know anything about the list and I don't know what its
127.0.0.5 means

dns 10.16.8.208.dnsbl.solid.net
Canonical name: 10.16.8.208.dnsbl.solid.net
Addresses:
  127.0.0.5

and it doesn't appear to give any evidence anyway.

> I tried to contact a person via the dispute page, which had a place
> for comments and my contact info.  The offending IP was 208.8.16.10

Yeah, it [usually] isn't actually a 'dispute' problem -- which would
mean that the parser made a mistake and named an IP such as the server
as a source when it should have named something else -- altho' the
parser is designed to name a user IP behind the server and not the
server, so if the parser is 'unfamiliar' with the server and if the
server's Received tracelines are non-compliant, then the parser can
'trip' and break the chain back to the user IP prematurely.

> It could be due to a misdirected bounce, but this is the first I've
> heard of anyone listing on a major BL due to that.  We do NOT bounce
> email that is flagged by Spamassassin or ClamAV, but misdirected
> unflagged email is bounced and customers do have autoresponders.  It
> would be good to know which, if any of those is the cause.

I understand that concept.  Maybe a deputy will pop in here and then she
would email you some kind of characterizing information.  The faq has a
system for admins which also has a route to contact which starts here
http://www.spamcop.net/fom-serve/cache/75.html  Help for abuse-desks and
administrators -- How can I contact a real person about this?

And there is deputies <at> spamcop.net

-- 
Mike Easter
kibitzer, not SC admin