I recently moved my company's Administration Offices from one site to another.
Simple I thought.
- Purchase a new internet connection
- move the email server
- and reconfigure email to be sent and received on the new internet connection
Apparently not. A few days after moving to the new IP Address I get a call from a user saying that their email is getting blocked by the Barracuda Reputation Block List (BRBL)*.
Me being me I assumed I had something misconfigured. So then ensued days of checking to make sure all my internal systems where virus / malware free. That the gateway firewall rules were all explicit DENY unless allowed. That no host other than the email server could send SMTP traffic out. And following the Barracuda reasons for blacklist page to make sure I was not accidentally causing my own problems.
I called my ISP and they started looking at reasons why I was getting blocked. RBL's it seems can use a lot of different methods to decide to recommend blocking your IP.
Reasons why you get on a RBL
Although you have purchased a "business grade" connection your ISP may have used it in a dynamic range in the past. Dynamically assigned IP ranges are traditionally highly suspect because home users aren't aware that their computers are 0wn3d by evil h@x0rs. RBL's can list this as DYN-ADDR and subscribers to the RBL can blanket deny anthing from a DYN-ADDR range. So your IP can have a lingering black mark from this heritage. So strike one for your IP having a checkered past.
Another problem can be the previous user of the IP address. If they have been infected by Malware and Trojans then you will perhaps have further listing/s on the internet for SPAM sending and DICTIONARY ATTACKS.
I typed my IP address into Google and got a link to http://www.projecthoneypot.org. This showed that prior to me using the IP address it was a known source of SPAM and Dictionary Attacks (A year before I used the IP but still a bad reputation can hang around).
So what to do:
Update:
The recommended way of not having to worry about getting your IP on a RBL is to use your ISP's mail server as a smart host.
You can usually identify this server by:
- the SMTP email setting in your email client (e.g. Thunderbird, Outlook, Outlook Express)
- or the ISP will usually publish it's SMTP server address on it's website.
Configure your onsite server to send everything via this server. Your ISP will be managaing their email server infrastructure so that all it's customers can send email. Your email will be sent to the Smart Host and then relayed from there to it's destination. The benefit is you can screw down your firewall rules to one outgoing SMTP connection (your email server to the smarthost) and whatever inbound rules you need to get mail delivered to your email server.
So what to do to get your IP address a good reputation:
Make sure your Email Gateway IP address has the correct RDNS (Reverse DNS entry). Something like mx1.yourdomain.com and that you have an A record with the same name pointing to the same IP address. Re your ISP for the RDNS and your Domain Name Host for the A record. See Check your DNS/RDNS Setup below.
Go onto the internet and search for every major RBL site, go to their listing lookup page, do a lookup for your IP and if it's listed as a bad IP address try to get it de-listed before you start using it for email. You can get the assistance of your ISP to do this because their postmaster may have a good working relationship with the RBL providers and can help expedite getting your IP back to having a good reputation.
You can also pay $20USD protection money to EmailReg.org and this is supposed to assist the Barracuda RBL to trust your IP address by providing a mapping of which IP Addresses send emails for your domain.
Check your DNS/RDNS setup
Using my ISP's mail server as an example of a correct setup:
# first find the A record for the host
dig @220.233.0.4 mail.exemail.com.au
; <<>> DiG 9.6.1-RedHat-9.6.1-2.fc11 <<>> @220.233.0.4 mail.exemail.com.au
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22687
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2
;; QUESTION SECTION:
;mail.exemail.com.au. IN A
;; ANSWER SECTION:
mail.exemail.com.au. 11375 IN CNAME chestnut2-mail.exetel.com.au.
chestnut2-mail.exetel.com.au. 314 IN A 220.233.0.76
;; AUTHORITY SECTION:
exetel.com.au. 1756 IN NS ns1.exetel.com.au.
exetel.com.au. 1756 IN NS ns2.exetel.com.au.
;; ADDITIONAL SECTION:
ns1.exetel.com.au. 765 IN A 220.233.0.1
ns2.exetel.com.au. 1370 IN A 220.233.0.2
;; Query time: 34 msec
;; SERVER: 220.233.0.4#53(220.233.0.4)
;; WHEN: Thu Jul 16 00:01:39 2009
;; MSG SIZE rcvd: 157
# next lookup the ptr record which is the RDNS (Reverse DNS)
# by querying the IP supplied from above (220.233.0.76).
# note the "A" record and the "PTR" return the same hostname
# in this case chestnut2-mail.exetel.com.au.
dig @220.233.0.4 -x 220.233.0.76
; <<>> DiG 9.6.1-RedHat-9.6.1-2.fc11 <<>> @220.233.0.4 -x 220.233.0.76
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63734
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2
;; QUESTION SECTION:
;76.0.233.220.in-addr.arpa. IN PTR
;; ANSWER SECTION:
76.0.233.220.in-addr.arpa. 19431 IN PTR chestnut2-mail.exetel.com.au.
;; AUTHORITY SECTION:
0.233.220.in-addr.arpa. 17086 IN NS ns2.exetel.com.au.
0.233.220.in-addr.arpa. 17086 IN NS ns1.exetel.com.au.
;; ADDITIONAL SECTION:
ns2.exetel.com.au. 1002 IN A 220.233.0.2
ns1.exetel.com.au. 457 IN A 220.233.0.1
;; Query time: 34 msec
;; SERVER: 220.233.0.4#53(220.233.0.4)
;; WHEN: Wed Jul 15 23:36:46 2009
;; MSG SIZE rcvd: 153
Hi, Thank you for sharing this. My IP address has been blacklisted by b.barracudacentral.org, dnsbl-2.uceprotect.net, dnsbl-3.uceprotect.net, pbl.spamhaus.org, zen.spamhaus.org. Currently i have a negative reputation. I didn't send any bulk mail to others. I made about five comments on other websites under my websites niche for the purpose of link building per day. But i made relevant comments. Will this negative reputation affect my website? How will i resolve this? Please replay soon..