Email and Blacklists

Bounce back messages

If you try to send an email and you get a message back to indicate that it could not be sent, you may find that either your domain name or the destination domain name is blacklisted.

Blacklist checkers independently identify spam sources on the internet. These are servers where bulk (meaning hundreds or thousands of) unsolicited mails are sent from. Usually from a hacker or someone that is manipulating an account on the server. It does not necessarily mean that the spam has originated from your account.

The black list records where a server has been independently identified as a spam mail source. Somewhere in the mail path between the sender and recipient a process is checking that the mail has come from or is going to a spam source. The message you get back is often cryptic. One of the first things to do is check whether the problem is at your end, not necessarily your domain, but the server your domain is running from. You can do that using a Black List Check.

If your domain name is ok, check the domain name of the person you are trying to send to.

Black List Check

I came across a useful tool for checking to see if your domain is listed on a blacklist. You can go to here to check:

http://www.inmotionhosting.com/support/tools/blacklist-check

If you find your domain name is listed on a blacklist please bring it to my attention by going to contact us

EMail Server is on a blacklist

ALERT: 12/02/2016

Update: RESOLVED 12/02/2016

The following case was raised with the hosting provider and resolved at 8pm on the 12th of Feb. Not everyone was affected by this problem, there were 5 cases bought to my attention.

I have received 4 messages from people about error or bounce back messages being returned from some email addresses. They will look something like this:

host homestart-org-uk01b.mail.eo.outlook.com [213.199.154.87]

SMTP error from remote mail server after RCPT TO:<xxxxxxx@xxxxxxxxxx.org.uk;>:

550 5.7.1 Service unavailable; Client host [173.247.252.74] blocked using Spamhaus; To request removal from this list see http://www.spamhaus.org/lookup.lasso

(I have obscured the email address, they will all be different).

The red text offers the clue as to what is happening and what to do about it. Firstly if you see one of these make sure that you send a copy to me, and secondly click on the link in the message which goes to spamhaus.org and declare you are a user on this server and your domain is legitimate.

What has happened?

We are on a shared server, which means that in addition to every one I am hosting there are other people on there as well. If one of these other accounts is compromised somewhere and a hacker gets in, or one of the account holders is a spammer, then thousands of messages can be sent from the hosting. External companies and organisations have “honeypots” that trap spam messages and if they are detected then the spam source, in this case the server, is blacklisted. So everyone on that server is affected.

This is a very rare occurrence, the hosting company also does it’s own monitoring of traffic and generally detects spamming activity and traps it before it becomes a problem.

What have I done about it?

Starting last night I forwarded the error messages that people had sent to me and opened support tickets. I was not sure what the cause was. Having done a bit more research this morning and having been on chat with the hosting provider twice this morning, we have pin pointed the problem to a specific server where our mail is routed through, and confirmed that this server is on a blacklist.

So the hosting company are aware of it and addressing it. I will continue to monitor the situation.

Generally what they will do is switch all mail to another server IP address and then the problem goes away. I am waiting to hear if that has happened.

Who is affected?

Generally most mail will still get through and you will still receive email. However certain sources such as NHS, Government and local government and other large corporations will subscribe to blacklists to limit the volume of spam messages coming in. As most of you are charities then you will all be affected in some way.

I use two reseller accounts, one is based in the UK, if you have not seen any error messages coming back you are not affected by this problem.

Can I get around this problem?

The best approach if this problem is stopping your organisation from functioning is to use an email address not associated with your domain name. For example; hotmail, yahoo, gmail, btconnect, talktalk, etc as a temporary measure. This will allow you to continue to send email in the short term while we wait for this problem to be fixed.

When will it be fixed?

In short I don’t know, it is usually resolved in a few hours. I will chase the hosting company again if this problem is still there at 1pm UK time. I will also put a message at the top of this thread with any more news.

Should I be concerned about this?

Where you use a shared server irrespective of where it is located there is a risk it might be detected as a spam source by third parties if someone has done something either deliberately or by accident on the server. Many of you have come from HostPapa where it occurred regularly for short periods. If your server is at InMotion hosting then it is a very rare occurrence, and I know this company takes matters like this very seriously and monitors traffic entering and leaving the server.

Right now, I am not proposing to change the hosting provider. If you are concerned please contact me through the usual channels.

Troubleshooting email

Occasionally we do get issues with email, and you need to find out where the problem is occurring. It is not necessarily at your end, it may be at the senders end.

Also if you suspect that there may be something not quite right with email please come back here and check. If I am aware of anything, or am working on it, then my status will be reported on this page.

I have created a troubleshooting guide in PPT that you can find on the News page to step you through what you need to do.

The page Troubleshooting Email and associated downloads can be found here.

Managing mail continued….

I mentioned a month ago that I had turned on Spam Assassin in the hosting for my personal email account. This continues to work very well, reducing the burden of filtering out spam messages. It is not 100% foolproof, but it does catch a lot of them.

I use four mechanisms now.

1). Turn on Spam Assassin in the control panel.

2). Create an account filter (affects all mail coming into your domain), to automatically delete mail that achieves 7 plus symbols in the spam bar (it is written like this +++++++). Anything scoring 7 or more is definitely spam.

3). Create a second account filter that will send any messages scoring 5 plus symbols in the spam bar (it is written like this +++++) to a specially created account called suspectspam@[mydomain.org.uk]. So all of this suspected spam is sent to a specific mail account that you can periodically check. 5 + symbols generally means highly likely to be spam.

4). In my Outlook account I use ESET Smart Security. For things that escape the spam filter but are clearly spam (I get a lot of pretend newsletters), these are detected and moved automatically.

These four steps have made processing email a lot easier. If this is of interest I can write a short tutorial on it, it is easy to set up. Let me know by making a comment below.

Additionally

If you use the filtering facilities in your hosting control panel, you can also trap and redirect certain forms of email. This can be quite a powerful tool as well.

Cyber Safety

Wearing another hat I am chair of a NAG group (Neighbourhood Action Group), they are all over the UK and they generally cover an area of towns or villages and liaise with the local police in the UK.

I did a presentation the 19th of November at my local NAG on Cyber Safety. It is pitched at the home user (so applicable to adults of all ages), and parents and incorporates advice for parents with young children and young adults who are perhaps most at risk.

I have also included a selection of “nasty emails”, (images of them, not the full emails), to show how spammers, hackers and others try to hook people in, and what you should look for.

You are more than welcome to access and share the items on this site, and I can even send you copies localised for your site if you wish. (It represents a useful resource to help people stay safe). Continue reading Cyber Safety

Email Limitations on sending bulk mail

What is a bulk mail?

If you send out emails to more than say 10 people at a time, with the message “undisclosed recipients” then you are sending out bulk email. I had one instance where a group was sending out a marketing message to around 80 recipients. They received a lot of messages back that the mail was not sent. In fact it went out to the 50 people, the last 30 did not receive it.

50 Limit and 250/hr

Within the hosting we use there are two limits you need to be aware of. The first is the 50 limit. Any email you send should not carry more than 50 email addresses on it. If it does have more than 50 addresses the mail will be sent to just the first 50 and then you will get back error messages.

So break up any mailing lists into say groups of 40 email addresses which should work ok and send more than one mail. Continue reading Email Limitations on sending bulk mail

TalkTalk Mail problems

(22nd November 2015)

There have been several instances of issues sending mail into the following domain names which I think all fall under the Talk Talk group of companies. I have seen another mail rejected message this morning to a talktalk.net recipient.

tiscali.co.uk
aol.com
talktalk.net

Each time I see these problems or someone reports a mail rejected message I get in contact with the sending hosting company and ask them to check. They report back that the issue lies with Talk Talk.

There seems to be some evidence that this group of domains have tightened up their security with regards to email. It has progressively got more and more complicated this year, most likely because of the high volumes of emails being sent by spammers. Various checks are being carried out to ensure that the server associated with a domain is really where the mail came from, and not from a 3rd party. Continue reading TalkTalk Mail problems

Issues sending mail to Talk Talk customers

(3rd November 2015).

I have received messages from two clients over the past two days relating to “bounce back” messages being returned from the TalkTalk network.

The messages will carry this text:

Subject: Mail delivery failed: returning message to sender

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed:

someone@talktalk.net Continue reading Issues sending mail to Talk Talk customers

Managing SPAM

spam-management Many of you running charitable organisations will have a dedicated primary email address that you use for incoming, and sometimes outgoing email. Over time this email address becomes “known” to spammers and you start to receive unsolicited email on it.

While looking at the hosting for many organisations I can see huge email boxes that are full of this type of content. (I only see the size of the mailbox, not the mail). Following the issues I faced with my main email account in October, I decided to look into methods for reducing it, redirecting it, and eliminating it. Some of these are available to you through the hosting you use. I will explain the pro’s and con’s below, and how you can “non destructively” experiment to see how spam management may work for you. Continue reading Managing SPAM

Using MailPoet

The following is of interest if your site has a newsletter application built in called Mail Poet.

If you have an email address list containing more than 70 subscribers for your newsletter please do take care with the last step before you send out your newsletter. Generally speaking shared hosting providers do not like bulk mailing applications running in their hosting. They use a variety of methods to detect mail being sent from the hosting which includes monitoring the volume per second/ minute and the number of error messages received such as “recipient account does not exist”. Continue reading Using MailPoet