Re: Email blacklist

[Arthur T.]

On 28 Mar 2008 12:44:12 -0700, in bit.listserv.ibm-main 
(Message-ID:<[EMAIL PROTECTED]>) 
[EMAIL PROTECTED] (Morris, Carey) wrote:


A few nights ago we started getting this message when we 
tried to send emails from the mainframe to our Outlook 
email server:


EZA5198I 03/25/08 23:25:23   2< 550 Denied by policy: 
Sender is listed on DNS-based RBL.


The Outlook admin explained that we use several outside 
services to identify email from SPAM sites and, for 
whatever reason, one of those sites had identified the 
mainframe's IP as a SPAM'er.  He said we should also be 
getting a message or email identifying the IP address of 
the service that had blacklisted us.  The problem cleared 
by itself, presumably when the service corrected the 
problem, but I have not been able to find anything in the 
Communications Server manuals that talks about this.  Has 
anyone else had the honor of being blacklisted and, if so, 
did they receive anything to tell them who had blacklisted 
them?


 Try putting your IP address(es) and/or domain name(s) 
into

http://moensted.dk/spam/


--
I cannot receive mail at the address this was sent from.
To reply directly, send to ar23hur "at" intergate "dot" com

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Email blacklist

[Shmuel Metz (Seymour J.)]

In <[EMAIL PROTECTED]>,
on 03/28/2008
   at 02:30 PM, "Morris, Carey" <[EMAIL PROTECTED]> said:

>A few nights ago we started getting this message when we tried to send
>emails from the mainframe to our Outlook email server:

>EZA5198I 03/25/08 23:25:23   2< 550 Denied by policy: Sender is listed on
>DNS-based RBL.

I'd say that your lookout admin is not doing his job; the message should
contain more data. Also, he should either be whitelisting his own network
or generating alerts when his own traffic is rejected.

>The Outlook admin explained that we use several outside services to
>identify email from SPAM sites and, for whatever reason, one of those
>sites had identified the mainframe's IP as a SPAM'er.

More likely it had identified your provider as a spammer. What was the IP
address in question?

>but I have not been able to find anything in the Communications Server
>manuals that talks about this.

I wouldn't expect anything there; the CS documentation does not cover mail
abuse issues.


In <[EMAIL PROTECTED]>,
on 03/30/2008
   at 07:46 AM, "Morris, Carey" <[EMAIL PROTECTED]> said:

>I can't see that there's anything we could set up differently in SMTP to
>get a more descriptive reject message.

If traffic from SMTP to lookout is rejected, then the message text is
controlled by lookout. The required fix is not on your side of the link.

OTOH, if the listing is due to something that SMTP did, then you need to
fix that. 

-- 
 Shmuel (Seymour J.) Metz, SysProg and JOAT
 ISO position; see  
We don't care. We don't have to care, we're Congress.
(S877: The Shut up and Eat Your spam act of 2003)

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Email blacklist

[Morris, Carey]

Yes.  I think that's the information he wanted but the 550 message we were 
receiving did not mention who had blacklisted us.  I can't see that there's 
anything we could set up differently in SMTP to get a more descriptive reject 
message.

Thanks,
Carey


-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf Of Mark 
Post
Sent: Friday, March 28, 2008 4:28 PM
To: IBM-MAIN@bama.ua.edu
Subject: Re: Email blacklist

>>> On Fri, Mar 28, 2008 at  3:30 PM, in message
<[EMAIL PROTECTED]>,
"Morris, Carey" <[EMAIL PROTECTED]> wrote:
-snip-
> Has anyone else had the
> honor of being blacklisted and, if so, did they receive anything to tell them
> who had blacklisted them?

A client I was working with a few years ago had one of their Exchange servers 
mistakenly set up as an open relay.  They were spewing spam at a tremendous 
rate, and got blacklisted.  No one told us.  I think what your Exchange admin 
was trying to tell you is that in the actual SMTP reject message you got from 
the Exchange server should have been something like "550 5.7.1 Email rejected 
because 1.2.3.4 is listed by zen.spamhaus.org", as an example.  There are other 
possibilities besides spamhaus.org.


Mark POst

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Email blacklist

[Mark Post]

>>> On Fri, Mar 28, 2008 at  3:30 PM, in message
<[EMAIL PROTECTED]>,
"Morris, Carey" <[EMAIL PROTECTED]> wrote: 
-snip-
> Has anyone else had the 
> honor of being blacklisted and, if so, did they receive anything to tell them 
> who had blacklisted them?

A client I was working with a few years ago had one of their Exchange servers 
mistakenly set up as an open relay.  They were spewing spam at a tremendous 
rate, and got blacklisted.  No one told us.  I think what your Exchange admin 
was trying to tell you is that in the actual SMTP reject message you got from 
the Exchange server should have been something like "550 5.7.1 Email rejected 
because 1.2.3.4 is listed by zen.spamhaus.org", as an example.  There are other 
possibilities besides spamhaus.org.


Mark POst

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Email blacklist

[Lionel B Dyck]

We use a mail filter product that determines if an e-mail is (a) spam or 
(b) contains something malicious and then blocks them. It has both a 
vendor provided blacklist and a local blacklist and can, based upon 
trends, classify a sender to the blacklist.

It sounds like your mainframe is probably using a non-public IP address 
and somehow your vendors blacklist picked up that address from a 
collection of blacklisted addresses that they probably collect from their 
customers to improve their list.

It is not something you'll find in the communications server pubs.

Lionel B. Dyck, Consultant/Specialist 
Enterprise Platform Services, Mainframe Engineering 
KP-IT Enterprise Engineering 
925-926-5332 (8-473-5332) | E-Mail: [EMAIL PROTECTED] 
AIM: lbdyck | Yahoo IM: lbdyck 
Kaiser Service Credo: "Our cause is health. Our passion is service. We're 
here to make lives better." 

I never guess. It is a capital mistake to theorize before one has data. 
Insensibly one begins to twist facts to suit theories, instead of theories 
to suit facts. 
- Sir Arthur Conan Doyle 

NOTICE TO RECIPIENT: If you are not the intended recipient of this e-mail, 
you are prohibited from sharing, copying, or otherwise using or disclosing 
its contents. If you have received this e-mail in error, please notify the 
sender immediately by reply e-mail and permanently delete this e-mail and 
any attachments without reading, forwarding or saving them. Thank you. 



From:
"Morris, Carey" <[EMAIL PROTECTED]>
To:
IBM-MAIN@bama.ua.edu
Date:
03/28/2008 12:44 PM
Subject:
Email blacklist



A few nights ago we started getting this message when we tried to send 
emails from the mainframe to our Outlook email server:

EZA5198I 03/25/08 23:25:23   2< 550 Denied by policy: Sender is listed on 
DNS-based RBL.

The Outlook admin explained that we use several outside services to 
identify email from SPAM sites and, for whatever reason, one of those 
sites had identified the mainframe's IP as a SPAM'er.  He said we should 
also be getting a message or email identifying the IP address of the 
service that had blacklisted us.  The problem cleared by itself, 
presumably when the service corrected the problem, but I have not been 
able to find anything in the Communications Server manuals that talks 
about this.  Has anyone else had the honor of being blacklisted and, if 
so, did they receive anything to tell them who had blacklisted them?

Thanks,
Carey Morris
City of Fort Worth

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html



--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Email blacklist

[Kelman, Tom]

I create reports via SAS every night and then send an email from the
mainframe to several techies and managers to tell them the reports are
available for review.  I've never run into anything like this yet.  Then
again my company might not be checking the same services yours does.

Tom Kelman
Commerce Bank of Kansas City
(816) 760-7632
> -Original Message-
> From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On
> Behalf Of Morris, Carey
> Sent: Friday, March 28, 2008 2:31 PM
> To: IBM-MAIN@bama.ua.edu
> Subject: Email blacklist
> 
> A few nights ago we started getting this message when we tried to send
> emails from the mainframe to our Outlook email server:
> 
> EZA5198I 03/25/08 23:25:23   2< 550 Denied by policy: Sender is listed
on
> DNS-based RBL.
> 
> The Outlook admin explained that we use several outside services to
> identify email from SPAM sites and, for whatever reason, one of those
> sites had identified the mainframe's IP as a SPAM'er.  He said we
should
> also be getting a message or email identifying the IP address of the
> service that had blacklisted us.  The problem cleared by itself,
> presumably when the service corrected the problem, but I have not been
> able to find anything in the Communications Server manuals that talks
> about this.  Has anyone else had the honor of being blacklisted and,
if
> so, did they receive anything to tell them who had blacklisted them?
> 
> Thanks,
> Carey Morris
> City of Fort Worth
> 
> --
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
> Search the archives at http://bama.ua.edu/archives/ibm-main.html




*
If you wish to communicate securely with Commerce Bank and its
affiliates, you must log into your account under Online Services at 
http://www.commercebank.com or use the Commerce Bank Secure
Email Message Center at https://securemail.commercebank.com

NOTICE: This electronic mail message and any attached files are
confidential. The information is exclusively for the use of the
individual or entity intended as the recipient. If you are not
the intended recipient, any use, copying, printing, reviewing,
retention, disclosure, distribution or forwarding of the message
or any attached file is not authorized and is strictly prohibited.
If you have received this electronic mail message in error, please
advise the sender by reply electronic mail immediately and
permanently delete the original transmission, any attachments
and any copies of this message from your computer system.
*

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Email blacklist

[Morris, Carey]

A few nights ago we started getting this message when we tried to send emails 
from the mainframe to our Outlook email server:

EZA5198I 03/25/08 23:25:23   2< 550 Denied by policy: Sender is listed on 
DNS-based RBL.

The Outlook admin explained that we use several outside services to identify 
email from SPAM sites and, for whatever reason, one of those sites had 
identified the mainframe's IP as a SPAM'er.  He said we should also be getting 
a message or email identifying the IP address of the service that had 
blacklisted us.  The problem cleared by itself, presumably when the service 
corrected the problem, but I have not been able to find anything in the 
Communications Server manuals that talks about this.  Has anyone else had the 
honor of being blacklisted and, if so, did they receive anything to tell them 
who had blacklisted them?

Thanks,
Carey Morris
City of Fort Worth

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html