vmsperl was in the spamcop list.

2005-01-29 Thread John E. Malmberg
Somehow the vmsperl mailing list got into the spamcop.net list.
(reason: 530 5.7.1 Blocked -
see http://www.spamcop.net/bl.shtml?63.238.179.181:
Since this is a closed list, the only possibilities are:
   1. The host had a security problem.
   (I really do not think that is likely)
   2. One or more subscribers on the mailing list accidentally
  reported something from the mailing list as spam, and
  also confirmed that the mail list server was the source
  of the spam as a second step.
The second is more likely, so please be careful.  Spamcop rules 
specifically only allow mailing list administrators to report spam that 
comes from a mailing list.

Now I do not know how many mailing lists share this server, so the 
report may not have been from a subscriber to this mailing list.

Most of the time the spamcop.net used to figure out that the mailing 
list was not the source, however spammers found ways to take advantage 
of that.

So now spamcop.net is phasing over to a mailhost configuration.  If your 
spamcop.net account has been converted to the mailhost configuration, 
then if you report a mailing list message as spam, the parser will
probably stop at the mail server and indicate it as the spam source.

If the one of the mailing list administrators gets a spamcop.net 
account, and registers the mailing list server as one of their 
mailhosts, the spamcop.net parser is more likely to treat it as a 
trusted sender if someone accidentally reports spam in the past.

Also, if you are a SpamAssasin user, and not yet on SpamAssasin 3, 
reports that I seen from the field is that SpamAssasin 3 is far more 
accurate than the earlier versions if you use the feature that checks 
the I.P. address of URLs in messages against the DNSbls.

Thanks,
-John
[EMAIL PROTECTED]
Personal Opinion Only


Re: vmsperl was in the spamcop list.

2005-01-29 Thread Craig A. Berry
At 9:31 AM -0500 1/29/05, John E. Malmberg wrote:
Somehow the vmsperl mailing list got into the spamcop.net list.

(reason: 530 5.7.1 Blocked -
see http://www.spamcop.net/bl.shtml?63.238.179.181:


This has happened from time to time, but the address you show here is
not the address of lists.develooper.com, the MTA for all the Perl
mailing lists.  63.238.179.181 is for called qsl.net, which is where
you are sending mail from.

In any case, I cannot find any evidence that we are currently
blacklisted by spamcop.  You can see a pretty detailed report on the
domain here:

http://www.senderbase.org/?searchBy=ipaddresssb=1searchString=63.251.223.163

It does look like the entire ISP is listed by blackholes.us:

http://openrbl.org/zones/@ISP?63.251.223.163

but I'm not at all sure I know how to read that page.  If this is
causing problems for anyone, please write to the list owner.

Since this is a closed list, the only possibilities are:

   1. The host had a security problem.
   (I really do not think that is likely)

   2. One or more subscribers on the mailing list accidentally
  reported something from the mailing list as spam, and
  also confirmed that the mail list server was the source
  of the spam as a second step.

Or some entirely unrelated activities have gotten your ISP listed.

The second is more likely, so please be careful.  Spamcop rules specifically 
only allow mailing list administrators to report spam that comes from a 
mailing list.

Now I do not know how many mailing lists share this server, so the report may 
not have been from a subscriber to this mailing list.


Most of the time the spamcop.net used to figure out that the mailing list was 
not the source, however spammers found ways to take advantage of that.

So now spamcop.net is phasing over to a mailhost configuration.  If your 
spamcop.net account has been converted to the mailhost configuration, then if 
you report a mailing list message as spam, the parser will
probably stop at the mail server and indicate it as the spam source.

If the one of the mailing list administrators gets a spamcop.net account, and 
registers the mailing list server as one of their mailhosts, the spamcop.net 
parser is more likely to treat it as a trusted sender if someone accidentally 
reports spam in the past.

The last time this happened, the listowner wrote to smamcop, who
immediately cleared the listing and apologized.

Also, if you are a SpamAssasin user, and not yet on SpamAssasin 3, reports 
that I seen from the field is that SpamAssasin 3 is far more accurate than the 
earlier versions if you use the feature that checks the I.P. address of URLs 
in messages against the DNSbls.

Good to know. 



-- 

Craig A. Berry
mailto:[EMAIL PROTECTED]

... getting out of a sonnet is much more
 difficult than getting in.
 Brad Leithauser


Re: vmsperl was in the spamcop list.

2005-01-29 Thread John E. Malmberg
Craig A. Berry wrote:
At 9:31 AM -0500 1/29/05, John E. Malmberg wrote:
Somehow the vmsperl mailing list got into the spamcop.net list.
  (reason: 530 5.7.1 Blocked -
  see http://www.spamcop.net/bl.shtml?63.238.179.181:
This has happened from time to time, but the address you show here is
not the address of lists.develooper.com, the MTA for all the Perl
mailing lists.  63.238.179.181 is for called qsl.net, which is where
you are sending mail from.
I am sorry, I should have noticed that it was my mail relay service I.P. 
address.

But I am not sending from that I.P. address.  The only e-mail that 
originates from that I.P. address is that of the owner of the QSL.NET 
service.

All other e-mail from that I.P. address will only go to members of the 
QSL.NET service.

So it must have been a member of QSL.NET that reported their own mail 
relay.  Unless of course that QSL.NET had a security breach, which I doubt.

As I am double subscribed to this list, I did not miss anything.
I usually subscribe to mailing lists with the qsl.net e-mail address set 
to no mail because the QSL.NET spam filters are too aggressive for 
mailing lists, and sometimes will reject real e-mail from them, but just 
use qsl.net for posting because of the same spam filters foil most of 
the harvesting and worms.

That no-mail option is not available on this mailing list.
I will see if the encompasserve.org postmaster will whitelist the 
qsl.net I.P. address which will prevent this condition from happening 
the next time a qsl.net member has an accident.

-John
[EMAIL PROTECTED]
Personal Opinion Only