-1

On a 1&1 shared hosting, I'm using mail(...); from a PHP script (which itself calls /usr/sbin/sendmail -t -i) and finally I get an error message (see below).

More or less my mail (I send less than 5 mails per day) is considered as spam by SORBS. It's not spam (it is usually an important mail to a customer with their download link after a purchase) nor a virus.

I'm having a nightmare since days to solve this problem.

Questions:

  • what is the flow diagram of my email ?

local PHP ==> local sendmail ==> ... ? SORBS ? ==> recipient server ? => error message? (who sends it? sorbs or recipient or local sendmail?)

  • where is SORBS working in this story ? By my shared hosting (1&1)? Somewhere in the middle? By who is this service called? By the recipient's server?

  • how to typically solve such problems? SORBS seems to be difficult to reach (no phone, difficult to contact support via email, etc.) and very opaque

Note: I've asked SORBS for delisting, but the problem continues.

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed:

aaa@domain2.com: SMTP error from remote server for RCPT TO command, host: mail.forwarder.lexsynergy.com (212.20.251.xx) reason: 550-212.227.126.xx is listed at dnsbl.sorbs.net (127.0.0.xx, 127.0.0.xx: 550 Virus Transmitting Server See: http://www.sorbs.net/lookup.shtml?212.227.126.xx)

--- The header of the original message is following. ---

Received: from xx.kundenserver.de (infong1124.kundenserver.de [212.227.18.xx]) by mrelayeu.kundenserver.de (node=mreue006) with ESMTP (Nemesis) id 0LzUX8-1b2ynI3IFW-014gcV; Tue, 06 Sep 2016 14:34:58 +0200 Received: from 173.0.81.1 (IP may be forged by CGI script) by icpu2490.kundenserver.de with HTTP id 4AibFb-1bfKiR2kcj-002Zae; Tue, 06 Sep 2016 14:34:58 +0200 X-Sender-Info: xxx

Basj
  • 709
  • 3
  • 11
  • 29
  • 1
    Without knowing the actual IP address it's difficult to provide advice beyond, send your mail through your ISPs relay host. – user9517 Sep 06 '16 at 19:28
  • 1
    I don't mean to be rude, but it sounds like you don't have a significant amount of the basic information needed to competently administer a mail server. I'd strongly urge you to use your hosting provider's email services which are professionally managed. What you're doing is a bit like learning how to drive a car on a freeway. (Though, of course, you're unlikely to kill anyone.) – David Schwartz Sep 07 '16 at 00:11
  • 1
    @DavidSchwartz : I don't want to administer a mail server myself. That's why I use a shared hosting with everything configured for me by a sysadmin. But this problem (SORBS listing) appears and I want to understand how things work so that I can speak more easily with the tech hotline support of my shared hosting provider :) – Basj Sep 07 '16 at 11:31
  • 1
    @Basj Ahh, gotcha. Sorry for sounding rude. In that case, adding to your toolkit is a very good thing. – David Schwartz Sep 07 '16 at 15:37
  • @DavidSchwartz No worries! :) – Basj Sep 08 '16 at 14:12

2 Answers2

5

What is the flow diagram of my email?

PHP -> local MTA (sendmail) -> remote server

Error message? (who sends it? sorbs or recipient or local sendmail?)

The error line (550-[IP] is listed...) is generated by the remote server when you try and send mail to them. Your MTA then sends the message (known as a Non-delivery report) back to you indicating that it was unable to deliver the message.

Where is SORBS working in this story?

SORBS is a list of IP addresses that fall into various categories. They don't check the content of your email at all. The remote MTA is checking for your IP address in that list and rejecting your connection based on the results. In your case they show that your IP address was sending out viruses at one point in time. You can follow the link in the rejection for more details on exactly when and why your host was listed.

How to typically solve such problems?

First, make sure you are not configured as an open relay. Check your mail logs and config to make sure you are only sending out messages that you expect to be. You can use the mxtoolbox diagnostic tool to test if your server is an open relay. Also you should check that you aren't running a vulnerable PHP application that is sending out messages. Fix these issues if they exist before requesting a de-listing.

If your server is clean and you've started the de-listing process and are still on the list after 24 hours it is likely that the address given to you by your ISP was used by a spammer at one point in time and has a bad reputation. The SORBS de-listing process takes longer each time you have to request de-listing.

David
  • 606
  • 4
  • 6
4

where is SORBS working in this story ? By my shared hosting (1&1)? Somewhere in the middle? By who is this service called? By the recipient's server?

Email blocklists such as SORBS are typically operated by the recipient organisation (e.g. the company not the individual) or whoever they've subcontracted their email gateway services to (e.g. systems like mimecast or barracuda's email filters). Your customer has decided that a clean email feed is more important than your emails (though they probably didn't quite understand the implications of the choices they made in their email filter settings, so good luck explaining that to them).

This is explained reasonably well at the SORBS website (http://www.sorbs.net/listing/aboutlistings.shtml). Your address is listed as part of a block on virus sites, so you should also read http://www.sorbs.net/delisting/virus.shtml if you have not done so already.

Simply put, you will need to ensure the problems are fixed in order to be considered for de-listing. This may require the co-operation of your webhost provider, it may be a simple matter to clear up (e.g. your IP address was previously used by a malicious or dumb customer and now you've taken it over it can reasonably be demonstrated to be clean), or it may not be so easy.

To a large degree, if this is nothing you've done, then I do strongly suggest you enlist the help of your webhost as they've effectively sold you damaged goods. If it is something you've done, e.g. your site is or has been compromised, they may still be best placed to help you resolve your issues as this will probably be neither the first or last time they've had to deal with this kind of thing.

Another alternative for you would be to smarthost your emails for this kind of thing through another service. There are some out there who specialise in being "clean" for this kind of thing.

Rob Moir
  • 31,884
  • 6
  • 58
  • 89