0

About 1 year ago I installed a new webserver (Linux) and I got a new IP address for it. At that time the webserver could not send any email and the IP address had a good reputation.

A few months later I added mailing capabilities to the server and authenticated SMTP service for my customers, with STARTSSL and valid SSL certificate. However I inadvertently misconfigured it as open relay. As soon as I realized my mistake (hours later), I fixed it and I went to ask delisting from the DNS block list services that listed it. Barracuda Reputation Block List (BRBL) was one of those.

However, while all other lists delisted it and never listed it again, BRBL now keeps listing the server IP address every 30 days. I keep asking removal as soon as they list it and they remove it.

The generic reasons that lead server to be listed do not seem to apply in my case: it's not an open relay anymore, since months, and I think it's not part of a botnet, because I have monitoring setup and if it were, I'd see spikes in the graphs at the very least.

They suggest, among other things, to register domains at EmailReg.org to ensure they do not list your IP by mistake. EmailReg.org costs USD20 per domain, which is sort of extortion: "pay me or I could list you by mistake". Besides, I believe there actually is a mistake, but I fear it's on my side. I only fail to understand where.

Is there a way to get a copy from Barracuda of at least one of the spam messages that led the IP address being listed at BRBL? Or the exact reason why they keep listing it such as the offending domain name or the like?

EDIT after Simon Greenwood's answer: I've obviously already found their IP reputation check tool, but it's basically useless from a "cause of listing" point of view. During the 30 days between one listing and the next one it simply says the IP is not listed. When the IP is listed it simply points me to the generic listing reasons above.

Lucio Crusca
  • 420
  • 3
  • 12
  • 33
  • Given the frequency, could it be from a mailing list coming from your server and possibly hitting a honeypot, or being reported? – Simon Greenwood Dec 17 '17 at 10:12

1 Answers1

0

You can check the reputation of your IP address at Barracuda Central as you've probably found, and the point is that it may not be a bad email that is causing the problem but the reputation of the IP address, the netblock, or indeed the provider. Barracuda used to be something of a black hole so that they are actually now providing a service, albeit a paid one, is actually an advance.

Simon Greenwood
  • 1,363
  • 9
  • 12
  • Well, thanks anyway, but that does not answer my question... and I'm not really convinced that BRBL takes into account netblock or provider reputation – Lucio Crusca Dec 17 '17 at 09:56
  • It's a key component of reputation. For example I know of a major European hosting company who have at least one netblock blocked on corporate mail firewalls and which is unblocked by exception. – Simon Greenwood Dec 17 '17 at 10:10