Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Recently one of our client machines was infected with a virus and I believe was spamming addresses in the user's contact list. Since then our server has been appearing on blacklists and it has been causing our e-mail to be blocked and returned by many clients. The virus has since been cleared, what can I do to get our server off these blacklists so that we will have more reliable e-mail service? Will I have to change my IP address?

Thanks,

Mike

share|improve this question
add comment

3 Answers 3

up vote 7 down vote accepted

Generally use this website MX TOOLBOX to find out which blacklist you are at (it can also help you to troubleshoot problems with your configuration such as good practice etc. While you're at it it will point you to blacklists you are on and will provide you with links to websites were you can remove it. Usually removing your server from blacklist happens automatically after 7 days or on simple fill out form should get it done. But there are couple of blacklists which want you to pay some money to do it. It's up to you if you want to.

As a side note. You could put a server on 2nd IP and have your main gateway different ip. This will prevent your server from getting blacklisted occasionally since only legitimate emails will come from your server and the other ip won't be listed as mail server so it won't be a problem even if it happens again. Usually when you get static ip you get more then one, it's just matter of configuring your router properly to supply that (Virtual IP and port forwarding for the rescue) :-)

To cheer you up I have had 3 cases so far of spam troubles (all 3 in diff companies) and it always worked out for the best. In such cases you really get to know where to look for help and how to troubleshoot stuff. You will come out of this stronger then ever!

share|improve this answer
    
Very nice web site, didn't know it. +1 –  Massimo May 26 '10 at 21:03
1  
Indeed. A great resource! –  xeon May 26 '10 at 22:42
1  
Great resource! You may also want to block outbound port 25 on your network to keep systems other than the mail server from sending out email. –  Jeff Hengesbach May 27 '10 at 1:47
add comment

You should discover which blacklist(s) your server ended up in and contact their owner(s) to explain the situation and have it removed.

While you're at it, also check that you have a proper DNS configuration and SPF records.

share|improve this answer
add comment

Try this Email Server test and implement its recommendations. Also, to prevent the recurrence of Virus/Hacking related issue, look at Outbound Email Security for your Exchange server.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.