Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My email is being marked as SPAM by SpamAssasin. The problem is score 3.3 (among others):

3.3 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL
*      [ listed in]

I have no connection to whatsoever. Where did this IP come from?

share|improve this question looks like an Austrian cell phone (or related infrastructure). What are you using to send e-mail from? Send an e-mail to, it will send an e-mail back, see what it says. – Chris S Oct 22 '12 at 15:46
Checked with and all seems to be ok. Their SpamAssasin gives only 0.4 points. – Danijel Oct 22 '12 at 16:47
It may well be the recipient you're sending to has a misconfigured e-mail server (probably a relay at the IP address you mentioned, and the destination is improperly recognizing that relay as the sending host) – Chris S Oct 22 '12 at 17:00
@ChrisS That would be Austria, not Australia. It's a common mistake. :-P – Ladadadada Oct 22 '12 at 17:55
What do you mean by "my email"? Do you mean email you are sending or email you are receiving? If email you are receiving you are the one marking it as spam. If email you are sending, ask the recipient why they are marking it as spam. – David Schwartz Oct 22 '12 at 20:09
up vote 1 down vote accepted

Generally you'll want to check SpamHaus to see what the reported issue is:

IP Address is listed in the CBL. It appears to be infected with a spam sending trojan or proxy.

It was last detected at 2012-10-21 09:00 GMT (+/- 30 minutes), approximately 1 days, 7 hours, 59 minutes ago.

It has been relisted following a previous removal at 2011-06-22 17:06 GMT (487 days, 23 hours, 52 minutes ago)

Chances are, there's a compromised server listed on this node that's spoofing an address of yours to send SPAM. You might be interested in checking your logs on your mail server to see if there's any failed responses from hosts that you haven't been sending mail to.

share|improve this answer
Thanks. To be honest, I did not understand your post completely, but it's true - we've been hacked lately by a rootkit. And successfully removed it. What exactly should I check to fix this? – Danijel Oct 22 '12 at 21:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.