Today I one of our customers forwarded to me a mail from the ISP of one of her mail recipients that says they're blocking my customer's email because our webserver IP is listed in some RBLs.
Of course the latter, being a webserver, has nothing to do with this email journey through the 'net and unfortunately there isn't any DSN / bounce to look at: all we got is an email from someone working at the recipient's ISP saying "mail gets blocket because $ip_of_webserver is in $someRBL but I don't know why our system are checking that ip in the RBLs".
- the blocked mails have sender domain1.com and recipient domain2.com
- the blocked mails started on the user's MS Outlook, which sent them to mail.ispdomain.com, which sent them to smtpout.ispdomain.com, which sends them to the MX of domain2.com
- the MX of domain2.com does accept the email from our smtpout and responds
250 Requested mail action okay, completed- it probably filters the email in a later phase
- domain1.com has MX records mx.ispdomain.com
- mail.ispdomain.com, mx.ispdomain.com, smtpout.ispdomain.com are not listed in any RBL
- webserver.ispdomain.com is listed in SORBS-WEB and SORBS-SPAM
- only that specific IP is listed and not a whole range or subnet
- webserver.ispdomain.com relays all of its locally-generated mails through smtpout.ispdomain.com
- the blocked email did not come from or pass through the webserver
- all the servers have correctly configured PTR records on their IP addresses
This is still an open issue and it will be interesting to see how a webserver that relays all of its mails to another system got listed in an RBL, but that's another story.
I am not asking "why doesn't my mail work" or how to de-list my system. Been there, done that.
I see that the only connection between an email and a webserver IP can be the domain name of the mail's recipient (possibly present in the mail text too, eg. in the signature). I'm guessing some antispam system took that domain name (from recipient address or from mail body), resolved its A dns record, and looked that up in RBLs.
I am asking: is there some widespread antispam software / technique that behaves like that? And is that actually an effective measure against spam?