Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently had a spamming incident and got listed on a blacklist. I have rectified the issue, removed from the blacklist, but my IP reputation is now classified as a high volume sender.

What is the best way to rectify this? I have an additional IP address. I am thinking configure my server to make outbound SMTP connections using the other IP.

My questions are:

  • How long does it take for my reputation to stabilize again?
  • How do I configure my server/mailserver to use a specified outbound IP?

Setup:

  • Server 2008 Web
  • hMailserver
  • 2 IPs configured on one NIC
  • Cloud based server

Your urgent help would be greatly appreciated.

Cheers

share|improve this question
4  
Go to the website of the blacklisting site(s), find and follow their delisting processes. –  Iain Nov 13 '12 at 7:27
    
Hi lain, thanks for your reply. As stated above, I have already delisted on the only blacklist I could find myself listed on, which was barracuda. The problem still resides that my ip is classified as "poor reputation" due to high sending when I had the issue.. –  Louis van Tonder Nov 13 '12 at 8:59

3 Answers 3

If you're on one blacklist, you're probably on more than one. Once you have made absolutely sure that you've eliminated the source of spam, you need to run your IP address against a centralized SMTP blacklist checker. If you find that you are included on some of the blacklists, you should see links to removal instructions as well.

You can review your IP address reputation with Cisco IronPort as well.

If the spam originated from an infected PC on your LAN, you may find that blocking port 25 outbound at your perimeter firewall (except from your mail server) will help to prevent this type of problem from recurring.

To specify the outbound IP address used by hMailServer, you need to set the "Bind to local IP address setting per the hMailServer documentation.

share|improve this answer
    
Hi, thanks, I did request removal everyrhwere, and blacklists show clean. Cisco Ironport now shows me as neutral. I suppose all the MTA need to refresh to see that... Also, I am running a shared web hosting server with multiple domains, so yea, might have been one of the users that was compromised. –  Louis van Tonder Nov 13 '12 at 10:36

You did not say which service exactly you're talking about. But in general, there's nothing you can do about it. Just use another IP and check first IP's reputation from time to time, it will "cool down" eventually.

share|improve this answer
1  
Hi, thanks for your reply. You hoever mention everything that I did? My questions are: ***** How do I configure my server/mailserver to use a specified outbound IP? –  Louis van Tonder Nov 13 '12 at 10:34
up vote 0 down vote accepted

As suggested above, and in my original post, manually removing from the blacklists was the first step. As user107708 suggested, letting it "cool down" was the only option.

I could however not get hmailserver to use my alternative ip to send. It seems its bound to one ip, for incoming and outgoing... and I cant change in incoming ip on the live server.

I ended up setting up a "backup" smtp server, for cases such as this, and relay all email through this backup server if the first server get compromises with reputation block. This way I can now switch between the two smtp servers when one is compromised, and letting the compromised server "cool down".

Only issue is with SPF, so my zone records point to both servers in their SPF records.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.