0

I have an interesting issue. I have a client that just got blacklisted due to spam being sent out over the last 2 days. I have my firewall configured to only allow mail to go outbound on port 25 from our mail server (Exchange 2010) exclusively and I have verified that there are no open relay's on our transport rules. We are running Vipre Business and after running deep scans with updated definitions all computers come back clean. I ran a message tracking report on our Exchange server that shows all mail sent via the mail server over the last couple of weeks and didn't see anything malicious or out of the ordinary. I have also verified that there are no home devices or rouge computers on the network. For all practical purposes it appears that the network is clean, but we still wound up on 5 or 6 blacklists...Where should I start looking next? Is there a "best practices" guide that can help eradicate this issue?

Thanks in advance! msindle

5
  • What type of internet connection is this network hung off of?
    – EEAA
    Nov 1, 2013 at 15:23
  • Its a cable connection with a static IP from our local ISP, did that answer your question?
    – msindle
    Nov 1, 2013 at 15:58
  • Do any of those blacklists give any specific information about why they listed you? Nov 2, 2013 at 1:53
  • Thanks for the responses and I hope everyone had a good weekend. @Gordon Unfortunately they just said please check your logs. One of my coworkers went ahead and delisted them, which i'm not entirely comfortable with, and wished they hadn't because now I cant see the reason for blacklisting. There was nothing that stood out to me in our logs, just normal mailings...any thoughts?
    – msindle
    Nov 4, 2013 at 15:54
  • For "best practices" see - serverfault.com/questions/419407/…
    – Cold T
    Jul 21, 2014 at 19:46

1 Answer 1

0

Is there any chance your messages are queueing up and then going out in bursts? We had that problem with some of our production servers; when a huge queue of emails goes out at once, some of the spam filters will detect that as problematic behavior.

I assume you're using Spamhaus to check their listings: we found ourselves on their lists whenever there was an issue, and they're easy to have your listing removed.

This previous serverfault topic should help you on the way towards best practices. Also, look here for more tips. Best of luck!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .