1

Recently noticed that email server IP address 88.119.185.129 is added to Symantec email blacklist. This IP is clean, not listed at any blacklists. The email server is not open relay, all emails are signed by strong DKIM, also using PRVS, and no spam e-mails. IP has valid PTR (reverse DNS) and SPF records. No suspicious activity - it's clean machine. Have tried several times to ask to remove from Symantec email blacklist at IP Address Investigation Request page - and they removed it - but after 1 day - IP was added again. I heard lots of people complains about this Symantec blacklist.. How to fight them? It is impossible to send emails to several domains now.

  • Are you quite certain that no spam is originating from that IP address? – Michael Hampton Aug 9 at 13:25
  • Yes, all server traffic is recorded. – Ernestas Gruodis Aug 9 at 13:29
  • How are you recording all the server traffic? – Tero Kilkanen Aug 9 at 13:30
  • To file, on CLI, etc.. - it is possible to see and analyze all sockets (ports 25, ..) activity. I mean only for server administrator. – Ernestas Gruodis Aug 9 at 13:35
2

Short answer: Your server is sending spam.

Long answer: Someone somewhere flags a message that he/she received as spam. Most probably an indirect outgoing message - maybe a forwarding adress.

| improve this answer | |
  • Regarding spam - impossible. I think they are supporting media giants like gmail, etc.. and forcing to use their services, and not some widely unknown SMTP servers.. If that would be the real case - Symantec would provide a proof in some kind of form. This makes me not to trust in their products. – Ernestas Gruodis Aug 10 at 16:34
  • 1
    This is interesting. I plugged in an IP address I control which has not been used for over a year, and it also came up with a "negative reputation". So too with several other IP addresses of VMs which don't send mail. I don't know what Symantec is doing, but I'm pretty sure now that they're doing it wrong. – Michael Hampton Aug 10 at 16:59
  • 1
    Unused IPs are usually not 'negative', but DUL or SORBS (see zytrax.com/books//dns/ch9/dnsbl.html for details). Technically they can't have a reputation, or they inherited a bad one (maybe from a netblok). But symantec is the king and queen of intransparency here, I don't recommend using their stuff because of this, too. – bjoster Aug 11 at 9:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.