I have a website hosted in a vps that sends informative emails to my clientes, maybe 20-40 emails per day. Since few weeks ago some sent emails are bouncing with the following error:
This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed:
email@example.com SMTP error from remote mail server after RCPT TO:: host mx1.emailsrvr.com [126.96.36.199]: 554 5.7.1 ACL dns_rbl; Client host [MY-IP] blocked using sa-dnset.blagr.emailsrvr.com=127.24.0.2 Please visit http://bounce.emailsrvr.com/?a0 for more information on why this message could not be delivered
------ This is a copy of the message, including all the headers. ------
**MY-IP is the ip of my vps server*
Tracking the error according to details in the email body, I found that my ip is blacklisted in Blocklist Removal Center with the following warning:
The sending IP address or domain of the message is currently on a blacklist. The intended recipient will need to safelist the IP address the message is being sent from. Please use an alternate method to relay this information to the intended recipient. To find out more information on where the sending host is blacklisted, enter the IP address, located in the rejected message, into our Blacklist Aggregator.
Why is the ip blacklisted?
Following up the warning and information provided, this is happened to me because:
- It appears to be infected with a spam sending trojan, proxy or some other form of botnet.
- It was last detected at 2014-03-26 19:00 GMT (+/- 30 minutes), approximately 3 days, 1 hours, 30 minutes ago.
- The host at this IP address is infected with the Ebury Rootkit/Backdoor trojan.
Ebury is a SSH rootkit/backdoor trojan for Linux and Unix-style operating systems. It is installed by attackers on root-level compromised hosts by either replacing SSH related binaries (such as ssh or sshd) or a shared library (such as libkeyutils.so) used by SSH
What should I do in this case?
The only way to definitely remove a rootkit is to format all partitions on the server, then reinstall the operating system. Once a system has been root compromised, there is no way to confidently clean it up, because with root access, backdoors can be placed that you cannot detect. Essentially, once a server has been root compromised, it can never be trusted again, no matter what steps are taken to try to clean it.
So, what is the question here?
I am really tired dealing with emails that are never sent correctly. Also, yahoo neither hotmail are not getting the messages at inbox, but spam does.
My plan from here is to hire another hosting provider with a new ip address from scratch, make use of security procedures to avoid this situation again but I want take advantage of this change and install a S/MIME certificate to give emails more security (as a friend's recommendation).
- Will a S/MIME certificate help me to minimize emails at spam folder on yahoo and hotmail?
- How a S/MIME certificate will help me in this situation?