how-to block ads
|
|
Share Topic
 |
 |
|
|
|
 graysonfPremium,MVM
join:1999-07-16
Fort Lauderdale, FL | reply to Gizguy
Re: BellSouth E-mail server Blacklisted? MX records don't have anything to do with this. Why?
The servers that send mail out, the ones being blacklisted, are not the same ones used that receive mail for the bellsouth.net domain. It's the receiving servers that have an MX record, not the sending servers. | |
 GizguyPremium
join:2003-01-23
Alpharetta, GA | graysonf,
you most likely know much more about MX records than me, I'm just pecking away trying to figure out why starting last week my email to my daughter's work place was being rejected. In all cases the rejects had a common source of error - a BellSouth server at one of the following addresses:
imf21aec.mail.bellsouth.net [205.152.59.69]
imf24aec.mail.bellsouth.net [205.152.59.72]
They look like 'mail' servers and they are being rejected on my outgoing messages, not my incoming mail. At the time I reported this problem I know for a fact that '»www.mxtoolbox.com ' indicated the .59.69 address had MX records as being black listed. The reject early this morning was for the .59.72 address. Similarly IP addresses in my residential IP Subnet 66.156.67.xxx yesterday showed MX records on the black list.
As of this post, neither of these addresses, nor addresses in my DSL subnet, show up as having MX records (see attached). Also, now my mail has "not" been rejected. So either BellSouth has cleared the problem as promised, or something stranger is happening. Or perhaps the small text message I sent 30 minutes ago is still in queue somewhere.
I do appreciate all of they help that you and others have provided. | |
graysonfPremium,MVM
join:1999-07-16
Fort Lauderdale, FL | imf21aec.mail.bellsouth.net [205.152.59.69] and imf24aec.mail.bellsouth.net [205.152.59.72] are outgoing mail servers used by bellsouth customers. The do not have MX records because they do not receive mail for the bellsouth.net domain.
The two mail servers that currently do receive mail for the bellsouth.net domain are:
mx01.mail.bellsouth.net [205.152.58.33] and
mx00.mail.bellsouth.net [205.152.58.32]. These are the actual MX records for bellsouth.net.
There are dozens, if not hundreds of blacklists in use out there. And they use varying criteria for inclusion of IP addresses.
For example, every single residential bellsouth.net IP address (both dialup and DSL) is in the DUL blacklist. These inclusions have nothing to do with any evidence of any spam being sent. The logic for this list is that running mail servers on these IPs is not allowed by the ISP, so any mail coming directly from them is likely problematic. Bellsouth's use of port 25 filtering has largely reduced the usefulness of this portion of the DUL.
Some sites reject mail because the IP sending it reverses to a hostname that does not also have an MX record. This is poor practice since many large ISPs operate as described above and their sending mail server hosts do not have MX records. A site rejecting mail this way would reject 100% of all the mail sent by bellsouth's customers.
And some sites reject mail based on actual spam content, or receiving mail at unknown and unpublished addresses. This could be the result of brute force address guessing commonly used to send spam.
And there are many, many other rationales/designs for blacklists. | |
GizguyPremium
join:2003-01-23
Alpharetta, GA | thanks | |
 bathswifeOriginal Member
join:2000-09-06
Birmingham, AL | reply to graysonf
I am completely confused which is not all that unusual but maybe you can help me understand.
Please read through what I write carefully because I don't know the right language to try to explain what I'm confused about and I need help talking to the help desk.
What is the difference between the IP address and the server address? I thought that the IP address was what your computer showed to the public as your IP address.
All I know is that until I got accidentally moved to having a dynamic IP address I had no trouble sending email to anyone. Now that my IP address is dynamic, it's a crapshoot as to whether or not I can send email. When I power off the router from time to time (electrical storms, etc.), I am given an IP address at random by bellsouth.
If my emails start getting bounced back to me because the IP I am using is listed in nsorbs, etc.,(like last night), I know that the IP I have been dynamically assigned has been reported by someone as coming from a spammer. I then have to power off my router and power it back on and try sending the same emails again. If the IP I am assigned after powering back on is one that is "good", the email will go, if it is one that has been abused in the past by someone spamming and has been reported to nsorbs,etc., I have to keep powering off the router and powering it back on until I get a good one.
I believe it is my computer IP that is being rejected by the recipient's ISP because in the headers, the numbers listed as being rejected are exactly the numbers of the IP I've been dynamically assigned by bellsouth.
So what I think is happening here is that it is my computer's assigned IP address that is being rejected, and perhaps that is a bellsouth 'server' and I just don't know the correct lingo. That is what worries me. When I talk to the help desk, are they going to understand what I'm saying is the problem? Can you request a specific static IP address? And if so, how can you know one to ask for that has NOT been used in the past by a spammer?
When I call the help desk to get put back on static, how can I ensure that I get my old IP address back (the good one that never got emails bounced back) or one that has not previously been abused by someone?
I have been a member of spamcop for years and go through energetic spurts of turning every single spam in for a day or two before I just get too worn out so I am familiar with the problems associated with spam. I understand why some addresses are blocked by nsorbs and the other organizations like them and I don't have a problem with that. What I think is that before some glitch occurred in the BLS system that caused my account to revert back to 'dynamically assigned IP' I never had any problems sending emails. Now I do. I want my old static IP address back that was what I think of as "clean" in the sense that it hadn't been used by spammers and I never had trouble sending email to people.
--
jbooksNOSPAM@bellsouth.netremove the "nospam" from the email to email me.mhttp://www.johnsonsusedbooks.com | |
graysonfPremium,MVM
join:1999-07-16
Fort Lauderdale, FL | Your problem is not related to your IP address because you are not allowed to send mail directly from your IP address to any mail server other than mail.bellsouth.net, and the mail being rejected isn't coming from mail.bellsouth.net. | |
bathswifeOriginal Member
join:2000-09-06
Birmingham, AL | Okay, I'm going to cut and paste the entire header here and maybe you can help me understand what you are saying. The sending IP address that is listed as being rejected was my public IP address at that time dynamically assigned to me (205.152.59.67). Here is the entire header: Recipient:
Reason: 5.5.1 Rejected, sending IP address 205.152.59.67 is blocked. Details: IP 205.152.59.67 is blacklisted (code 6), info at »blacklist.kpn-cert.nl/bailout
Reporting-MTA: dns; imf19aec.mail.bellsouth.net
Arrival-Date: Thu, 22 Dec 2005 23:43:01 -0500
Received-From-MTA: dns; ibm60aec.bellsouth.net (208.63.194.66)
Final-Recipient: RFC822;
Action: failed
Status: 5.1.1
Remote-MTA: dns; mailhost.hetnet.nl (195.121.6.164)
Diagnostic-Code: smtp; 550 5.5.1 Rejected, sending IP address 205.152.59.67 is blocked. Details: IP 205.152.59.67 is blacklisted (code 6), info at »blacklist.kpn-cert.nl/bailout
Received: from ibm60aec.bellsouth.net ([208.63.194.66])
by imf19aec.mail.bellsouth.net with ESMTP
id
for ; Thu, 22 Dec 2005 23:43:01 -0500
Received: from Karen.sip.bhm.bellsouth.net
([208.63.194.66]) by ibm60aec.bellsouth.net with ESMTP
id
for ; Thu, 22 Dec 2005 23:43:00 -0500
Message-Id:
X-Sender: harperbooks@mail.bhm.bellsouth.net
X-Mailer: QUALCOMM Windows Eudora Version 6.1.2.0
Date: Thu, 22 Dec 2005 22:42:21 -0600
To: "Ben Blomsma"
From: Karen Harper
Subject: Re: Item #6584916504
In-Reply-To:
References:
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary="=====================_83387859==.ALT" After I powered off my router and powered it back on, I was dynamically assigned an IP addy that began with 72.X.X.X and was immediately able to send the email to the above person. I don't think that is coincidence but perhaps I am still not understanding what you are trying to tell me.
--
jbooksNOSPAM@bellsouth.netremove the "nospam" from the email to email me.mhttp://www.johnsonsusedbooks.com | |
NormanSPremium,MVM
join:2001-02-14
San Jose, CA
kudos:4 Reviews:
 ·SONIC.NET
·Pacific Bell - SBC
| reply to bathswife
Are you running your own mail server? From home? On your residential account? I am not familiar with the Bellsouth AUP/TOS, but, personally, I have no problem if you are doing that.
If you are doing that, then you must know a little bit about mail servers, domains, DNS records, MX records, etc. If you are not doing that, then how do you send email? Having your computer's IP address in DNSBLs is only an issue if you are running a mail server from that computer; otherwise, you are using somebody else's SMTP server for your outbound email, and it will be their server's IP address, not yours, which is subject to listing by DNSBLs.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum | |
graysonfPremium,MVM
join:1999-07-16
Fort Lauderdale, FL | reply to bathswife
205.152.59.67 is/was not your public IP address. It belongs to one of bellsouth's outgoing mail servers:
Name: imf19aec.mail.bellsouth.net
Address: 205.152.59.67
Your public IP address that was in effect when you sent the mail appears to be:
Name: adsl-63-194-66.bhm.bellsouth.net
Address: 208.63.194.66
This address was not the one used for the basis of the rejection, 205.152.59.67 was. | | |
|
bathswifeOriginal Member
join:2000-09-06
Birmingham, AL | said by graysonf:205.152.59.67 is/was not your public IP address. It belongs to one of bellsouth's outgoing mail servers: Name: imf19aec.mail.bellsouth.net Address: 205.152.59.67 Your public IP address that was in effect when you sent the mail appears to be: Name: adsl-63-194-66.bhm.bellsouth.net Address: 208.63.194.66 This address was not the one used for the basis of the rejection, 205.152.59.67 was. Okay, I'm trying to understand this. Where did you get the "adsl-63-194-66"? And how exactly do you find out what your current IP address is? When I looked at my "public IP" address here on the DSLReports site, it showed the 205.152.59.67 as being my IP. Sorry to be so slow on this but I want to make sure I do the right thing when I switch back to static IP. Thanks for using small words and speaking slowly 
--
jbooksNOSPAM@bellsouth.netremove the "nospam" from the email to email me.mhttp://www.johnsonsusedbooks.com | |
bathswifeOriginal Member
join:2000-09-06
Birmingham, AL | reply to NormanS
said by NormanS:Are you running your own mail server? From home? On your residential account? I am not familiar with the Bellsouth AUP/TOS, but, personally, I have no problem if you are doing that. No, I'm not running on my own mail server. I wouldn't have a clue about how to do that sort of thing. I think the problem I'm having explaining my situation is that I have never learned how to properly read a complete email header. I started learning it way back when I signed up for spamcop but got lazy, ahem, busy and didn't do it. Now I think my problem is that I am reading the headers wrong and so giving information wrong.
My goal here is to understand what is happening so I can fix it. I'm thinking that if I switch back to a static IP I will be able to send emails to everyone like I always had been able to before but I'm beginning to think that it might not make any difference which is very depressing.
--
jbooksNOSPAM@bellsouth.netremove the "nospam" from the email to email me.mhttp://www.johnsonsusedbooks.com | |
NormanSPremium,MVM
join:2001-02-14
San Jose, CA
kudos:4 Reviews:
·SONIC.NET
·Pacific Bell - SBC
| said by bathswife:No, I'm not running on my own mail server. I wouldn't have a clue about how to do that sort of thing... My goal here is to understand what is happening so I can fix it. I'm thinking that if I switch back to a static IP I will be able to send emails to everyone like I always had been able to before but I'm beginning to think that it might not make any difference which is very depressing. No. For your case there will be no difference between the static and the dynamic IP address. Which isn't to say that you shouldn't try to get it back; assuming that you were paying for a static IP package, you should not have been switched to a dynamic IP account.
However, if you are not running a server from your computer, your email is going out through somebody else's SMTP server; in your case, a Bellsouth SMTP server. Your problem with rejected email is separate from, and unrelated to your problem with your lost static IP address. No mail server should reject email from an ISP SMTP server on the basis of the submission IP address; else nobody would be able to send email. My submission IP address is blocked six ways from Sunday just because it is a dynamic IP address.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum | |
bathswifeOriginal Member
join:2000-09-06
Birmingham, AL | said by NormanS:However, if you are not running a server from your computer, your email is going out through somebody else's SMTP server; in your case, a Bellsouth SMTP server. Your problem with rejected email is separate from, and unrelated to your problem with your lost static IP address. No mail server should reject email from an ISP SMTP server on the basis of the submission IP address; else nobody would be able to send email. My submission IP address is blocked six ways from Sunday just because it is a dynamic IP address.
So each time I power off my router and then power it back on I'm sent through a different bellsouth mail server? Argh. How can I change which bellsouth smtp server my mail is sent through? I would like to avoid this problem. --
jbooksNOSPAM@bellsouth.netremove the "nospam" from the email to email me.mhttp://www.johnsonsusedbooks.com | |
NormanSPremium,MVM
join:2001-02-14
San Jose, CA
kudos:4 Reviews:
·SONIC.NET
·Pacific Bell - SBC
1 edit | 
SMTP relay diagam. |
said by bathswife:So each time I power off my router and then power it back on I'm sent through a different bellsouth mail server? Argh. How can I change which bellsouth smtp server my mail is sent through? I would like to avoid this problem. No. You set your mail client to use mail.bellsouth.net. The IP address for this server is fixed in DNS. It exists independent of your IP address which you draw from the DHCP address pool. Furthermore, this message submission server need not have the same IP address as the Bellsouth output SMTP server.
There is no way for you to control which Bellsouth output SMTP server sends your email on to the Internet. That is determined entirely by some kind of network traffic management magic. Things work something like this:
You computer gets an IP address from the Bellsouth DHCP pool. When you send email with MS Outlook Express, your computer connects to the BS SMTP server on that server's IP address. In the simplest configuration, that server then does a DNS lookup on the recipient domain to find that domain's MX server; after which, it connects to that MX server. That BS output-to-recipient-MX connection is fixed at one of two IP addresses, as explained earlier. Your computer IP address is well out of this loop by the time that the message is being relayed on to the destination. This relay is between either of two Bellsouth SMTP relay clients, " imf21aec.mail.bellsouth.net [205.152.59.69]", or "imf24aec.mail.bellsouth.net [205.152.59.72]". You have zero control over which of those two servers handles your email.
The diagram I have included shows a schematic of the arrangement. The point at which your email is being rejected is the looping line between the Bellsouth SMTP relay clients and the SBC (prodigy.net) MX server. As you can see, your computer's IP address is not even known to the SBC MX server. At the time an MX server rejects an email, the only foreign IP address that the MX server sees is the connecting SMTP relay client's IP address (oversimplified; some MX servers can examine the message through DATA for content filtering).
Oh, I just picked on the SBC MX server to illustrate the nature of the problem. You should substitute the actual MX server for the domain rejecting your messages.
Addenda:
Bellsouth may have more than the two SMTP relay clients shown in my diagram; some may be blocked, others not. Whether you draw a new IP address may, or may not affect which Bellsouth SMTP servers in their farm will handle your email. Whether your email goes through, or is rejected, is dependent upon which SMTP relay client is handing of the message to the destination MX server.
said by bathswife:Okay, I'm trying to understand this. Where did you get the "adsl-63-194-66"? And how exactly do you find out what your current IP address is? A couple of places to find your IP address:
»www.whatismyip.com/
»myip.dslextreme.com/
BTW, that second one shows why I am sometimes confused in this forum; DSL Extreme is not only the name of a level of Bellsouth DSL service, it is also the name of a CLEC DSL service provider who could have serviced my premises if I hadn't started up on Pacbell DSL (now SBC AT&T) service.
More interesting information can be found here (by filling in the blanks):
»www.dnsstuff.com/
Your IP address should be visible near the upper right corner on the DNSStuff page.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum | |
graysonfPremium,MVM
join:1999-07-16
Fort Lauderdale, FL | reply to bathswife
You pasted the header from the rejected mail. In that header was the Received: header inserted by the bellsouth mail server that handled your message. That Received header contained your IP address, 208.63.194.66. A reverse lookup of that IP yields adsl-63-194-66.bhm.bellsouth.net.
One very simple way to determine your current IP address is to surf to this link:
»checkip.dyndns.org/
I don't see how it's possible you had an IP address that belongs to a bellsouth.net mail server. | |
GizguyPremium
join:2003-01-23
Alpharetta, GA | reply to graysonf
Isn't this fun..... two hours after I sent my 12:25pm email a reject message was received - once again reporting the Bellsouth outgoing email with ip address of 205.152.59.69 as the cause of the rejection. Perhaps it takes some time for '»www.us.sorbs.net ' to update the removal of this IP address from '»www.mxtoolbox.com ' , or maybe sorbs.net is rejecting the mail for another reason. In all fairness, it may just be a problem between BellSouth and the receiving email system since all of my other POP mail is not rejecting.
Again as I posted earlier, when I send an POP email to this one recipient from the same PC, with same DSL IP address, but I send it using a non-BellSouth email ID through Google's GMAIL smtp server (outgoing port of 465) the message is not rejected. Similarly if I send the mail using the smtp server of the web hosting company I use (not using port 25) it gets through fine.
So it appears to be a problem within the BellSouth Email system - which many on this forum have reported as being very weak. It even failed when I sent the message using BellSouth's Webmail.
Please note, that regardless of what email address I use (BellSouth, or my personal domain address), the mail rejects for this one recipient only when I use the BellSouth.Net (port 25) mail server. I'm not going to lose any sleep over this as I am now sending all of my POP email via Google's SMTP server and/or my web hosting server. However, if BellSouth ever prevents me from using these alternatives, then I guess I'll switch to an alternative broadband provider. | |
bathswifeOriginal Member
join:2000-09-06
Birmingham, AL | reply to NormanS
Okay, great diagram and information. At least there is a glimmer of hope that I might understand all of this because I have a place to start.
I can see I am going to have to start reading a bunch of technical stuff to try to understand and you all have been very helpful. I appreciate that.
Yes, it was a bad analogy and really all I was pointing out is that I get more spam now than I ever did before and that turning spammers in hasn't decreased the number of spams I receive every day.
Now that I realize that my ip address doesn't make any difference I am wondering why change it to a static ip address at all.
I have a lot to think about and really, thanks to everybody who has tried to explain all this to me. I'm not a stupid person but understanding this sort of thing is sort of like looking at a map and having a feel for directions and that is a talent I am unfortunately without.
--
jbooksNOSPAM@bellsouth.netremove the "nospam" from the email to email me.mhttp://www.johnsonsusedbooks.com | |
bathswifeOriginal Member
join:2000-09-06
Birmingham, AL | reply to graysonf
said by graysonf:(snip) I don't see how it's possible you had an IP address that belongs to a bellsouth.net mail server. I don't either after reading all the information you guys have posted. The only thing I can think is that I must have had a dyslexic moment when looking at my ip last night. Thanks again for being so patient.
I'm still not totally convinced that powering off my router and getting a new ip address doesn't help take care of the problem of bounced emails but I'm not completely married to that idea and realize it could be coincidence.
--
jbooksNOSPAM@bellsouth.netremove the "nospam" from the email to email me.mhttp://www.johnsonsusedbooks.com | |
NormanSPremium,MVM
join:2001-02-14
San Jose, CA
kudos:4 Reviews:
·SONIC.NET
·Pacific Bell - SBC
| reply to bathswife
said by bathswife:Yes, it was a bad analogy and really all I was pointing out is that I get more spam now than I ever did before and that turning spammers in hasn't decreased the number of spams I receive every day. Now that I realize that my ip address doesn't make any difference I am wondering why change it to a static ip address at all. I have a lot to think about and really, thanks to everybody who has tried to explain all this to me. I'm not a stupid person but understanding this sort of thing is sort of like looking at a map and having a feel for directions and that is a talent I am unfortunately without. Spam reaching your Inbox is a measure of the degree of filtering your email provider is using. Unfortunately, an ISP with the customer base of Bellsouth can't afford to be as aggressive at blocking as much smaller ISP. Corporate email services can also be more aggressive. I use a DNSBL which targets Brazil, China, and Korea, but my ISP, SBC, couldn't afford to use that DNSBL because they have a larger customer base of people with relations in Brazil, China, or Korea.
I decided to buy a domain, and run my own MTA when I realized that SBC did not explicitly prohibit that for DSL lines, and that I could employ more aggressive blocking techniques than SBC was able to use. Unfortunately, without a static IP address and a ptr record reflecting my MX configuration, there are recipient domains, such as those run by AOL (@aol.com, @aim.com, @compuserve.com, @netscape.net, and some others), which refuse to accept connections from SMTP relay clients hosted on dynamic IP addresses. So I use one of the SBC SMTP servers as a "smarthost", an SMTP relay for my domain. This leaves me at the mercy of the same kind of problem you are having; and AOL, in particular, has been known to block the SBC relay clients from time to time.
A static IP address has its uses. If I could justify the price, I'd pay for a static IP package from SBC, or DSL Extreme. I could get either to set up a ptr record reflecting my domain name, and then run a proper SMTP end-to-end relay client. Then I wold not have to worry about AOL, and others, doing to the SBC SMTP relay clients the same as you are seeing with the Bellsouth SMTP relay clients. However, with the exception of running some kind of server, there is no real advantage to a static IP address.
Map reading I am good at. Schematics reading is something else, entirely. I could look at a schematic of a circuit all day, and have a hard time picturing how the circuit in the schematic would translate into readings on a DVM display, or 'scope CRT. For somebody who just wants to use the Internet, knowing the details of how the Internet works is kind of like trying to learn how the internal combustion engine works when all you need is to drive the car from home to work, and back.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum | |
NormanSPremium,MVM
join:2001-02-14
San Jose, CA
kudos:4 Reviews:
·SONIC.NET
·Pacific Bell - SBC
| reply to Gizguy
said by Gizguy:Again as I posted earlier, when I send an POP email to this one recipient from the same PC, with same DSL IP address, but I send it using a non-BellSouth email ID through Google's GMAIL smtp server (outgoing port of 465) the message is not rejected. Similarly if I send the mail using the smtp server of the web hosting company I use (not using port 25) it gets through fine. So it appears to be a problem within the BellSouth Email system - which many on this forum have reported as being very weak. It even failed when I sent the message using BellSouth's Webmail. Technically, you don't send POP email. POP, or "Post Office Protocol" describes the method of accessing email from a mailbox. But you send email either through a client which uses the "Simple Mail Transfer Protocol" (SMTP), or a web form. Either way, once the email submission is complete, the process is SMTP all the way to the Mail Delivery Agent (MDA), which is the SMTP server which puts the email into the mailbox. After that, you access your email either by using a POP3 client to download the message, or using an IMAP client, or web browser, to access the message store on-line.
When you use a web form for email submission, there is an interaction between the HTTP client, which submits your email, and an SMTP submission server, which accepts the message for transfer. After that, your email may take the same path to the edge of the ISP network. So it is likely that Bellsouth email is handled by the same output servers, whether the submission was handled by an SMTP client, such as MS Outlook Express, or a web browser, such as MS Internet Explorer.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum | |
|
