Thanks for the tip (BTW, top-post haters, I didn't start it!). I was quickly delisted by SpamCop, but here is their response: ------ Once all spam issues have been addressed, **reputation recovery can take anywhere from a few hours to __just over one week__ to improve**, depending on the specifics of the situation, and how much email volume the IP sends. Complaint ratios determine the amount of risk for receiving mail from an IP, so logically, reputation improves as the ratio of legitimate mails increases with respect to the number of complaints. Speeding up the process is not really possible. SenderBase Reputation is an automated system over which we have very little manual influence. Mailflow policy is the sole domain and responsibility of the recipient;SenderBase has no control over how passive or aggressive Cisco-IronPort customers choose to be when implementing SenderBase reputation information. While the reputation is improving, we suggest contacting domains which are rejecting or throttling mail from the IP, and request they whitelist the IP temporarily. Regards, -SenderBase Support -----
In sort, wait... Once you're de-listed from SpamCop (which is owned by IronPort and plays a non-trivial part in their SenderBase scoring) you should find that your reputation increases fairly quickly - normally within 24 hours presuming that the spam has actually stopped.
Scott.
On Wed, Aug 17, 2011 at 1:57 PM, <up@3.am> wrote:
We had two users fall for a phishing email recently, and of course the result was that he gave his user/pass to a spammer. We caught one of them in time, but the other got out many thousands of spam the other night before being discovered.
I am in the process of cleaning this up. Spamcop and others were good about delisting us promptly. Others will within the next day.
However, "Senderbase", apparently used in Cisco's Ironport, will let you look up your IP and tell you that your reputation is "poor", but offers no way to get delisted. It refers you to Spamcop, which I imagine they rely on for listings, but not delistings.
For now, I'm re--routing per domain to a second server, but I'd appreciate any tips if there are any. Seems a lot of .edu's use senderbase.