I know this is going to sound worse than the spirit in which I offer it but... Step one might be to adjust the attitude from "Deal with these people" to something along the lines of "how might we best resolve the issue". No matter who you deal with, you will get much further with a good humble attitude rather than blame. It is my experience that if they list more than a very specific range of IP addresses on your network, you have a real problem. If you have a spammer at the top and bottom of a CIDR block then they may list the range, but I have had them lost two small ranges in the same /24 before... so I know they have very good specificity. I am sorry I can not offer you any specific steps or contact information to help you expedite the resolution, but I hope you will find some value in this advice. Perhaps, if your network is small and you control all your mail servers and you really are clean, you can configure thrm to relay through a smart host or SendGrid or etc. Good luck,Mike Sent from my Verizon Wireless 4G LTE smartphone -------- Original message -------- From: Bryan Tong <contact@nullivex.com> Date: 07/28/2015 8:06 PM (GMT-07:00) To: nanog@nanog.org Subject: Working with Spamhaus Hello All, SpamHaus has done us the favor of blacklisting all of our prefixes due to the issues with handful of IPs from customers we have removed from our network. They are now being unresponsive on helping us get these listings removed and we have a lot of legitimate customers who are no longer able to send email. If anyone has any advice on how to deal with these people. Please let me know here or off list. Thanks!
Well, I wouldnt have such a disheartened attitude if they would have been specific or given time to comply. I find listing an entire /17 without cause or a report to back it up an unjust action. I have contacted them through multiple mediums and have found no response. So if someone has had better luck I want to know if I am doing something wrong. I have also been absolutely pleasant with them. My frustration grows as I am ignored. Every network deals with bad apples I dont understand why our good standing customers must also suffer these consequences. Thanks On Tue, Jul 28, 2015 at 9:33 PM, Michael J McCafferty < mike@m5computersecurity.com> wrote:
I know this is going to sound worse than the spirit in which I offer it but... Step one might be to adjust the attitude from "Deal with these people" to something along the lines of "how might we best resolve the issue".
No matter who you deal with, you will get much further with a good humble attitude rather than blame.
It is my experience that if they list more than a very specific range of IP addresses on your network, you have a real problem. If you have a spammer at the top and bottom of a CIDR block then they may list the range, but I have had them lost two small ranges in the same /24 before... so I know they have very good specificity.
I am sorry I can not offer you any specific steps or contact information to help you expedite the resolution, but I hope you will find some value in this advice.
Perhaps, if your network is small and you control all your mail servers and you really are clean, you can configure thrm to relay through a smart host or SendGrid or etc.
Good luck, Mike
Sent from my Verizon Wireless 4G LTE smartphone
-------- Original message -------- From: Bryan Tong <contact@nullivex.com> Date: 07/28/2015 8:06 PM (GMT-07:00) To: nanog@nanog.org Subject: Working with Spamhaus
Hello All,
SpamHaus has done us the favor of blacklisting all of our prefixes due to the issues with handful of IPs from customers we have removed from our network.
They are now being unresponsive on helping us get these listings removed and we have a lot of legitimate customers who are no longer able to send email.
If anyone has any advice on how to deal with these people. Please let me know here or off list.
Thanks!
-- eSited LLC (701) 390-9638
On Tue, Jul 28, 2015 at 11:39 PM, Bryan Tong <contact@nullivex.com> wrote:
I wouldnt have such a disheartened attitude if they would have been specific or given time to comply.
eSited LLC (701) 390-9638
Hi Brian, eSited has 37 unresolved spam listings with Spamhaus, all documented and some going as far back as 2013. You got a problem boss. In your position, I would start with "This list of customers has been terminated for spamming. The hacks on these customers' servers have been resolved. The following blocks are each used by multiple customers. Can you help me get a better idea which one is spamming so I can end it?" Next, consider blocking outbound tcp port 25 by default and adding exceptions upon customer request. Like a swimming pool, SMTP is an attractive nuisance. You really have to take active steps to avoid trouble. If you have the tools, consider also capturing a day's email outbound from your network and examine one random message for each origin. Regards, Bill Herrin -- William Herrin ................ herrin@dirtside.com bill@herrin.us Owner, Dirtside Systems ......... Web: <http://www.dirtside.com/>
participants (3)
-
Bryan Tong -
Michael J McCafferty -
William Herrin