We weren't listed in the PSBL. First thing I did was a few multi-DNSBL lookups and only found a couple of obscure (to me) ones, which I immediately filled out for delisting. Interestingly, comcast.net was BLing us, complete with URL to do apply for delisting. I did, and got a response that we weren't listed. I don't date take down re-routing just yet.... :-/

Just went through this the other day. In our case once we removed the IP from the PSBL, our senderbase reputation went back to neutral within about an hour or two. Seemed to be pretty directly related. I suspect senderbase checks a handful of "reliable" BL's and your IP reputation is greatly affected by listings in them. As far as I can tell there is no way to contact them to expedite things. Worse is this one:

http://www.commtouch.com/Site/Resources/Check_IP_Reputation.asp

Unless it's just me, that page is broken and it's the only way to check listings or request removals.

Andrew

-----Original Message----- From: up@3.am [mailto:up@3.am] Sent: Wednesday, August 17, 2011 1:58 PM To: nanog@nanog.org Subject: Cisco Ironport and Senderbase...how to get delisted?

We had two users fall for a phishing email recently, and of course the result was that he gave his user/pass to a spammer. We caught one of them in time, but the other got out many thousands of spam the other night before being discovered.

I am in the process of cleaning this up. Spamcop and others were good about delisting us promptly. Others will within the next day.

However, "Senderbase", apparently used in Cisco's Ironport, will let you look up your IP and tell you that your reputation is "poor", but offers no way to get delisted. It refers you to Spamcop, which I imagine they rely on for listings, but not delistings.

For now, I'm re--routing per domain to a second server, but I'd appreciate any tips if there are any. Seems a lot of .edu's use senderbase.

----- No virus found in this message. Checked by AVG - www.avg.com Version: 10.0.1392 / Virus Database: 1520/3840 - Release Date: 08/17/11