Cisco Ironport and Senderbase...how to get delisted?
We had two users fall for a phishing email recently, and of course the result was that he gave his user/pass to a spammer. We caught one of them in time, but the other got out many thousands of spam the other night before being discovered. I am in the process of cleaning this up. Spamcop and others were good about delisting us promptly. Others will within the next day. However, "Senderbase", apparently used in Cisco's Ironport, will let you look up your IP and tell you that your reputation is "poor", but offers no way to get delisted. It refers you to Spamcop, which I imagine they rely on for listings, but not delistings. For now, I'm re--routing per domain to a second server, but I'd appreciate any tips if there are any. Seems a lot of .edu's use senderbase.
On 8/17/2011 10:57 AM, up@3.am wrote:
However, "Senderbase", apparently used in Cisco's Ironport, will let you look up your IP and tell you that your reputation is "poor", but offers no way to get delisted. It refers you to Spamcop, which I imagine they rely on for listings, but not delistings.
I mean this in the kindest way, and hope I am not suggesting something you've already tried, but I sent email with an explanation to support@senderbase.org and had success in removing an IP address for a mailing list that I manage. It got listed when we switched servers, because it went from zero emails to 800-900... It took about 24 hours to get it straightened out. Hope that helps. -- The Consultant's Curse: When the customer has beaten up on you long enough, give him what he asks for, instead of what he needs. This is very strong medicine, and is normally only required once.
In sort, wait... Once you're de-listed from SpamCop (which is owned by IronPort and plays a non-trivial part in their SenderBase scoring) you should find that your reputation increases fairly quickly - normally within 24 hours presuming that the spam has actually stopped. Scott. On Wed, Aug 17, 2011 at 1:57 PM, <up@3.am> wrote:
We had two users fall for a phishing email recently, and of course the result was that he gave his user/pass to a spammer. We caught one of them in time, but the other got out many thousands of spam the other night before being discovered.
I am in the process of cleaning this up. Spamcop and others were good about delisting us promptly. Others will within the next day.
However, "Senderbase", apparently used in Cisco's Ironport, will let you look up your IP and tell you that your reputation is "poor", but offers no way to get delisted. It refers you to Spamcop, which I imagine they rely on for listings, but not delistings.
For now, I'm re--routing per domain to a second server, but I'd appreciate any tips if there are any. Seems a lot of .edu's use senderbase.
Thanks for the tip (BTW, top-post haters, I didn't start it!). I was quickly delisted by SpamCop, but here is their response: ------ Once all spam issues have been addressed, **reputation recovery can take anywhere from a few hours to __just over one week__ to improve**, depending on the specifics of the situation, and how much email volume the IP sends. Complaint ratios determine the amount of risk for receiving mail from an IP, so logically, reputation improves as the ratio of legitimate mails increases with respect to the number of complaints. Speeding up the process is not really possible. SenderBase Reputation is an automated system over which we have very little manual influence. Mailflow policy is the sole domain and responsibility of the recipient;SenderBase has no control over how passive or aggressive Cisco-IronPort customers choose to be when implementing SenderBase reputation information. While the reputation is improving, we suggest contacting domains which are rejecting or throttling mail from the IP, and request they whitelist the IP temporarily. Regards, -SenderBase Support -----
In sort, wait... Once you're de-listed from SpamCop (which is owned by IronPort and plays a non-trivial part in their SenderBase scoring) you should find that your reputation increases fairly quickly - normally within 24 hours presuming that the spam has actually stopped.
Scott.
On Wed, Aug 17, 2011 at 1:57 PM, <up@3.am> wrote:
We had two users fall for a phishing email recently, and of course the result was that he gave his user/pass to a spammer. We caught one of them in time, but the other got out many thousands of spam the other night before being discovered.
I am in the process of cleaning this up. Spamcop and others were good about delisting us promptly. Others will within the next day.
However, "Senderbase", apparently used in Cisco's Ironport, will let you look up your IP and tell you that your reputation is "poor", but offers no way to get delisted. It refers you to Spamcop, which I imagine they rely on for listings, but not delistings.
For now, I'm re--routing per domain to a second server, but I'd appreciate any tips if there are any. Seems a lot of .edu's use senderbase.
participants (3)
-
Lynda -
Scott Howard -
up＠3.am