That would be the one. They have a /18 that contains that /24 that I mentioned. Bellsouth.net has finally issued for me NOC TICKET 577106. They had no previous ticket on this trouble for Pair.net. I hope pair.net was glad to find me through Steve Schustack of fort-lauderdale-marine-directory.com. Probably not and I'm doing this consultation for free ;-) I think I just might be the only one that got results. Maybe I can get a supporting engineer position at Pair.com. Or maybe a support contract. pair Networks (PAIR) pair Networks (AS7859) PAIR-NETWORKS 7859 pair Networks PAIRNET-BLK-2 (NET-209-197-64-0-1) 209.197.64.0 - 209.197.127.255 pair Networks PAIRNET-BLK-3 (NET-216-92-0-0-1) 216.92.0.0 - 216.92.255.255 pair Networks PAIRNET (NET-209-68-0-0-1) 209.68.0.0 - 209.68.63.255 pair Networks PAIRNET-BLK-4 (NET-66-39-0-0-1) 66.39.0.0 - 66.39.159.255 pair Networks PAIRNET-BLK-5 (NET-216-146-192-0-1) 216.146.192.0 - 216.146.223.255 pair Networks PAIRNET-BLK-6 (NET-65-181-128-0-1) 65.181.128.0 - 65.181.191.255 # ARIN WHOIS database, last updated 2005-09-19 19:10 # Enter ? for additional hints on searching ARIN's WHOIS database. * In addition, Pair networks says the following:In our experiences, most blocks occur from users forwarding their domain email to an outside address such as Bellsouth. Since a customer forwards all mail, legitimate and spam, the ISP will see the spam deliveries and block the offending IP, our server. In most cases, the ISP is willing to work with us and the customers to limit the amount of mail being forwarded. In this case, Bellsouth refuses to correspond with us. Should you have any additional questions please let us know. Thank you,Jaime P.pair Networks* I had not heard that kind of indication before. I hope if someone isforwarding domain email to bellsouth.net that they will stop...--- Alan Spicer (a_spicer@bellsouth.net) http://telecom.dyndns.biz/ ----- Original Message ----- From: "Suresh Ramasubramanian" <ops.lists@gmail.com> To: "Alan Spicer" <a_spicer@bellsouth.net> Cc: <nanog@nanog.org> Sent: Monday, September 19, 2005 11:31 PM Subject: Re: 209.68.1.140 (209.68.1.0 /24) blocked by bellsouth.net for SMTP On 20/09/05, Alan Spicer <a_spicer@bellsouth.net> wrote:

I wonder if anyone with Bellsouth.net can tell me why this ip or /24

209.68.1.140 (209.68.1.0 /24)

would be blocked from sending SMTP to bellsouth.net customers.

That's a large (and quite good) webhost called pair.com, which also hosts the Pittsburgh IX (pitx.net) http://www.pair.com/support/notices/blocked-email.html Blocking is fine - happens. Postmaster and other role accounts not replying at all to email that they're sent is just not a good thing to do. --srs -- Suresh Ramasubramanian (ops.lists@gmail.com) -- No virus found in this incoming message. Checked by AVG Anti-Virus. Version: 7.0.344 / Virus Database: 267.11.1/104 - Release Date: 9/16/2005

On Tue, 20 Sep 2005, Suresh Ramasubramanian wrote:

Blocking is fine - happens. Postmaster and other role accounts not replying at all to email that they're sent is just not a good thing to do.

speaking of which: ----- The following addresses had permanent fatal errors ----- abuse@css.one.microsoft.com (reason: 550 5.7.1 <Your e-mail was rejected by an anti-spam content filter on gateway (131.107.3.123).Reason...uage, graphics, or spam-like characteristics. Removing these may let the e-mail through the filter.>) ----- Transcript of session follows ----- ... while talking to mailb.microsoft.com.:

...

...

DATA <<< 550 5.7.1 <Your e-mail was rejected by an anti-spam content filter on gateway (131.107.3.123).Reasons for rejection may be: obscene language, graphics, or spam-like characteristics. Removing these may let the e-mail through the filter.> 554 5.0.0 Service unavailable

running a spam filter on abuse@hotmail.com does not seem terribly wise... -Dan

----- Original Message ----- From: "Omar Thameen" <omar@westside.urbanblight.com> To: <nanog@nanog.org> Cc: "Suresh Ramasubramanian" <ops.lists@gmail.com>; "Alan Spicer" <a_spicer@bellsouth.net> Sent: Saturday, September 24, 2005 6:25 AM Subject: Re: 209.68.1.140 (209.68.1.0 /24) blocked by bellsouth.net for SMTP

On Tue, Sep 20, 2005 at 09:01:40AM +0530, Suresh Ramasubramanian wrote:

...

On 20/09/05, Alan Spicer <a_spicer@bellsouth.net> wrote:

...

I wonder if anyone with Bellsouth.net can tell me why this ip or /24

209.68.1.140 (209.68.1.0 /24)

would be blocked from sending SMTP to bellsouth.net customers.

That's a large (and quite good) webhost called pair.com, which also hosts the Pittsburgh IX (pitx.net)

http://www.pair.com/support/notices/blocked-email.html

Blocking is fine - happens. Postmaster and other role accounts not replying at all to email that they're sent is just not a good thing to do.

This may give you an idea of what issue may be and the response you're likely to encounter.

Back in June, we contacted Bellsouth postmaster regarding their filtering of SMTP connections (i.e., so that connection attempts hang until the timeout is reached), and received this reply from postmaster@bellsouth.net:

We will configure our settings for your company on our Filtering mechanism to 50 messages within a 5 minute window. We ask that you conform to this industry standards regarding submission of email to our mail server.

As you all know, 50 messages/5 minutes is abysmally low, particularly for a mailing list hosting provider. Our requests for higher threshold and a pointer to the "industry standards" were summarily dismissed.

If there's a Bellsouth contact with more of a clue on this list, we'd be happy to meet any reasonable requirements you have for email delivery.

Omar Thameen omar@BIGLIST.com

Bellsouth basically told me they were blocking Pair Networks because the percentage of spam vs non-spam is around 75 - 80%. They say they are communicating with them on this. Supposedly there was a conference telephone call this past Thursday 09-22-2005. BS says they must reduce this spam amount for the block to be removed. Pair seems to think it is mostly domain customers forwarding their mailboxes to their BS dot Net email accounts. This the first I've heard of BS having a 50/5 threshold limit. --- Alan Spicer (a_spicer@bellsouth.net)

--On September 24, 2005 10:20:24 PM -0400 sigma@smx.pair.com wrote:

Yes, this is quite clearly the case; there are dozens of mutual customers who have forwarding rules setup. We are not generating Spam to send to Bellsouth; it's coming from somewhere else and then being forwarded.

At my $employer I have similar problems with AOL. We occasionally get blocked because of bone-headed AOL users thinking that report spam is the same as delete, or thinking that report spam on forwarded mail is helpful, when it's not. It happens atleast once a month that one or more, or all of our outbound MXers get blocked over at AOL with 4xx or 5xx errors that result in me having to call postmaster to get them to remove it. Also just one hacked webform usually results in the same problem (we have thousands of web hosting customers). It's in our projects list to find 'some way' to rate limit individual senders but it's not a high priority right now.

I imagine that at some time in the future, forwarding e-mail might become impractical, if receiving systems insist on parsing it as originated or relayed Spam.

I've certainly brought up the idea of not allowing offsite forwarding to AOL. We already implemented no offsite catch-alls and I'd like to have removed any possibility of doing catch-alls but management veto-ed me on that one because of the high amount of customer complaints we'd get. Sometimes, the 'cure' is definitely worse than the 'disease.'

--On September 26, 2005 8:59:31 AM +0530 Suresh Ramasubramanian <ops.lists@gmail.com> wrote:

On 25/09/05, Michael Loftis <mloftis@wgops.com> wrote:

...

result in me having to call postmaster to get them to remove it. Also just one hacked webform usually results in the same problem (we have thousands of web hosting customers). It's in our projects list to find 'some way' to rate limit individual senders but it's not a high priority right now.

One hacked webform can pump out as much spam in a few hours as the rest of your users would send email to AOL in a week.

I realise this, but that's usually not the case. Almost without fail we notice and shut it down long before aol starts blocking, and clear out the queues of anything pending from the spammer. then hours or a day later AOL blocks us for something that's been dealt with. :/

On Sat, 24 Sep 2005, Michael Loftis wrote:

Also just one hacked webform usually results in the same problem (we have thousands of web hosting customers). It's in our projects list to find 'some way' to rate limit individual senders but it's not a high priority right now.

I implemented rate limiting for Exim to address this problem. The feature is available in version 4.52 and later. ftp://ftp.csx.cam.ac.uk/pub/software/email/exim/ChangeLogs/NewStuff-4.52 We have a few thousand users who forward email off-site, and it gets the same anti-spam filtering as locally-delivered email. This seems to be sufficient to avoid trouble with AOL etc. Tony. -- f.a.n.finch <dot@dotat.at> http://dotat.at/ BISCAY: WEST 5 OR 6 BECOMING VARIABLE 3 OR 4. SHOWERS AT FIRST. MODERATE OR GOOD.

sigma@smx.pair.com wrote:

Yes, this is quite clearly the case; there are dozens of mutual customers who have forwarding rules setup. We are not generating Spam to send to Bellsouth; it's coming from somewhere else and then being forwarded.

I imagine that at some time in the future, forwarding e-mail might become impractical, if receiving systems insist on parsing it as originated or relayed Spam.

No, what will happen more and more is that parties who forward email will have to make a "best effort" to ensure that it is not spam. Meaning a policy "unfiltered email does not get fowarded to external parties" Its pretty simple. Its garbage and its coming from you. Block. Happens to be it is not trivial (currently probably rarely possible) to guarantee that email is forwarded, rather than simply originated with forged headers. Hopefully this will generate/increase a positive network effect for aggressive spam filtering, from blocklists, graylists, content filtering and so on. Unfortunately the network effect is likely not to be a pleasant experience for many providers, as you have recently found out. Customers may be entitled to request complete unfiltered access of their email account to the world, but they are not entitled in this day and age to expect that to carry over into a privelege for provider A to dump crap into provider B without a prior arrangement/understanding between provider A and B.

...

This the first I've heard of BS having a 50/5 threshold limit.

Bellsouth has given us no statistics, no logs, no headers, not even a timeframe for their vague claims. We can clearly see from our side that we are not generating nor relaying Spam. But our customers can no longer choose to forward their e-mail to Bellsouth. It seems that Bellsouth is restricting its customers.

Kevin

This is a problem. Headers would go a long way to disabling the forwarding instances and/or mandating strict filtering for those customers. That being said, assuming you have told bellsouth you were working on eliminating raw forwarding they should have worked immediately to lift the block and give you the benefit of the doubt. In the absence of retained technical evidence, a "easy out" blocklist and an "easy in" whitelist should be the norm. Joe

On 25/09/05, sigma@smx.pair.com <sigma@smx.pair.com> wrote:

This was my point. Have we already come to the day where regular e-mail forwarding is no longer workable? If so, we'll adapt, naturally, but I

regular email forwarding IF you filter first i'm not advocating spf, mind .. though that WAS started to address forwarded spam, initially, before it changed specs, utilities and various other things --srs -- Suresh Ramasubramanian (ops.lists@gmail.com)

Sean Figgins wrote:

On Mon, 26 Sep 2005, Suresh Ramasubramanian wrote:

...

regular email forwarding IF you filter first

And if the customer specifically requests that YOU do not filter his email, or set up a system that allows him to see ALL email, even if ti is tagged as spam?

Then you simply tell the customer to collect (via pop, imap, etc.) the email directly from your mail servers. Your position is that you are unable to provide the service of an unfiltered forwarded address due to the problems this causes all the *other* customers on your network when the recipient clicks "this is spam" in the final mailbox on email that was forwarded thru your network, labeling your network as a "source" of the forwarded spam. It is impossible to give every customer *everything* they ask for. You should give them as much as you *reasonably* can, but unreasonable request must be met with "no" or else you will end up catering to a bunch of side cases and ignoring your core business, ultimately to the detriment of the majority of your customers. jc p.s. Speaking of "unreasonable requests" - I feel it is unreasonable for a member of the moderating committee to whine that he can't filter out "undesired" posts due to using a lame email client, and to then coerce a poster into "tagging" these posts. I laud the poster for being willing to tag anyway, but think it's a very bad precedent that "tag because I'm using a lame email client and I'm on the moderating committee so you need to cater to my whims" is allowed to prevail. I thought this was supposed to be a group of highly technical people who are expected to do whatever filtering is necessary on their own end...

Richard A Steenbergen wrote:

I'm aware of quite a few people who have encouraged said poster to tag his off-topic posts for easy filtering, myself included.

A brief cite and quote from a news article discussing the status of major networks (BellSouth Corp., SBC Communications, Cingular Wireless) in North America following a huge storm that affected several states is clearly on-topic for the North American Network Operators Group discussion list.

Ideally this material belongs in a blog with a comments section,

He has a blog. He posts *many* more links to his blog each day than he posts to nanog. Since creating his blog, the links he posts to nanog are, for the most part, on-topic for nanog. Certainly the post that triggered this discussion was on-topic for nanog.

or in a seperate mailing list. Failing that, it needs to be tagged for easy filtering by those who aren't interested.

I'm confused. Can you explain why the ON-TOPIC links he posts somehow "need to be tagged"?

Adding a subject tag also allows readers to match on the off-topic chatter spawned by these posts, not just the original post.

Why is this any different from the off-topic chatter spawned from other posts? jc

On 26/09/2005, at 9:50 AM, Richard A Steenbergen wrote:

we just don't want this operational and technical mailing list for network operations being taken over by news and general technology chatter.

of please, there are far worse things this list is in danger of being taken over by. -- James