IP Hornbill blacklisted

[m.vandun]

Hi,

We received a comment from a customer that they do not receive any emails anymore. Apearantly the IP for live.hornbill.com has been blacklisted. Can you please request UCE Protect to delist the blacklist or use a different IP. IP that has been blacklisted is: 87.117.243.10

Kind Regards,

Mark

[Keith Stevenson]

@m.vandun

Thanks for the post. 

So firstly we are not sending\doing anything dodgy and only this one list that seems to have issues. If you look at https://mxtoolbox.com/SuperTool.aspx?action=blacklist%3a87.117.243.10&run=toolpage you will see that all other lists have no issues (most of which are far better known than the UCE Protect.).   All our monitoring and checks show no untoward activity and all traffic is as expected.  There have been no configuration changes on the system relating to outbound mail from live.hornbill.com in past 4 months. 

Secondly, nothing I can find about this site is good news,

If it was a legitimate issues we would need to fix whatever was the problem and then contact the spam list to request removal. This is normally easy, clear and the spam list maintainer themselves helpful.

In this one it seems they just want you to pay as they say "we will remove it in 7 days or you can pay for experdidate removal. "

They also give no clear reason as to why the IP was blocked or a contact to discuss why it was blocked. They suggest from the listing that the IP sent email to a spam trap.

This could be true (as a shared IP for all outbound Email) any 1 customer may have inadvertently sent email to a given address. Sadly without knowing what address (these arent listed or provided) we have no idea if this is the case. (This would also be the case for any multi tenant system or hosted service). The List has even listed entire AWS IP ranges.

Given the size and customer base of UCEPROTECT we would recommend that any customer effected by this switch to SMTP SMART host of their own rather than the Hornbill provided list.

In summary

· The criteria for customer IP’s being placed on UCEPROTECT block lists are not publicly available and appear to be overly aggressive in nature (entire IP ranges can be blocked based on a single ‘suspicious’ IP).

· UCEPROTECT refuses to interact with vendors to help assist in understanding the criteria behind the blocking whereas other more reputable blocklists will engage with customers so that customers can proactively correct behaviour.

· Unlike other reputable blocklists UCEPROTECT also charges a fee for delisting . Paying the fee will not prevent UCEPROTECT from again blocking the same IP in 1 day, 1 week etc. leading to further blocklisting and payment requests in the future.

At the same time, we are advising our customers and their email recipients to avoid using UCEPROTECT’s blocklisk or if not possible configure Hornbill to use their own SMART host rather than the live.hornbill.com provided SMART HOST

The other part (which the site says is a warning ant not cause) is Forward-DNS does NOT match Reverse-DNS.
This is known as Forward-Confirmed reverse DNS (FCrDNS). This basically means that the hostname's A record must match the reverse DNS (PTR) record for the IP. This was a historic attempt to ensure that the Sender owned the domain and the DNS record. In reality it never really worked once cloud services or multi tenant systems became a reality with multiple SMTP serves serving many customers and having resilience and was dropped by all but 2 lists years ago. 

Therefore as with above, At the same time, we are advising our customers and their email recipients to avoid using any blocklisk that implmennts FCrDNS or if not possible configure Hornbill to use their own SMART host rather than the live.hornbill.com provided SMART HOST

We hope this clarifies your query. 

Kind Regards

Keith Stevenson
 

 

[m.vandun]

Hi @Keith Stevenson,

Thanks for your extensive reply. I kind of understand what you are saying but some of it is mumbo jumbo to me, I'm not an SMTP expert

What is SMTP SMART host? Who needs to adjust this? Our customer, us? In case of us, do we need to change this in Hornbill or our Exchange?

Regards,

[Victor]

16 minutes ago, m.vandun said:

What is SMTP SMART host?

A smart host or smarthost is an email server via which third parties can send emails and have them forwarded on to the email recipients' email servers.

https://en.wikipedia.org/wiki/Smart_host

17 minutes ago, m.vandun said:

Who needs to adjust this? Our customer, us? In case of us, do we need to change this in Hornbill or our Exchange?

Yes, the Hornbill system admin on customer side needs to set up a different outbound server in Hornbill admin.

https://wiki.hornbill.com/index.php/Outbound_Mail_Routing