Eircom mailserver blacklisted

marcphisto

Hi,

just wondering if anyone else has come across this. We use eircom as an isp but we do not use them as an smtp server but when we send mail we intermittantly get the following message.

5.7.1 Service unavailable; Client host [86.40.241.94] blocked using sbl-xbl.spamhaus.org; http://www.spamhaus.org/query/bl?ip=86.40.241.94

Now this ip resolves to a blacklisted Eircom mail server but my confusion is why our mail is getting sent through it at all. Is it the case that since we use eircom as an isp all our outgoing mail will go through this by default on the way to our own smtp server?

My main issue is how to get our mail through and I'm not sure who I should be chasing up on this. I've reported the blacklisting to eircom but I'm not holding my breath on this.

Also, if it is an eircom server surely it would effect all eircom users in the region?

If anyone could shed some light on this or point me in the right direction I'd appreciate it.

Alun

That address resolves to an ordinary Eircom DSL customer, probably someone running their own mail server or compromised by some kind of Trojan being used to relay spam, not an official Eircom mail server.

Name: 86-40-241-94-dynamic.b-ras2.lmk.limerick.eircom.net
Address: 86.40.241.94

That's not your current IP address by any chance is it? Alternatively, it's just unfortunate that you've picked up the IP address of someone who's been blacklisted, if so just reboot the router until you get another address.

marcphisto

Hi Alun,

thanks for the reply.

No it's not our current IP address so this leaves me even more confused as to why we would be getting this message. Is restarting the router the only option?

cheers.

Alun

That's strange then. What is your current IP, and what are you using as your SMTP server as a matter of interest?

bushy...

Looks like Eircoms emails server still works no ?

220 mail19.svc.cra.dublin.eircom.net ESMTP
helo
250 mail19.svc.cra.dublin.eircom.net
mail from:test1001@eircom.net
250 ok
rcpt to :anyone_else@eircom.net
250 ok
data
354 go ahead
test email 1234
.
250 ok 1243257613 qp 45590


its a bit too friendly , i'm not on Eircom

marcphisto

After restarting the router the ip address is 86.40.254.118 and our smtp server is mail.hosting365.ie.

The complete block 86.40.*.* is on the Spamhaus pbl and they say that you simply need to turn on authentication before send to stop this error but that is turned on in all the clients and the error message still comes up.

still

cheers.

Alun

marcphisto wrote: »

The complete block 86.40.*.* is on the Spamhaus pbl ...

Aaah, sorry .. didn't spot that, I was only looking on the CBL list which was only blocking that one IP. Some of these spam blacklist folks can be a bit of a PITA sometimes .. blocking an entire subnet just because of one miscreant with a Trojan. You could try requesting an unblock from them, but my experience is that they don't pay much attention to such requests. You could try getting Hosting365 involved .. that might help.

... and they say that you simply need to turn on authentication before send to stop this error but that is turned on in all the clients and the error message still comes up.

I'm guessing the spam filter must look in the mail headers to check whether you're an authenticated sender or not (there's an extra line added in the first Received from: header line if you're authenticated). Try sending a mail to yourself and looking in the header of the received mail. There should be a line like the following (addresses and IP addresses obfuscated) ...

Received: from [127.0.0.1] (86-42-xxx-yyy-dynamic.b-ras1.bbh.dublin.eircom.net [86.42.xxx.yyy])
(Authenticated sender: xxxxx@yyyyy.com)
by omf06.hostedemail.com (Postfix) with ESMTP
for <yyyyy@zzzzz.com>; Mon, 25 May 2009 14:14:21 +0000 (UTC)

marcphisto

Sigh, it turns out that this error is only appearing for our Entourage users. (This info would have been useful a few hours ago). So it looks like there's a problem with the way it is authenticating.

Cheers for the help.

FusionNet

I had this exact problem with a client who used Eircom mail but BT broadband. This spamhouse error used to come up from time to time.

Resolved it by entering a different SMTP out according to what the ISP recommended. Havent had the problem since..

For example old SMPT out was mail.eircom.net new one was totally different, something like mail.iol.ie. incomming mail details stayed the same..

mikemike

FusionNet you're a f***ing GENIUS ......

I've been trying to sort this b*stard of a problem out for ages , and today for some reason the emails weren't going out AT ALL ...:mad:

I tried your solution , and it works spot on ..

Thanks a lot

runswithascript

Can someone elaborate why an Eircom subnet would be blacklisted and who does the blacklisting and what recipients it will affect?

roryq

If it is on the Spamhaus one it's a load of C**k basically spamhaus will just block domains and request money to be delisted... If you have a static IP or a buisness broadband account would you not be using mail1.eircom.net

Which never turns up on a blacklist as it is the business one..

runswithascript

roryq wrote: »

If you have a static IP or a buisness broadband account would you not be using mail1.eircom.net

Quite.

Someone I know in authority at Eircom.net has told me you can enter your IP at Spamhaus and they will take you off the list, although he did not mention a fee.

roryq

Yeah the first time but they re-list and keep re-listing.. They are a tricky bunch to deal with.

johnmacward

LA3G wrote: »

Can someone elaborate why an Eircom subnet would be blacklisted and who does the blacklisting and what recipients it will affect?

Check out mxtoolbox.com, type in your public IP address or hostname and see what might be blacklisting you.

Something I know from plenty of experience is that Eircom are seen by UCEPROTECT (a blacklist site) as an offender in general, because there are over 4200 spammers on their network which they don't do much about, like block their connections. UCEPROTECT regard this as laziness on the part of Eircom as they give the example of AOL (which has a much larger subnet of addresses) as having no spam on its network. They muct have a zero tolerance policy.

Some domains will use this blacklist as a measure against spam but will only in rare circumstances block an entire ISP subnet from access, they could lose out on an awful lot of genuine mail.

I emailed Eircom once on this (a reccomendation from UCEPROTECT) and we got a canned response like "We are always doing our best to keep spam levels low...blah...blah" but they seem to be pretty lazy in this regard. For example, just like I said, recently over 4200 spammers detected on eircom IP's. A few months ago it was around 2000.

AndrewMc

LA3G wrote: »

Can someone elaborate why an Eircom subnet would be blacklisted and who does the blacklisting and what recipients it will affect?

The PBL listing on Spamhaus is a list of addresses that are not normally expected to send mail directly to the recipient, but instead should be going via their ISP's server. Typically they include ISPs' dynamically allocated ranges, the sort of addresses residential and small business users get when then they connect. They're blocked because these are the same group of people whose machines are most likely to be chock full of viruses etc. and sending out spam.

Trying to de-list your IP address from the PBL is a waste of everybody's time since the next time your router gets an address it could be completely different. Only try to de-list if you've got a static IP address.

The recipient mail server can be configured to use whatever blacklists it likes (or none at all), so the recipients affected could be anybody.

zeris

roryq wrote: »

If it is on the Spamhaus one it's a load of C**k basically spamhaus will just block domains and request money to be delisted...

Spamhaus do not currently block based on a domain name and is all IP based. They do not charge to be de-listed by Spamhaus. You must be confusing it with some other RBL.

runswithascript

Are there not business packages with Eircom.net providing the same bandwidth and capacity for the same price?

If the user is blacklisted because they're on a subnet which is assigned to residential customer perhaps switching to a business package will solve the issue, assuming they are not already on one.

roryq

zeris wrote: »

Spamhaus do not currently block based on a domain name and is all IP based. They do not charge to be de-listed by Spamhaus. You must be confusing it with some other RBL.

You know what I stand corrected I was thinking of Sorbs I was having a brain dead moment.. My mistake..