
IP relisted despite no more mail being sent
On June 6, 2009, a client sent a mailing. After it was sent, their (static, only-used-by-them) IP was listed by a particular list that is generated by the creator of a large, well-known anti-spam appliance and seems to be used by default in that appliance.
I didn’t notice the issue until I started checking all of our IP space against this list some time around the 17th of this month. A delisting request was duly entered with the maintainer. It was processed the same day and I got a reply:
Thank you for contacting Barracuda Networks regarding the block of IP address: [redacted]
The Barracuda Spam Firewall has rules that apply to email sent from an IP address known to Barracuda Central with a “poor” rating. The Barracuda Spam Firewall has an option to decline email from these IPs. This is an option that the Administrator of the Barracuda Spam Firewall may enable. If the Administrator chooses to enable this option it may block email from your IP address.
This IP has been seen by Barracuda Central to transmit spam email in the past 30 days.
We have removed your “poor” rating The IP will be automatically rechecked several times each day and may be adjusted again if issues are observed.
Please allow between 12 and 24 hours for changes to propagate around the world to all Barracuda Spam Firewalls — at which time you will be able to send email from the IP address. This is the last email you should receive about this issue.
Thank you for your time and understanding.
Good enough. Within 24 hours, I wasn’t seeing the IP listed anymore.
That is, until today. Now the client is listed again, so a new request goes in. And a new response comes back:
Thank you for contacting Barracuda Networks regarding IP address: [redacted]
The Barracuda Spam Firewall has rules that apply to email sent from an IP address known to Barracuda Central with a “poor” rating. The Barracuda Spam Firewall has an option to decline email from these IPs. This is an option that the Administrator of the Barracuda Spam Firewall may enable. If the Administrator chooses to enable this option it may block email from your IP address.
This IP has been seen by Barracuda Central to transmit spam email in the past 30 days.
We have removed your “poor” rating The IP will be automatically rechecked several times each day and may be adjusted again if issues are observed.
Please allow between 12 and 24 hours for changes to propagate around the world to all Barracuda Spam Firewalls — at which time you will be able to send email from the IP address. This is the last email you should receive about this issue.
Thank you for your time and understanding.
Now, ordinarily you look at this and you say “well, they didn’t like your mail stream and so you got relisted.” And, ordinarily you might be right.
However, this client is the only one using this IP, and they haven’t sent any more mail since 6/5. That means that the IP was listed, seemingly, on the strength of no evidence.
A couple of possibilities have been suggested as to why the IP might have been relisted, but neither really says anything good about Barracuda.
The first is that Barracuda didn’t like the IP’s rDNS entry. But, that would mean that they are out scanning hosts randomly for rDNS. Since no mail has gone out since 6/5, there would have been no reason for Barracuda to check rDNS since the delisting request was granted on 6/17.
The other is that they based the relisting on older evidence. Certainly the “within the last 30 days” bit of their mail comes into play here and there doesn’t appear to be any mail other than the 6/5 mailing that fits the bill. But, even if there were, this would indicate sloppiness on the part of the DNSBL operations staff. They had an opportunity with the 6/17 delisting request to address any concerns about older mailings, but decided not to. Instead, they wait a week and relist it anyway?
Not good.
So, to summarize:
June 5 | Objectionable (and last) Mailing Sent |
June 17 | Delist request |
June 17 | Correspondence Indicating Delisting with continued monitoring |
June 25 | IP Shows Up Again on the BBL |
0 | Number of pieces sent since June 5 |
Archives
- November 2021
- July 2020
- June 2020
- March 2020
- February 2020
- January 2020
- November 2018
- February 2018
- January 2018
- December 2017
- January 2017
- August 2016
- June 2016
- April 2016
- March 2016
- February 2016
- July 2015
- June 2015
- March 2015
- February 2015
- November 2014
- June 2014
- April 2014
- February 2014
- December 2013
- November 2013
- September 2013
- May 2013
- June 2012
- April 2012
- September 2011
- August 2011
- March 2011
- January 2011
- November 2010
- July 2010
- May 2010
- April 2010
- March 2010
- February 2010
- December 2009
- November 2009
- October 2009
- July 2009
- June 2009
- May 2009
- March 2009
- January 2009
- October 2008
- September 2008
- April 2008