IP relisted despite no more mail being sent

On June 6, 2009, a client sent a mailing. After it was sent, their (static, only-used-by-them) IP was listed by a particular list that is generated by the creator of a large, well-known anti-spam appliance and seems to be used by default in that appliance.

I didn’t notice the issue until I started checking all of our IP space against this list some time around the 17th of this month. A delisting request was duly entered with the maintainer. It was processed the same day and I got a reply:

Thank you for contacting Barracuda Networks regarding the block of IP address: [redacted]

The Barracuda Spam Firewall has rules that apply to email sent from an IP address known to Barracuda Central with a “poor” rating. The Barracuda Spam Firewall has an option to decline email from these IPs. This is an option that the Administrator of the Barracuda Spam Firewall may enable. If the Administrator chooses to enable this option it may block email from your IP address.

This IP has been seen by Barracuda Central to transmit spam email in the past 30 days.

We have removed your “poor” rating The IP will be automatically rechecked several times each day and may be adjusted again if issues are observed.

Please allow between 12 and 24 hours for changes to propagate around the world to all Barracuda Spam Firewalls — at which time you will be able to send email from the IP address. This is the last email you should receive about this issue.

Thank you for your time and understanding.

Good enough. Within 24 hours, I wasn’t seeing the IP listed anymore.

That is, until today. Now the client is listed again, so a new request goes in. And a new response comes back:

Thank you for contacting Barracuda Networks regarding IP address: [redacted]

The Barracuda Spam Firewall has rules that apply to email sent from an IP address known to Barracuda Central with a “poor” rating. The Barracuda Spam Firewall has an option to decline email from these IPs. This is an option that the Administrator of the Barracuda Spam Firewall may enable. If the Administrator chooses to enable this option it may block email from your IP address.

This IP has been seen by Barracuda Central to transmit spam email in the past 30 days.

We have removed your “poor” rating The IP will be automatically rechecked several times each day and may be adjusted again if issues are observed.

Please allow between 12 and 24 hours for changes to propagate around the world to all Barracuda Spam Firewalls — at which time you will be able to send email from the IP address. This is the last email you should receive about this issue.

Thank you for your time and understanding.

Now, ordinarily you look at this and you say “well, they didn’t like your mail stream and so you got relisted.” And, ordinarily you might be right.

However, this client is the only one using this IP, and they haven’t sent any more mail since 6/5. That means that the IP was listed, seemingly, on the strength of no evidence.

A couple of possibilities have been suggested as to why the IP might have been relisted, but neither really says anything good about Barracuda.

The first is that Barracuda didn’t like the IP’s rDNS entry. But, that would mean that they are out scanning hosts randomly for rDNS. Since no mail has gone out since 6/5, there would have been no reason for Barracuda to check rDNS since the delisting request was granted on 6/17.

The other is that they based the relisting on older evidence. Certainly the “within the last 30 days” bit of their mail comes into play here and there doesn’t appear to be any mail other than the 6/5 mailing that fits the bill. But, even if there were, this would indicate sloppiness on the part of the DNSBL operations staff. They had an opportunity with the 6/17 delisting request to address any concerns about older mailings, but decided not to. Instead, they wait a week and relist it anyway?

Not good.

So, to summarize: