3 ms·

No. GMail is arbitrarily blocking ip addresses or subnets and there's nothing you can do about it. One year ago I've purchased a VPS with a clean IP address (

No. GMail is arbitrarily blocking ip addresses or subnets and there's nothing you can do about it. One year ago I've purchased a VPS with a clean IP address (checked against all DNSBLs), set up mail server with SMTP and IMAP server, set up SPF, DKIM and DMARC and was able to successfully send emails to Gmail for 3 months. After 3 months GMail stopped accepting mail from my server saying that my ip address was used to send spam. I'm pretty much sure it wasn't me. My VPS OS and mail server are up to date, there was no suspicious activity in the logs, so it's very unlikely that I was hacked. There're only three possible explanations for it: 1. My VPS was hacked indeed 2. Some bad guy from the same IP network sent spam (although GMail error message specifically states that spam was sent by this exact IP address, not an address from the same network). 3. GMail just randomly blocks access to any little guy trying to setup independent mail server just because they can. I'll never know the truth but it was very disappointing experience. Also, lost couple of semi-important emails this way.

oarsinsync 7y ago
> 2. Some bad guy from the same IP network sent spam (although GMail error message specifically states that spam was sent by this exact IP address, not an address from the same network). This is the most likely situation. If a VPS provider is sufficiently cheap, it will attract the wrong people, who will then get the entire VPS provider's IP blocks blacklisted. It's a shame, but it's the reality. There are lots of discussions around this subject on various mailing lists, where people from the likes of Gmail have chimed in stating as much. I would reckon it takes as little as 10% of the addresses in a /24 (so ~25 IPs) to get that entire netblock blacklisted. If you want a higher probability of clean IPs, you need to be using a provider that is sufficiently expensive to not attract spammers. Either that, or you need your own IPs.
- tambre 7y ago
  > Either that, or you need your own IPs. Or just use IPv6, which will probably fix this.
  - scintill76 7y ago
    Why is this considered a useful signal by Gmail? Isn't it cheaper for a spammer to get throwaway IPv6 addresses?
    - inopinatus 7y ago
      Most spammers aren’t competent to provision an IPV6 service correctly, especially one with matched PTR and SPF(TXT) records, and using throwaway v6 addresses makes SPF much harder. It’s also easy to spot, at which point you can tag the sender domain with a bad reputation. It’s no surprise that Gmail et al are more interested in sender domain reputation, and also the graph of related domains, than they were a few years ago.
  - oarsinsync 7y ago
    This'll stop being true at cheap VPS providers as soon as spammers cotton on, and then VPS providers ranges will be blocked in /48s (even if you only get a /128 or /64 from your VPS provider) because it's not worth the hassle of doing anything smaller.
xnyanta 7y ago
It sounds like someone on your provider's network got the subnet blacklisted. I've been running mail servers on OVH (which is known to be a cheap host) for years and I successfully deliver to GMail and other providers without any issues. I'm pretty sure delivering over IPv6 also helps a lot since spammers will never bother setting that up.
inopinatus 7y ago
Not sure why you said “no”, because the whole of your remaining comment simply reinforced that reputation matters, including reputation by association. Association extends to sharing an IP allocation. It may even extend to sharing a nameserver. Gmail isn’t randomly targeting a “little guy” for the Internet Death Penalty. This isn’t arbitrary, and an entitled victim mindset isn’t going to get your email delivered. Like I said, prefer IPv6. For now at least, bad senders don’t choose it. That’s the something you can do about it. Pro tip: most VPS services are a swamp. Incidentally, if your server was rooted, don’t assume that this would show up in the mail logs. There are plenty other ways to use a compromised host as an open relay, including lying to your admin tools. Ultimately, I think that if you’re unwilling or unable to run a MTA to the maximum level of reputation, then skip doing so, and use Postmark instead.

oarsinsync 7y ago

> 2. Some bad guy from the same IP network sent spam (although GMail error message specifically states that spam was sent by this exact IP address, not an address from the same network). This is the most likely situation. If a VPS provider is sufficiently cheap, it will attract the wrong people, who will then get the entire VPS provider's IP blocks blacklisted. It's a shame, but it's the reality. There are lots of discussions around this subject on various mailing lists, where people from the likes of Gmail have chimed in stating as much. I would reckon it takes as little as 10% of the addresses in a /24 (so ~25 IPs) to get that entire netblock blacklisted. If you want a higher probability of clean IPs, you need to be using a provider that is sufficiently expensive to not attract spammers. Either that, or you need your own IPs.

tambre 7y ago
> Either that, or you need your own IPs. Or just use IPv6, which will probably fix this.
- scintill76 7y ago
  Why is this considered a useful signal by Gmail? Isn't it cheaper for a spammer to get throwaway IPv6 addresses?
  - inopinatus 7y ago
    Most spammers aren’t competent to provision an IPV6 service correctly, especially one with matched PTR and SPF(TXT) records, and using throwaway v6 addresses makes SPF much harder. It’s also easy to spot, at which point you can tag the sender domain with a bad reputation. It’s no surprise that Gmail et al are more interested in sender domain reputation, and also the graph of related domains, than they were a few years ago.
- oarsinsync 7y ago
  This'll stop being true at cheap VPS providers as soon as spammers cotton on, and then VPS providers ranges will be blocked in /48s (even if you only get a /128 or /64 from your VPS provider) because it's not worth the hassle of doing anything smaller.

xnyanta 7y ago

It sounds like someone on your provider's network got the subnet blacklisted. I've been running mail servers on OVH (which is known to be a cheap host) for years and I successfully deliver to GMail and other providers without any issues. I'm pretty sure delivering over IPv6 also helps a lot since spammers will never bother setting that up.

inopinatus 7y ago

Not sure why you said “no”, because the whole of your remaining comment simply reinforced that reputation matters, including reputation by association. Association extends to sharing an IP allocation. It may even extend to sharing a nameserver. Gmail isn’t randomly targeting a “little guy” for the Internet Death Penalty. This isn’t arbitrary, and an entitled victim mindset isn’t going to get your email delivered. Like I said, prefer IPv6. For now at least, bad senders don’t choose it. That’s the something you can do about it. Pro tip: most VPS services are a swamp. Incidentally, if your server was rooted, don’t assume that this would show up in the mail logs. There are plenty other ways to use a compromised host as an open relay, including lying to your admin tools. Ultimately, I think that if you’re unwilling or unable to run a MTA to the maximum level of reputation, then skip doing so, and use Postmark instead.