42 ms·

Spam blacklisting is out of control

• pabs3 5y ago
  Last time I was an admin of a server that got onto SMTP IP blocklists, it was because some spammer had brute-forced the SMTP password of one of our users and was sending out spam through that account. Passwords are terrible, switch to using certs/keys instead of passwords if you can.
• cx42net 5y ago
  Managing mail servers is nowadays only possible for million dollars backed companies. It's clearly something we discovered while running Improvmx.com. Of course it's possible (and quite easy) to set up your own mail server, there are tons of guides out there for that, but this is just the tip of the iceberg! Once you have it up and running, you'll find yourself in a constant battle between those who spam you, and those who consider you spammer, real or not. Using blacklists to filter out the bad incoming email is one efficient tool, but you need to rely on good, reliable and *honest* blacklist systems. Sorbs and Spamhaus comes to mind, compared to uceprotect and backscaterer. The last two asks you money to delist you regardless of what you did, and this is typically bad player playing on top of bad players. They do a race to the bottom by offering a racketing service. But the worst is still that popular mail server uses these! Microsoft uses UCEProtect to filter email! So, as a mail provider like OP's, you find yourself in a pickle where you need to decide if you want your email to be delivered to Microsoft's users - that means paying, or not. That is why managing emails has become a million dollars necessity if you want them to be up and running properly. You need to be close to the big ones, have a seat at the big tables where the decisions occurs and hopefully have your IPs added to whitelists. To plug one very useful link in all this, I'd share Hetrix! (https://Hetrixtools.com https://Hetrixtools.com), they monitor your IPs and notify you when they are listed on almost all the existing blacklists, and automatically delist them whenever possible, or provides you all the info to do to delist them. As a mail provider, this is on of the most useful tool there is.
• gazan 5y ago
  Hello All, I am looking for somebody that already has a sophisticated mailing operation, and I have the rest. Anybody interested?
• codatory 5y ago
  UCEPROTECT-2 and 3 aren't blocklists, they're reputation lists. Anyone straight blocking off those lists has most likely misconfigured their filtering and should expect to be missing mails. NOTE: By using Level 2 blocking, be prepared to lose a few mails too. DO NOT BLAME US, YOU HAVE BEEN FOREWARNED! > https://www.uceprotect.net/en/index.php?m=3&s=4 https://www.uceprotect.net/en/index.php?m=3&s=4 Use of Level 3 for blocking is recommended only if you are a HARDLINER and you want to cause service providers and carriers that have spammer / abusive clients to be quickly and effectively blocked and it does not matter to you if regular email is also occasionally rejected. > https://www.uceprotect.net/en/index.php?m=3&s=5 https://www.uceprotect.net/en/index.php?m=3&s=5 This has been the subject of hot debate on one of the popular mailing list operator's lists, and the providers that find themselves in Level 2/3 reliably are working on strategies to deal with that but it becomes complicated to do anything that affects thousands of customers. You'll find the providers that aren't on these lists are the ones that have an equally strict policy for allowing outbound Port 25 from their customers and a severely punitive abuse desk. IMO, I run a personal mail server and deliver directly and if my mail is rejected or lost then I use another mechanism to contact that person (usually telephone) and inform them of the failure. I also provide usable feedback to senders for why I may have chosen to reject their message. And when it really matters, I also have a relay I can use for troublesome transports.
• reph2097 5y ago
  Uceprotect is a scam. Ignore it. Using it for inbound email is a misconfiguration.
• reph2097 5y ago
  People on HN seem to be unable to run mail servers. It's not that hard.
• LinuxBender 5y ago
  There is a typo in their title. If intentional please instead consider words like block reject and deny for the people that do not speak English as a first language. I've dealt with real time blocklists as long as they have existed. They are not going away any time soon. I agree that the paid exception lists are a bit shady but I also see the validity of their methods of temporarily punishing everyone on a hosts network to put pressure on the ISP/platform provider to police it's own network and remove spammers. The best one can do today aside from securing ones own server is to research an ISP's IP space ahead of time to see how dirty they are. There are plenty of providers that cleaned up their act some time ago. Linode is a great example of change. New accounts can't even send email unless they open a ticket and prove they made some effort to comply with can-spam. More providers need to follow that example so that we don't run into this problem of dirty networks that real time block-lists like UceProtect have listed. It's an imperfect solution to an old ugly problem.
  • IshKebab 5y ago
    It's "blacklist" in most languages though so the non-standard "block list" would be probably more confusing to non-native speakers. Anyway they clearly meant blacklist.
  • r_hoods_ghost 5y ago
    Yeah except we've had this recently with Linode's IP range landing on that exact blacklist and being blocked by Microsoft and other major mail providers, knocking out our ability to send to huge chunks of our customers. I've had to get the mail server moved off Linode to another hosting company as paying the ransom fee did nothing. UceProtect does seem at least as morally dubious if not more so that the spammers it alleges to protect against.
    • boudin 5y ago
      Which other major provider uses this list? Uceprotect is attempting to racket me from time to time. While I'm blocked i try different providers to guess the ones using this, I only found Hotmail blocking me.
• spcebar 5y ago
  I too have had issues with that particular blacklist, which, I believe, is gaining notoriety as a scam. In my case I was setting up outgoing email for a customer's WordPress website. In the end, rather than spending the time and money dealing with the blacklist, we routed their mail through Sendgrid. Not an especially happy ending, but their email works now.
• PeterisP 5y ago
  > I can complain to my hosting company and hope they evict the bad user from the network. But then why should my hosting company do so? The answer to this is the other option, leaving the hosting company. In this manner, every hosting company gets a choice - either they will kick out legal-but-immoral things like spammers, or they will not and rightly lose their above-board customers. This is essentially how the global e-mail community self-polices by establishing a norm that a host either has to work to exclude bad actors or will get boycotted/excluded for allowing them.
  • cgriswald 5y ago
    His whole defense of the hosting company's hypothetical failure to help is bizarre. He considers a lot of things that aren't his concern or even really his business. A real analysis of whether to complain would only consider whether the hosting company will be responsive and whether they are competent to fix the problem. Why is he considering—with incomplete information—the hosting company's legal options and the severity of the spamming? Edited to add: He could also consider whether it is his hosting company with the problem or the orgs using UCEPROTECT; although as someone who needs their emails to go through "no matter what" that can be more difficult.
  • indymike 5y ago
    > The answer to this is the other option, leaving the hosting company. In this manner, every hosting company gets a choice - either they will kick out legal-but-immoral things like spammers, or they will not and rightly lose their above-board customers. This assumes that the RBL in question is a good actor. It is as bad as the spammers. > This is essentially how the global e-mail community self-polices by establishing a norm that a host either has to work to exclude bad actors or will get boycotted/excluded for allowing them. Most of us have ignored UCEPROTECTCTL lists for a long long time as it appears to be a money grab.
• jeffbee 5y ago
  This post meanders between complaining about RBLs and vaguely whining about the big email hosts, but I don't see the connection. There is zero useful information contained in the RBLs and the big hosts don't use them.
  • derekzhouzhen 5y ago
    I believe that outlook.com starts using UCEPROTECTL2/3. However I have no proof so I have to be vague about it. It is in the interest of big email hosts to shut out small, independent senders to strengthen their position of monopoly. Again, I have no proof.
    • shirro 5y ago
      When Exchange hosting which is just about every business in Australia it seems (and possibly outlook.com and 365) blocked a huge range of IPs, a lot of people went to IP blocklist searches and saw the only entry was UCEPROTECT3 and connected the events. It is very possible they are unrelated or it crept in through another provider's product without anyone there explicitly choosing to use it. Unfortunately the whole system is very opaque.
• csnover 5y ago
  Fortunately for the author, I haven’t noticed any email servers that use the UCEPROTECTL3 RBLs to reject mail—which is to say, I’ve noticed some servers I administer end up on UCEPROTECTL3 incidentally and it has never caused a delivery problem. On the other hand, some VPS providers are still allocating multiple customers to the same IPv6 /64 using SLAAC by default, and this will make it impossible to deliver mail on IPv6 since reputable RBLs always blacklist the whole /64. As far as the argument about spamming being immoral but not illegal, I’ve never seen a reputable ISP that didn’t prohibit unsolicited bulk email in their terms of use, so the grounds for reporting it is that a customer is violating the terms that they agreed to follow when they signed up. And to answer the question of whether or not RBLs are useful: in my experience, yes, they are quite useful. The biggest problem I’ve noticed with them is not typically false positives on small providers, but false negatives on giant companies like Google who cannot ever end up on an RBL because they process so much mail but don’t do a good enough job of preventing their servers from being used to send spam.
  • vsviridov 5y ago
    Outlook properties seemingly use uceprotect lists. Outlook support even has a page for getting off their block list, but I could never get a reply. And my hosting provider basically said "we're warning against using our servers for outbound email", which amounts to "we're not gonna do anything about your bad neighbors that landed you on the uceprotect lvl2&3 lists" Been running my own email for 18 years, and outlook is the only place that i have problems delivering to.
    • csnover 5y ago
      Outlook definitely engage in aggressive blocking of netranges, but I’m pretty sure they don’t use UCEPROTECT to do this since I’ve seen servers caught in Outlook netrange blocks despite all the public RBLs (including UCEPROTECTL3) showing no problem. Just to be sure, you are using the Outlook form[0] and not the Office365 form? Have you signed up for SNDS?[1] All these hoops are pretty dumb, and I don’t think they have updated any of these systems since the mid-2000s so they are also pretty terrible to use, but here we are. My limited personal experience with Outlook’s removal process is that it’s just slow and confusing (sometimes 12 hours for a response, sometimes the response emails are empty). The last time I had to do this, their TLS certificates had expired (and they use HSTS), so I could not even get into SNDS for half the day until someone there finally noticed and deployed new certificates. [0] https://support.microsoft.com/supportrequestform/8ad563e3-288e-2a61-8122-3ba03d6b8d75 https://support.microsoft.com/supportrequestform/8ad563e3-28... [1] https://sendersupport.olc.protection.outlook.com/snds/ https://sendersupport.olc.protection.outlook.com/snds/
• pandemicsoul 5y ago
  Spam blocklists are run by an unaccountable cowboy cult that somehow has managed to consolidate a ton of power simply for the fact that most people who run email inbox services didn't want to deal with the problem of spam, so they were more than willing to just hand over anti-spam "enforcement" to anyone who was allegedly doing "what was best for the internet." There's no check on these people who run these blacklists, and the system they've built is entirely a black box, antithetical to the principles of the open internet. And if you're not a huge corporation that can afford professional management of your email deliverability, good luck – the individuals and small organizations are just out of luck. It's a miserable racket and for what? If you want to know why there's a new thread each week on HN about why it's impossible to host your own email service, this is why.
  • multjoy 5y ago
    So what's the alternative? SBLs work, clearly, and almost every mail host, in the absence of distributed list, would work up their own lists in short order.
    • ILMostro7 5y ago
      Choose your SBL better; spend some time reading about it (doesn't have to be much) or testing it before blindly enabling it.
  • convolvatron 5y ago
    no. its because of spam. just because these people are doing a less than perfect job of keeping the screaming hordes out of my inbox doesn't remove any of the blame from the hordes.
    • pixl97 5y ago
      It's been years since I last hosted my own mail server, and even then the HAM to SPAM ratio was well over 1:100. The torrent of absolute crap faced at port 25 is unbelievable.
  • istillwritecode 5y ago
• boudin 5y ago
  UCEPROTECT is a scam. Blocking innocent people and asking them for money has nothing to do with security. The good thing is that most email servers do not use it because it's just bad. The bad thing is that Hotmail uses it (or at least was at until recently). It does mean that, as a Hotmail user, there's legitimate email that you won't receive. I do wonder if the guy behinf this scam is randomly blocking whole ip ranges to make a living, having enough people agreeing to the racket.
• indymike 5y ago
  RBLs are useful, but there are a few that are not what they appear to be. The particular one in question, UCEPROTECT is a) not worth paying b) should never be used by a production mailserver to block messages. From the beginning there have been enterprising RBLs that are clearly overbroad, and offer to accept money. The money is not for getting off the list, it is always for something else so as to appear legitimate and a side effect is getting your domain off the list. This model is unethical at best, and is right up there with companies that snail mail over-priced domain renewal notices.
  • Avamander 5y ago
    Actually no RBL alone should be used for decisive actions such as banning. It's not UCEPROTECT either, big vendors like Cisco with their IronPorts are just as bad.
• jspaetzel 5y ago
  Any shared hosting provider is extremely susceptible to this type of issue and this type of list just doesn't work. It's a scam. There are lots of good blocklists, but there are also lots of bad ones like this. When I worked with a company who ran email systems like this we'd always steer customers away from lists like this, in cases where we couldn't deliver mail because of it we blamed the other provider. This actually worked a lot of the time and the customer would wind up contacting the sender another way to let them know they had a problem, and fairly often they'd change lists. Our standard messaging was something like, "Google and Microsoft are receiving our emails just fine, something is wrong with the receiving service"
• huhtenberg 5y ago
  > Or I can leave the current hosting company Yep, that's the one. If your hoster doesn't care about spam spreading from their IP space, you should take your mail server elsewhere. There's literally nothing to think about. And if they do care about this issue, they are likely to be taking steps to remove any of their IP space from the blacklists, without being nudged. PS. I've been running a mail server for close to 20 years now and I do blacklist by /24 netblock on the second offense. This doesn't bounce emails though, just tags them as spam. So I had a quick look in the logs and Hetzner, Digital Ocean, OVH and LeaseWeb are all spamming a lot. LayerHost, Colo Crossing, Liquid Web, Host Winds and Servion are also close to the top. Anecdotal data, obviously, so caveat emptor and all that.
  • reaperducer 5y ago
    When I first started monitoring spam connections years ago, it was almost always home cable+internet providers. They seem to have gotten the message and cleaned up thier acts. As of last night, the number one source of spam for both the personal and company servers I maintain is Digital Ocean. Which is a shame, because otherwise I'm a happy Digital Ocean customer. But because of this, I would never move any of my commercial projects there.
    • pixl97 5y ago
      I'm not sure that home IPs have cleaned up their act, I think it is that no large email host accepts their email any longer so spammers have stopped sending from there.
    • derekzhouzhen 5y ago
      > home cable+internet providers. They seem to have gotten the message and cleaned up thier acts. By blocking outbound connection to port 25 outright. I don't want my VPS hosting company to "clean up" this way.
      • denton-scratch 5y ago
        > I don't want my VPS hosting company to "clean up" this way. Most ISPs submit their domestic ranges voluntarily to certain blocklists, e.g. the Spamhaus PBL. I used to have a bunch of blocklist services in my MTA configuration, with different lists having different weights and so on. Eventually it became clear to me that nearly all true spam that hit any one list would also hit Spamhaus Zen. So I scrapped my list of lists, and relied entirely on Zen. My life became easier. Note: Zen includes the PBL; so if you block using Zen, then you will block mail from domestic ranges. Zen is pretty safe (unless you are expecting mail from domestic ranges). It's safest to use Zen as part of a scoring system, with something like Spamassassin to add heuristic content scoring.
• robomartin 5y ago
  We recently ran into this issue and were forced to change email providers. It isn’t that our host didn’t care, it’s that it is almost impossible to play whack-a-mole with dozens of blacklists. We have been with the same provider for 15 years, no problems, ever. It seems that email delivery started to become unreliable about six months ago. After repeated attempts to fix it we had no choice but to move elsewhere.
  • CliffStoll 5y ago
    Who'd you choose?
    • robomartin 5y ago
      Sorry, I've been so busy I haven't checked into HN in a while. Zoho mail. Very happy with them so far. The webmail client is excellent. Deliver is fast and without problems. We usually setup users with multiple email addresses. Using email aliasing works great. In other words, you could receive email from you@example.com, sales@example.com and vendors@example.com. This only consumes one paid user account. Ultimately, we decided to move email for three businesses to Zoho. The prior host was GoDaddy. I can imagine someone saying something like: "You deserve the problems you had". My counter is that we've hosted email with GoDaddy for more than ten years. No problems at all. Rarely an issue. In my opinion, most of the GoDaddy hatred is truly unfounded. If you are running a more sophisticated infrastructure you need to go to something like Linode (which we use for exactly those applications) or something else. In the last 6 to 12 months, something changed. Once reliable email delivery became questionable we had no choice but to make a move. They said they could not do much more than request the servers in question to be removed from the various blacklists. In other words, play whack-a-mole with that entire ecosystem. A loosing proposition. So, we moved our business. Perfectly sensible decision. No hate involved. We are buying a service that, in my opinion, was no-longer being offered. Done deal.
• sylware 5y ago
  I run my own email server, and I have _really_ a pb with smtp servers using spamhaus block lists. Ofc, to "whitelist" your IP with spamhaus (some shady andoran/swiss mafia), you must use a javascript only web engine based web browsers (I don't and I shoud not have to) in order to contact spamhaus. If this is a "chat" with their ppl, where is their IRC server? If I have to pay something out of this, this will be a lawyer to deal with the admins of such smtp servers.
• kazinator 5y ago
  > My hosting company is competitively priced, is fast, and has served me well for many years. ... attributes which they achieve by (1) selling services to anyone and anyone and (2) not dedicating any resources to fighting spam. So you got what you pay for.
  • derekzhouzhen 5y ago
    I don't want my hosting company to dictate what I can do and what I can't do. I don't spam, but I won't hold my moral standard to everyone else.
    • autoexec 5y ago
      Your hosting company is free to allow all the spam they want to leave their network and every other ISP on the planet is free to drop all traffic from your irresponsible hosting company's IP space. freedom sure is nice.
      • derekzhouzhen 5y ago
        I and I alone is responsible for my act. It is a slippery downward slope once you start outsourcing responsibility.
        • autoexec 5y ago
          When your act is choosing and giving money to a host that supports and enables spammers and attackers yes, your are responsible for that. Blacklists can be outsourced, but many ISPs maintain their own internal blacklists as well. ISPs can also subscribe to a 3rd party blacklist, but still whitelist specific blacklisted IPs they know aren't going to cause them problems. There are plenty of blacklists that ISPs choose not to use because they block too much to be useful. ISPs can also use blacklists not to block senders, but to greylist them or give them higher levels of scrutiny before deciding what do accept or block. In the end, even with 3rd party blacklists networks still maintain control over what incoming traffic/mail they block or allow.
• prepend 5y ago
  I guess another option is to sue the blacklist operator for inappropriately including him. Or sending some legal sounding letter threatening suit. I found some old lawsuits [0] that got injunctions and even damages awarded from being included in black lists. I hate how the big tech customer nonsupport is bleeding into small firms attitude. “Sorry, you did nothing wrong but might one day so get fucked.” is really not something that should happen very much. [0] https://www.techdirt.com/articles/20051228/1349229.shtml https://www.techdirt.com/articles/20051228/1349229.shtml
• TillE 5y ago
  Email is a fundamentally broken protocol which has become less and less important, I don't really get the point of running your own server except as a technical exercise. Set up your email wherever is convenient, encrypt stuff that matters, and move as much communication as possible elsewhere.
  • DrBoring 5y ago
    But where is elsewhere?
    • dredmorbius 5y ago
      Postal, as a backstop. The cost is a feature. Network-specific messaging tools are another option. I strongly prefer open protocols. The concept that anyone anywhere can intrude on anyone anywhere else at no financial or reputational cost is ultimately flawed. It works only so long as those with that access are few in number, generally of mutual interest, and act in a largely principled manner. As numbers increase, and levels of interest and level of principles fall, the system will collapse. Usenet was the first such network to fall to this dynamic. Email is well on its way. Telephony is into its first years of general intolerability (any direct-dialed universal access, wired or otherwise). Facebook faces this threat less through its lack of filters than the defection of high-affinity users. Postal mail has its own issues with quality, but the associated costs do in fact impose a minimum bar to malicious content.
  • 1over137 5y ago
    All the 'elsewheres' are non-federated, centrally controlled, and/or corporate. No thanks.
• jijji 5y ago
  this is the first time that I've ever heard of a email blacklist provider offering to remove an IP from their database if you pay a monthly fee... it sounds like extortion.
• karmicthreat 5y ago
  I think many RBLs started out with good intentions. But it does feel like like many of them have shifted to pure grift. Pay for "priority" review definitely has negatively impacted this. UCEPROTECTL3 especially feels like an extortion attempt similar to the threatening domain renewal scams. But I've never notice any outgoing email from my services being blocked by it. So it just goes in the crank file. Really we probably need some sort of anti-RBL system. To keep good actors honest and force bad actors out of business.
• istillwritecode 5y ago
  If you start a new mail server in 2022 (or migrate from a previous address), you have to apply to be whitelisted by outlook.com and the many domains owned by Microsoft. They no longer accept mail from servers they haven't seen before. Companies such as google, microsoft, and facebook would rather that email died, and are actively working to destroy it through neglect, so that people will shift their messaging to proprietary networks they happen to own. Email has problems - spam being one of them, but it's as potentially important as IP routing itself, and we should work to preserve it.
  • thaumaturgy 5y ago
    > They no longer accept mail from servers they haven't seen before. Interesting. This tracks with my experiences too, but is there a good source for this that I can reference in the future? I got out of hosting email last year entirely because of intractable deliverability problems with the big three: Google, Microsoft, and Comcast. Comcast's issues mostly appeared intermittent and the result of incompetence. Google and Microsoft have clearly been competing to see who can kill small email service providers the fastest.
    • lytefm 5y ago
      I contacted Microsoft, actually received an answer from them and got an IP unblocked. Google can be tough though. If their Algorithms don't like you, good look. I was responsible for a new IP/Email setup and while all other relevant providers liked our mail and Google Postmaster tools didn't show anything bad, all our mail went to Spam in GMail. I found out why when even mails from completely different senders would usually go to Inbox but hit Spam once our Website or email was included: Despite showing it as "high reputation", GMail must have considered it as utter trash. Changed to a different, older domain and all has been fine since.
      • jbotz 5y ago
        How did you contact them? I had problems getting mail to MS years ago and at the time wasn't able to get anyone to do anything or even respond. At some point later the problem went away, though.
• rsync 5y ago
  I'm dealing with this right now. Both my personal domain and rsync.net are on a distinct subnet, but that subnet is smaller than a /24 and someone on a different subnet has, apparently, behaved badly. Enter "abusix" ... One of my engineers had an enlightening webchat with one of their engineers where we were shown the "offending" IP and it was explained that they have no ability to distinguish subnets (and no interest in doing so). So if you're not wasting an entire /24 (we only need ~10 IPs at this location) you're in danger of this misclassification. We were also informed that our normal, business communications with paying customers should have unsubscribe notices appended to them. Which is to say, you're a paying customer of a service and we send you some kind of alert or critical announcement ... and it should have an unsubscribe link. Unbelievable.
  • vorpalhex 5y ago
    > We were also informed that our normal, business communications with paying customers should have unsubscribe notices appended to them. You should have an unsubscribe link. You should also have your business address and identify yourself. Even if it's not required by the letter of the law, you should add it. As an example: Amazon automatically opted me into an "alert" when a wishlist I viewed had a new viewer. Since it's an "alert" and a "business communication" it has no unsubscribe. This is spam - this is an ad hidden as a notification.
    • kazinator 5y ago
      Though that may be a nice opinion, your ISP has no business dictating that to you.
      • Godel_unicode 5y ago
        Abusix isn't their ISP, they're an email blocklist provider. Telling people what they need to do to not get blocked for being abusive is literally their job.
        • hansel_der 5y ago
• bendbro 5y ago
  What is "blicklisting"? A misspelling?
  • berkut 5y ago
    Very likely... Unless they're South African :)
• mjrpes 5y ago
  I fought the battle to keep my SMTP server IP off blacklists, and lost. You can do everything possible, have a perfectly clean IP, have a good amount of outbound email traffic, only send transactional email, etc. Still, there will be edge cases where email does not go through. AT&T email servers would constantly blacklist me and not respond to requests to remove me, gmail/yahoo/outlook would silently put emails in the spam folder, and companies using email firewall products would blacklist me, with an IT Dept too inept to fix it. The solution was to pay a small fee and proxy all outbound email through a transactional SMTP sender, like Postmark or Mailgun. It's easy to do, with one line of code in Postfix. You can be selective, and only proxy emails sent to certain troublesome domains. If you try an email provider and it's not working out, it's one line of code to change to another provider. This allows me to still manage nearly all aspects of hosting my email server and control my email data, while not dealing with deliverability issues. I use Postmark and I have not dealt with a deliverability issue in two years.
  • Silhouette 5y ago
    While I am happy for you that you have found a solution, the solution you found is symptomatic of a very dangerous situation: it is increasingly impossible for individuals or SMEs to use essential online facilities like sending messages or transferring money reliably unless they use a broker service as an intermediary. We are allowing small numbers of tech firms to take control of vital functionality that should be using open, standardised protocols in a decentralised way. This leaves everyone who isn't big enough to run their own implementation that others can't afford to ignore beholden to those brokers and subject to arbitrary charges and/or denial of service.
    • YPCrumble 5y ago
      I agree completely with this, but the one problem is that you haven’t addressed how we control spam without these “trusted” intermediaries. “Trusted” here meaning that they aren’t spammers.
      • netr0ute 5y ago
• benjojo12 5y ago
  My personal experience with UCEPROTECT was that they had blacklisted 2 or 3 IPs in my /24 that were not routed to anything, nor had they ever been routed to anything, a fresh new block from RIPE NCC too. Of course they offered to unblacklist them in exchange for payment, or wait. Waited 2 weeks and they dropped off. I've yet to hear about anyone using their DNSBL for anything serious in 2020/2021/2022 I only knew about the listings because a monitoring service emailed me about it.
  • zinekeller 5y ago
    > a fresh new block from RIPE NCC too While I personally don't use UCE (and personally think that they're not good at what they're doing), unless you've get that IP range before 2012, I doubt it's a new one. Many spammers do often exploit RIPE's unallocated IPs for their spamming operations (either using BGP hijacking or just asking RIPE nicely for a range), which unfortunately is a perennial problem.
• bhauer 5y ago
  This has become bad enough that operators of personal mail servers are put into no-win situations and generally give up. Either we can concede defeat and relay personal correspondence email through a commercial service or we can just accept that some recipients will not receive our emails. I've adopted the latter stance because I don't operate a business that uses my personal mail server and therefore have the luxury of not caring a whole lot. My stance is that if a recipient is using an email service that blocks me for no good reason, they don't want to receive my email. They can complain to their service provider if they choose to. In a few cases, I've asked them to complain to their service provider and have seen some minor corrective action. But that's pretty rare.
• yosamino 5y ago
  This is a complaint about "UCEPROTECT Blacklist Policy LEVEL 3" [0] It's description is not subtle: > This blacklist has been created for HARDLINERS. It can, and probably will cause collateral damage to innocent users when used to block email. So if the mailsystem you are trying to reach employs it, is either experiencing spam levels that justify it's use - OR they made a mistake in using it, if this is the sole reason you are being banned. The first order of business is of course to complain to your hosting provider. Nobody wants spammers on their networks - but if they do: then this is kind of exactly the reason for this list. The policy describes in detail what made it possible for this netblock to end up on the list, that should be enough for them to take action either pre-emptively or by notifying their offending customer, and if neccessary kicking them off the network. The next thing you can do, instead of paying for whitelisting, ist to contact the mailserver-admin at system you are trying to deliver mail to. This can be a bit of a hassle - seeing that your mailserver just got blocked - but it usually works. The same way systems don't want to receive SPAM they also don't want to overblock, after all they want their users to receive emails as well. If you are the mail admin of a sending system and you're reaching out to the receiving system this is usually a pretty good indicator that you don't want to spam them. I have had success doing this even at some larger ISPs, where you would expect this to be more difficult. I very much enjoy these blocklists - simple, transparent. Loads better than the kafkaesk black holes that are the major mail providers who barely care, and who do not give you easy recourse if you are mistakenly blocked. [0] https://www.uceprotect.net/en/index.php?m=3&s=5 https://www.uceprotect.net/en/index.php?m=3&s=5
  • cure 5y ago
    > The next thing you can do, instead of paying for whitelisting, ist to contact the mailserver-admin at system you are trying to deliver mail to. This can be a bit of a hassle - seeing that your mailserver just got blocked - but it usually works. The same way systems don't want to receive SPAM they also don't want to overblock, after all they want their users to receive emails as well. If you are the mail admin of a sending system and you're reaching out to the receiving system this is usually a pretty good indicator that you don't want to spam them. That's nice in theory. In practice, UCEPROTECT level 3 is used by, for example, all Microsoft properties (including hotmail, etc). And UCEPROTECT level 3 lists a lot of netblocks. So, if you want to send e-mail from, say, Digital Ocean, to any Microsoft managed e-mail domain, you can just forget about it. DO doesn't care, Microsoft very much doesn't care. Good luck trying to contact a postmaster there!
• teekert 5y ago
  Would be nice if ipv6 would fix this. This is also the reason I stopped self-hosting email, despite some nice benefits.
• gorgoiler 5y ago
  Can anyone here (the author?) recommend a one-stop-shop script for checking ones IP address / prefixes against these blacklists, ordered by severity?
• neilv 5y ago
  The US federal government should tackle huge email account providers that effectively (by accident or design) use anti-spam as a pretext to sabotage self-hosted email.
  • scarface74 5y ago
    Yes because the government involved in technology always makes things better as I click on “allow cookies” on every damn website.
    • gog 5y ago
      Punishing anti-competitive measures doesn't have to be always complicated. "Allow cookies" modals are horrible but GDPR gives people in the EU rights to be forgotten and not contacted in the future. Reminding companies about GDPR regulations works very well.
      • scarface74 5y ago
        just wait for the new law to outlaw spam filters so anyone can host email. As soon as they do, email might as well be dead. The GDPR already caused some sites just to block access to EU countries.
      • raron 5y ago
        Probably a lot of those "allow cookies" banner are also illegal [0], but you can enable a cookie banner filer in uBlock Origin anyway. [0]: https://noyb.eu/en/noyb-files-422-formal-gdpr-complaints-nerve-wrecking-cookie-banners https://noyb.eu/en/noyb-files-422-formal-gdpr-complaints-ner...
• vmception 5y ago
  Extortion rackets
• jrochkind1 5y ago
  That you can pay them to get off the blacklist does sound rather like a protection racket. Am I missing anything?
• newbie789 5y ago
• basilgohar 5y ago
  This has literally just recently (re-)become an issue for me because after a good year or so of not being blocked, several emails from my server started getting filtered as spam by both Google and then just being outright blocked by both Google and Microsoft. When I got through Microsoft's steps to unblock, after several days and steps, they send me the message that actually my IP is not blocked. Google's recent message was more helpful - apparently forwarding emails from the accounts I setup for my kids to my wife's Gmail account triggered some obscure rule that ruined my server's reputation with Google, and I think Google & Microsoft collaborate because the issues cropped up within a week of each other. The interesting thing was I discovered the Outlook issue by trying to reply to an email sent from an Outlook customer. Yes, my reply to an Outlook customer's email to me was blocked because of my server's reputation. To be clear, I run no mailing lists nor solicit any business with my email server. I use it for personal use only and my consulting work which involves know contacts. The forwarding I spoke of before is solely to our own personal accounts. I use Mail-In-A-Box, for what it's worth, on a Linode VPS.
  • gog 5y ago
    How did you contact Google and Microsoft regarding deliverability issues?
    • pteraspidomorph 5y ago
      Microsoft: 1. Set up on https://sendersupport.olc.protection.outlook.com/snds/ https://sendersupport.olc.protection.outlook.com/snds/ 2. Read everything at https://sendersupport.olc.protection.outlook.com/pm/ https://sendersupport.olc.protection.outlook.com/pm/ 3. Make sure everything is fixed, then use the link to the form hidden under Troubleshooting > "Sender services, tools, and issue submission" (the link's label is "here") to contact support. Make sure all fields are provided, including a website. It may take a few days to get a response. You may have to try multiple times until someone actually helps you. Google: Pray
      • basilgohar 5y ago
        This is a fair reflection of my experience.
• Ansil849 5y ago
  > Other customers within this range did not care about their security and got hacked, started spamming, or were even attacking others, while your provider has possibly not even noticed that there is a serious problem. We are sorry for you, but you have chosen a provider not acting fast enough on abusers. What a ridiculously hostile message. Just because a website or mail server or whatever they are talking about got compromised does not mean that the owner "did not care about their security". This sounds like a case of a blocklist operator on a power trip, talking down to people.
• nsajko 5y ago
  The sad thing is that a solution for protection against spam has existed for about thirty years, yet it is almost unused. It is based on the same idea that later came to underpin Bitcoin: proof of work: https://news.ycombinator.com/item?id=30220979 https://news.ycombinator.com/item?id=30220979
• cmroanirgo 5y ago
  From the article: > If my understanding of the law is correct, spamming is legal, albeit immoral But the FTC takes a rather clear stance (at least in my eyes) [0]: > Despite its name, the CAN-SPAM Act doesn’t apply just to bulk email. It covers all commercial messages, which the law defines as “any electronic mail message the primary purpose of which is the commercial advertisement or promotion of a commercial product or service,” including email that promotes content on commercial websites. The law makes no exception for business-to-business email. That means all email – for example, a message to former customers announcing a new product line – must comply with the law. > Each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $46,517, so non-compliance can be costly. But following the law isn’t complicated* On top of that there's GDPR [1]: > After the GDPR passed, some people said it would be “the end of email marketing” or “the end of spam.” But it will be neither. Spam has always been outlawed or against the terms of use of most email providers. Those who send unsolicited or malicious mass emails will probably continue to send them. Did your spam folder dry up after May 25, 2018, when the GDPR took effect? So, it seems the laws are in place, it's just that the jungle of unwanted & unsolicited email continues. It sucks when it's your server that get's blocked in a dragnet because you've a noisy neighbour. But like others have stated, move neighbourhoods. [0] https://www.ftc.gov/tips-advice/business-center/guidance/can-spam-act-compliance-guide-business https://www.ftc.gov/tips-advice/business-center/guidance/can... [1] https://gdpr.eu/email-encryption/ https://gdpr.eu/email-encryption/
• pl0x 5y ago
  The adblock lists are out of the control. Adblock Plus and Brave will block put your site on a block list to then sell ads against your site to companies like Verizon and Google. Brave loves Verizon so much they even listed them as a featured advertiser. https://brave.com/brave-ads/ https://brave.com/brave-ads/
  • walrus01 5y ago
    note that there is a huge difference between corrupted for profit things like "adblock plus" and the community sourced, not for profit things like ublock origin.
• causality0 5y ago
  I signed up for random stuff quite liberally Wait, what? That's like off-handedly mentioning you eat a pine cone for breakfast every day and glossing over it like we're not going to wonder if you're crazy.
• annoyingnoob 5y ago
  Blame your ISP, or hosting provider. As an email admin, I deal every-single-day with phishing and malware that comes through email. There is not a single hosting company that does anything more than pass complaints onto the spammer - thus verifying that I'm a good target and causing even more of a problem. While I do not use any blacklists, I do make my own. I've found that blocking individual IPs is useless, there is always another one. However, if I block the entire IP range I have much more success. This is your hosting company's fault for allowing spamming and doing nothing about it.
• johnklos 5y ago
  The author has some oversimplifications which would be worth addressing. First, there actually does exist a strata of spam which is plainly illegal. All the phishing spam and all the messages that claim to be from networks and/or addresses that they are not, for example, are illegal. The problem is that it's not enforceable. Second, sending unsolicited messages when you do not have the permission of the sender is unambiguously wrong. Large sources of spam get around this by mixing bad messages in with good ones. This is why we get tons and tons of spam from Gmail, from Outlook.com, from Sendgrid, and so on, even though they really should know better. The point is that your "bad neighborhood" doesn't just have regular spammers - it's almost certain there are illegal and egregious spammers that your ISP is doing nothing about. How do we know this to be the case? Because many of the blocklists also run honeypot email addresses. If email addresses get harvested and someone sends spam to these addresses, you can be 100% certain that no permission was ever given, so the behavior that leads to this is definitely wrong. ISPs make too much money to punish anyone but the worst of their clients, and that's definitely a factor that contributes to the affordability of the author's ISP. However, the author left out one big, simple, obvious option: pay significantly less money than the cost of the blocklist extortion to smarthost through an ISP that has good email reputation. You get what you pay for, so when you save on your ISP, don't be surprised if you have to pay a little more to make up for their shortcomings.
• adrium 5y ago
  I have been running my own mail server for two years on my private ISP and have less problems than expected - even with the dynamic IP address (in practice, it changes once in 6-12 months) and no PTR. I also switched the ISP once. I have SPF, DKIM, DMARC. Edit: The nice thing about running the mail server personally and without a relay (like mailgun) is that mail is to-my-end encrypted. If the other party is running its own mail server, it could even be E2E encrypted. Considering the vast amount of personal information that going through email, this makes me feel good in terms of privacy. I have never heard of UCEPROTECT and fortunately, I never had to deal with it. The language on the webpage somehow reminds me of Kryptochef... A small inconvenience is that I had to unblock the IP on Spamhaus PBL every month. By now, it feels as if they know me, because I now only have to do this once if I get a new IP... Many mail servers are nice and provide the reason for the block even with hints how to unblock it. I successfully unblocked it on Abusix and Microsoft. Never had an issue with Google. GMX on the other hand will never accept my email because they require a proper PTR record. They are the only company I have come across and I find that scandalous.
  • phishersfritz 5y ago
    Your comment about no issues with no valid PTR surprised me. Spamhaus PBL is build based on your ISP telling Spamhaus which IPs are dynamic and which IPs should not send email. Your ISPs seemed to be nice enough to allow you delisting from it, which not all ISPs will allow. Abusix has a similar list, but its completely build based on dynamic looking or no PTRs. You can create an account and delist without any issues. Never the less there is way more services than GMX that block based on dynamic or no PTR. A lot of smaller solutions have this option checked by default. And it actually has been a best practice for decades to have a proper PTR. If you can, I'd set one and be done with it.
  • shirro 5y ago
    I like running my own mail server but I don't want to waste time on filtering spam so mismatches with ptr and hostname are an instant rejection from me. A PTR match is a very strong signal that I am looking at a hosted server or business connection which is configured to send email and not a compromised windows PC on consumer dsl which used to be a huge problem. ISPs supply those dsl ranges to blocklists as well. When I first started hosting my own mail it was on an old repurposed linux PC on ISDN in the early 2000s and even then my ISP offered configurable PTR records along with static IP in a small business package. I moved my family email vps to a different region recently and it took me a few seconds to update the ptr records for ipv4 and ipv6. It seems a very low bar for such a strong signal that you are dealing with a mail server and not some random compromised machine.
• thayne 5y ago
  If I were to design a replacement messanging system to replace email, I would design it with deny by default, where messages that aren't signed by someone on your contact list are rejected. Maybe with a system to request that someone add you to their contact list (though with a limit on how much text can be in that request). Maybe something like that could be done with email, but without a culture around it, figuring out what addresses you need to add to your contact list when you add new services could be a pain.
  • djakaitis 5y ago
    So basically how social media platforms handle messaging.
• kazinator 5y ago
  > I run my own email server, and don’t use any blacklist. Yes, I got some amount of SPAMs. However, the vast majority of trashy emails I receive each day are advertisements (I signed up for random stuff quite liberally). You don't run a mail server for other people who are not so careful with their e-mail addresses, let alone for a large organization. You don't run a mail server which hosts public mailing lists.
  • derekzhouzhen 5y ago
    I don't now; but when I did run a medium sized organization, I used a very lenient interpretation of spamhaus together with greylisting, and my users were happy.
• lodovic 5y ago
  Email has basically been taken over by Microsoft and Google. They set the rules and decides who can is blacklisted. Although to me, email has become increasingly less relevant, to a point where I only check it once a week or so.
• 51Cards 5y ago
  We just recently switched from a self hosted email server to one of the services (smtp.com, smtp2go, etc.) We gave up the fight.
• amar0c 5y ago
  No one sane is using UCEPROTECT.. I would not even care. If someone is using them as blacklist(s) they have more problems than my mail not reaching them. Spamhaus/Spamcop/truncate.gbudb.net/Barracuda with some "premiums" like Abusix is all anyone should need
• Wronnay 5y ago
  https://en.wikipedia.org/wiki/Comparison_of_DNS_blacklists https://en.wikipedia.org/wiki/Comparison_of_DNS_blacklists That blacklist is listed as "Suspect RBL provider". That says enough about it...
  • CliffStoll 5y ago
    From the Wikipedia article: These RBL providers have demonstrated the potential and willingness to adversely affect vast swaths of internet communications for misguided, reckless or likely fraudulent purposes. Using these RBL providers will likely result in clogging up ISP support channels while negatively affecting legitimate business customers.
• girvo 5y ago
  That UCEPROTECT racket is extortion, frankly. What a mess.
  • jrnichols 5y ago
    SORBS got away with it for years and profited nicely in the end.
• lytefm 5y ago
  > On the other hand, if a legitimate email from a future friend or a potential business associate were accidentally blocked, the lost opportunity cost is several magnitudes higher. To some extent, this also applies to legitimate business mails going to Spam. That was a big reason for me to switch away from Outlook to a provider where I could configure the spam filter to the equivalent of "Viagra scams etc".
• NelsonMinar 5y ago
  SMTP is a failed product.
  • alar44 5y ago
    Not so much failed as just outdated. That's like saying NCP is a failed product. It served it purpose for a time and as things changed, it was replaced. That being said, I don't know how SMTP hasn't been replaced yet. It shouldn't have lived much longer than the early 2000s, in my opinion.
    • convolvatron 5y ago
      its pretty telling the grandparent used the word 'product'. that's why we haven't replaced SMTP, because everyone is off building products. and they all want to own the whole world. SMTP isn't a product. its an open protocol standard. (I certainly agree that we should have a new one, I just can't see how that would happen)
• sam_goody 5y ago
  I agree with your plea, and view the current blacklists as Mafia style "protection" (that also conveniently helps the big players maintain their monopoly). Practically though, if you want to get your mail delivered, you should use Amazon SES or the like to send it - setup is really simple, and they have the clout to not be blacklisted EVEN THOUGH they are definitely being used to send spam. At $1 per 1,000 mails, it is unlikely you will even feel the cost. (I commented on this a few weeks ago at https://news.ycombinator.com/item?id=29713030 https://news.ycombinator.com/item?id=29713030.)
• lucb1e 5y ago
  What would be nice is if there could be whitelists as well, or a blacklist that additionally keeps count of positive interactions. I've had an IP for about a decade that never once sent spam, but has ended up on blacklists from time to time (hosting EICAR on a web server apparently gets your mail server banned, 15-year-old me found out). SPF nicely says that this IP is supposed to be sending email for this domain. I don't think I'm on blacklists anymore, but email still ends up in spam folders nine out of ten times. People are giving off signals that my messages aren't spam all the time (it's my personal email server). Years of non-spam emails count for nothing whereas a single spam mail from an adjacent IP can get you on such a list. Somehow it's a bit imbalanced.
  • knutix 5y ago
    You should check dnswl.org That is the biggest whitelist there is.
• upofadown 5y ago
  Blacklists are fine. If someone wants to make a list based on some criteria then OK, there is no real way to prevent them from doing that. The people doing the actual blocking based on the list have the responsibility for their actions. If, say, one of the largest email providers in the world is found to be giving preferential treatment to the email of other large email providers then they can't use some list as an excuse. Their actions are still anticompetitive and generally harmful. We shouldn't forget to go after the entity that runs the email server that is blocking email from our servers. You don't have to care that there is a list. Blame the right people and involve governments if required.
• jasonhansel 5y ago
  > If my understanding of the law is correct, spamming is legal, albeit immoral. It's illegal in the US: https://www.ftc.gov/tips-advice/business-center/guidance/can-spam-act-compliance-guide-business https://www.ftc.gov/tips-advice/business-center/guidance/can...
• wolverine876 5y ago
  In email, we have accepted a status quo of unreliable availability (delivery), a lack of confidentiality, and frequent fraud. The post office is far better, other than the latency of moving paper. We should wake up and raise the standard. We could even make it a public utility, or a utility that contracts to competing companies, or just develop standards for delivery and user rights - nobody can read my mail, nobody can interfere with it, delivery guaranteed within X time, etc. One challenge is to esure that individuals are still able to run their own servers (e.g., develop standards that the FOSS email software developers can meet). But we could have similar laws to regular mail, protecting delivery, confidentiality, and against fraud. Why do we endure this awful system? Recently I feel like the IT world has shifted from an innovative, creative, we-will-solve-any-problem, build-it-in-our-garage community, to one that is defeatist (nothing we can do), status quo, depends on mega-corps (or VCs) for everything, and which prizes a how-much-can-I-take narcissistic business mentality rather than a creative, change-the-world engineering one.
  • hiptobecubic 5y ago
    I think the stakes have become too high to treat IT like the wild west. There are too many stakeholders and too much money behind it. Haskell adopted the motto "avoid success at all costs" to prevent falling into the same pattern.
• jesprenj 5y ago
  F*k UCEPROTECT! I got listed as well (layer 3 only), because there were more than 32 cases of spam in an ISP that maintains more than 4 /16 networks across the whole country. With the whole AS blocklisted, I fail to see the point of UCEPROTECT and agree with the OP that they are mere thieves. On topic of protecting people, they have a trivial XSS right on the input field where one checks if their IP address is listed - yes, a GET variable is printed directly to HTML. </rant>
• saul_goodman 5y ago
  The UCEPROTECTL blacklists self-clear after a while and it's not nearly as bad other "real" blacklists. Considering all the other hassles one must engage in for self-hosted mail, this one is not high on my list of worries. My host occasionally pops up on these for a few days and usually clears without incident. But yes it's frustrating that my mailhost can be guilty by association despite being in good standing otherwise. And of course the side-benefit for Gmail to enforce more anti-spam provisions is that it increases the reliability of the data they can mine from your mail, and my mail too since so many people still use Gmail.
• paulnpace 5y ago
  For the past five years or so at least 80% of spam that reaches my inbox is from Gmail, Yahoo, or Microsoft. I've been running my own mail server for 9 years now and I don't use any blacklists. Blacklists are the red line districts of the web. They are just a large blunt tool used in a very inappropriate way. The system of IP address space ownership assignment where the vast majority of the IP address users will never own an IP address. It's like renting a business suite in a large office building and being accountable for some unscrupulous neighbor.
• zepearl 5y ago
  Is anybody using "fail2ban" connected to "badIP"? (as described e.g. here https://www.howtoforge.com/tutorial/protect-your-server-computer-with-badips-and-fail2ban/ https://www.howtoforge.com/tutorial/protect-your-server-comp... ) (in both modes, download & upload) My root server hosts as separate VMs at least a website and an email server => both are magnets for all kinds of scans and intrusion attempts => I've got logscans + honeypots etc... set up (fail2ban then closes the source IP's connection for a while) which seem to be working. I wonder if things could improve (e.g. preemptive FW-drop) by making fail2ban use "badIPs", and to make fail2ban feed back to badIPs the "bad IPs that I identify"? Any personal experience in this area here? How dynamic/reliable are "badIPs" lists?
  • dqv 5y ago
    I tried to use F2B and https://voipbl.org https://voipbl.org on a small 1 core + 1 GB RAM vm and it did not work out very well. I'm pretty sure iptables was crashing because there were so many IPS to block. Your mileage may vary. Probably needs something a little more powerful than what I had.
    • zepearl 5y ago
      Thanks - yeah, I did think that that list might be quite long... .
• _dain_ 5y ago
  Makes you wonder if email will someday become so unusable we'll go back to using the post.
  • chaircher 5y ago
    Anecdotal but I've just had a company write to me by post because they didn't recieve my last email I definitely sent them, and I'm going to have to write back to them by post.
    • vidanay 5y ago
      I used to have a credit card company that would send me a letter by post every month stating "You have signed up for paperless billing. Please check your account online for your statement."
• airocker 5y ago
  We have the same problem, even our verification email during registration goes to spam sometimes. Should there be a law that a legitimate company register their domain in a registry that spam filters have to ignore? Otherwise, companies controlling spam filters can choke other companies.
• bumblebritches5 5y ago
• shirro 5y ago
  My main issue is one big US company which has history of engaging in monopolistic practces. They blocked a huge range of Linode IP space in December/January including one of my servers which has a totally clean record, supports every industry standard and is only used by my immediate family. It is guilt by association but blocking email because someone lives in the wrong neighborhood isn't a civil rights violation unfortunately. When a very big company blocks nearly all email from another company that they compete with in hosting services I think it should be investigated as a possible abuse of market power by the EU and DOJ. I think there are important questions to be asked about the damage this does to competition and consumer choice. I wouldn't worry about UCEPROTECT listing. They have an option to pay to remove IPs which to me looks like a protection racket. If anyone blocks solely on the basis of those lists instead of taking signals from more respectable block lists they are only hurting their own customers by blocking legitimate email. I have multiple servers at multiple providers for various things so it is relatively trivial for me to add a rule to a transport map and have my server securely login into another machine to relay the email to a misbehaving receiver. But that requires slightly more than minimal knowledge and many people are pushed towards a small number of gatekeepers who will ultimately be purchased by a cartel of mega companies and nobody will know how to run a mail server anymore. Which is a shame because it really isn't very hard or very technical. What makes it tedious is the behaviour of some companies. The technical workaround to a block is as easy as routing email via another IP and takes a few minutes. But then there is the process of getting the original IP unblocked, sometimes via multiple processes in businesses with a single owner, seemingly none of them knowing what the others or even their own tech people are doing. And/or swapping out the IP for one in a clean block.
• ILMostro7 5y ago
  Blacklisting an ISP's ASN or entire network range because the blacklist creator set an arbitrary threshold of acceptable number of spam activity from 1 or more IPs. I'm really not sure about the legal aspects here, but there are so many practices that blatantly approach extortion. And it's skillfully done in the name of "online etiquette" or a "safe internet". Obviously, legitimate use-cases exist for such services, provided that they are operated faithfully by people/entities with some level of credibility. Whether or not Spam is legal, many (or most) service providers list it as prohibited in their SLA (Service-Level Agreement). Depending on the type of setup they run--the clientele; company focus/prioritization of ROI--they forward complaints to the account owners, with the understanding that the activity must be stopped. Again, this depends on the service provider, especially as you start thinking on a more granular level. E.g. they can have automated systems handling much of this, or they may have employees handle the communications and provide help to their clients in thwarting such activity. Generally, though, the account owners need to balance the security with compatibility--or the uptime and short-term performance of their services. Ultimately, however, some of these spam block-lists--UCEPROTECTL3 in particular--are blatantly using a sledge-hammer approach for little benefit to any of their users, in the hopes of spurring controversy; or fear that leads to customers; or outrage from customers toward the service providers. In the end, the intention is purely to get paid, either by clients who sign up for their service or by the internet service providers that can't wait multiple days or weeks until their network gets de-listed. Their accusatory and aggressive language conveys to people that they must be associated with either some amateur company or one that uses, and knowingly profits from, nefarious practices and shady characters if they somehow ended up on their list. Depending on where you stand, it can be seen as deplorable or underhanded behavior maybe even rising to the level extortion, or it can be considered a shrewd business tactic.
• snowwrestler 5y ago
  > If my understanding of the law is correct, spamming is legal, albeit immoral. If I were the hosting company, and I had a paying customer that is conducting legal business on my network, on what grounds can I evict them? Hosting companies can kick customers off for basically any reason they want to. High-end hosting companies will absolutely kick a customer off if the customer’s activities result in spam blacklisting. When I first signed with Rackspace, it took almost a week to negotiate their AUP (acceptable use policy). They were basically unwilling to give us any solid assurances about account suspension. They gave themselves enormous room to determine what was acceptable behavior on our part. If you haven’t carefully read your host’s AUP, it might be enlightening. If your host doesn’t have an AUP, or doesn’t enforce it, then yeah maybe that is not the best neighborhood.
• parkingrift 5y ago
  The entire email, message, and phone model is upside down for me. Rather than defaulting to allow-all, it should default to deny-all. Content is let in on a case by case basis. I found an email service the operates this way, Hey.com. Unfortunately, it’s pretty sparse in mostly every way but this. However, it’s practically impossible for me to receive spam. You can’t get into my inbox unless I’ve approved you. It doesn’t make any sense (to me) to maintain these hilariously complex deny lists that results in infinite cat and mouse. Just deny everything and only allow in known good actors. Voila.
• martinald 5y ago
  This is actually a really big and growing problem IMO. I gave up trying to run SMTP ourselves years (decades?) ago. Services like Sendgrid et al all made it very easy. However, in the last couple of years I've noticed even the basic paid plan on Sendgrid, Sparkpost, Mailgun (I've tried them all now I think?) still gets constantly blacklisted. Going to support gives you one answer: upgrade to a dedicated IP, which is close to $100/month, and really quite wasteful on the IPv4 space (if anyone knows a cheaper/better alternative, please let me know!). The problem is I am often building systems which require very little (but really important) email - the odd password reset request perhaps. For small webapps you're going to be spending probably more for this dedicated email IP than the rest of your infra combined.
• qwerty456127 5y ago
  This is blatant racketeering - they create a problem for you and demand you pay them for protection.
• rootusrootus 5y ago
  It's not a new thing. I was a sysadmin for a small ISP back in the early 2000s and we had a hate relationship with Spamhaus. They were militant, trigger happy, and very difficult to work with. It was an ongoing headache. I figure that places like spamhaus are a good part of why gmail took over.
• assaflavie 5y ago
  SMTP is just a bad protocol and it needs to go away. Unworkable.
• Terry_Roll 5y ago
  I think this blog should be retitled to some big US tech firms are out of control. The US firm providing anti virus/antispam to UK politicians wont even confirm if they have blocked email sent from constituents to UK politicians. Some websites also block emails from some European email providers, but it always traces back to US tech firms.
• chriscjcj 5y ago
  I commented recently on this very topic and gave an account as to why the company I worked for got out of email hosting years ago. It was blockhole lists. https://news.ycombinator.com/item?id=29675365 https://news.ycombinator.com/item?id=29675365
• cute_boi 5y ago
  I have never spammed in my entire life. But it seems I am also blacklisted. Pikachu :) "Sorry, Your IP is listed in some other Realtime IP Blacklist."
• denton-scratch 5y ago
  Hormel Foods have graciously indicated that they don't mind the use of the term "spam" to refer to UBE/UCE, but have requested that the capitalized version "SPAM" be respected as their trademark.
• denton-scratch 5y ago
  Level 2 and Level 3 are not blocklists that are suitable for blocking on their own. They are punitive blocklists. They should only be used as part of a scoring system, such as SpamAssassin. If your outbound mail is being blocked by some server just because your MTA is in one of those lists, it might be worth contacting the postmaster at the other end, and asking them either to drop those two lists, to use them only for spam-scoring, or to whitelist your MTA.