4 ms·

Ask HN: Getting blacklist when trying to check if email can deliver

9 points by lechuhuuha 5y ago

Hi all. My website is running a verify email to query smtp server the perform these command Note : the mail from {myemail}@mydomain is not real and my server dont have spf and dkim yet HELO mydomain MAIL FROM: <mymail@mydomain> RCPT TO: <examplemail@aol.com> QUIT After running these command i get black list on eXploits Blocklist (XBL) & CSS Blocklist (CSS). I check issue from spamhaus and this is the detail infomation : (IP, UTC timestamp, HELO value) {hide my ip :O} outlook.com Notable things about the HELOs: They are often dynamic-looking rDNS, and claim to be from geographically very different networks They can include impossible HELOs like "gmail.com", "outlook.com", "comcast.net" - Gmail, Outlook and Comcast do not use these. These are all fake. The cause of this problem is frequently found to be coming from an phone or laptop with "free" VPN or channel unlocker, "free" streaming apps. This can be caused by a spambot infection or a server misconfiguration. First check that the HELO settings are correct. This can be done by sending an email from {hide my ip :O} to "helocheck@abuseat.org". A bounce that contains the required information will be returned immediately. It will look like an error. It is not. Please examine the information in the body of the email. NOTE: "helocheck@abuseat.org" does not currently work with IPv6. If the HELO settings are correct, then there is a spambot or some other kind of malware! What step i need to take in order to not get blacklist like this in the future. Thanks in advanced!

egberts1 5y ago
First of all, EHLO (and HELO) are nearly non-essential to proper SMTP operation of email delivery but more about a rudimentary authentication factor of “please confirm who their mail server domain name is”. If you trigger enough mismatched EHLO from their expected mailing domain name, into the spam dustbin, your IP address goes. And if their mail server is beefy, into the blackhole list (RBL/DNSBL) too!
- lechuhuuha 5y ago
  So smtp check is the wrong way to verify an email address? Or the way im doing is wrong. Did i need to have SPF,DKIM config and send the real message to their SMTP server? My question is, is there any other way that this can be done? How do these services claim reliable validation in light of the above? I know that they are not going to reveal their methodologies, but can anyone on SO shed some more light?
  - egberts1 5y ago
    LOL, there are open specifications online to everything SMTP-related. Start with the IETF RFCs.
bradknowles 5y ago
So, I was the Sr. Internet Mail Administrator at the beginning of what I think most consider to be the real breakout of the Internet — 1995. I’m also co-author of the SAGE Booklet “Internet Postmaster: Duties and Responsibilities”. And I’ve been in the anti-spam community for a very long time. One thing I’ve learned is that you simply cannot validate an e-mail address using the methods you’ve described. Far too many e-mail addresses are not actually deliverable, even if you get a “220 OK” response at that stage. Too much processing is done on the message after the envelope has been transmitted. For a period of time, people thought that they could automate e-mail address validation (as you have described) as part of of the process of receiving an e-mail message. That is, when your server receives the envelope information, before you allow that sender to proceed any further, you call out to validate the e-mail address that they just gave you. But there’s no actual authentication there, so you look like a spammer. Moreover, your e-mail address validation process can be abused to do a denial-of-service attack on anyone they don’t like — just set up a bunch of spambots that all claim to be sending e-mail from victim@example.org, and then watch all those servers doing e-mail address validation just completely nuke the mail servers for example.org. That’s also called a reflection attack. To put it simply, don’t do e-mail address validation. At least, don’t use the early part of the SMTP protocol to do it. Instead, send them a real message. Tell them why you’re sending it. Ask for them to reply. If they don’t reply, then the e-mail address might or might not be valid, or they might just be ignoring you. Or they might have complained about your message to their mail server operators, who have then added you to a blacklist. You won’t know for sure in those cases, but the more information you give them explaining why you’re trying to send them e-mail, the more likely you are to get a positive response. And hopefully, the less likely you are to get blacklisted.
- bradknowles 5y ago
  Oh, and if you are actually a bad actor who is asking for advice on how to get around the blacklists who should be legitimately stopping your traffic, note that I haven’t really given away much information here. EAV stopped being a legitimate tactic in the late 90s. So, In the case that you (or a future reader) is actually a spammer, we will still get you. And it won’t take us that much longer.

9 points by lechuhuuha 5y ago

egberts1 5y ago

First of all, EHLO (and HELO) are nearly non-essential to proper SMTP operation of email delivery but more about a rudimentary authentication factor of “please confirm who their mail server domain name is”. If you trigger enough mismatched EHLO from their expected mailing domain name, into the spam dustbin, your IP address goes. And if their mail server is beefy, into the blackhole list (RBL/DNSBL) too!

lechuhuuha 5y ago
So smtp check is the wrong way to verify an email address? Or the way im doing is wrong. Did i need to have SPF,DKIM config and send the real message to their SMTP server? My question is, is there any other way that this can be done? How do these services claim reliable validation in light of the above? I know that they are not going to reveal their methodologies, but can anyone on SO shed some more light?
- egberts1 5y ago
  LOL, there are open specifications online to everything SMTP-related. Start with the IETF RFCs.

bradknowles 5y ago

So, I was the Sr. Internet Mail Administrator at the beginning of what I think most consider to be the real breakout of the Internet — 1995. I’m also co-author of the SAGE Booklet “Internet Postmaster: Duties and Responsibilities”. And I’ve been in the anti-spam community for a very long time. One thing I’ve learned is that you simply cannot validate an e-mail address using the methods you’ve described. Far too many e-mail addresses are not actually deliverable, even if you get a “220 OK” response at that stage. Too much processing is done on the message after the envelope has been transmitted. For a period of time, people thought that they could automate e-mail address validation (as you have described) as part of of the process of receiving an e-mail message. That is, when your server receives the envelope information, before you allow that sender to proceed any further, you call out to validate the e-mail address that they just gave you. But there’s no actual authentication there, so you look like a spammer. Moreover, your e-mail address validation process can be abused to do a denial-of-service attack on anyone they don’t like — just set up a bunch of spambots that all claim to be sending e-mail from victim@example.org, and then watch all those servers doing e-mail address validation just completely nuke the mail servers for example.org. That’s also called a reflection attack. To put it simply, don’t do e-mail address validation. At least, don’t use the early part of the SMTP protocol to do it. Instead, send them a real message. Tell them why you’re sending it. Ask for them to reply. If they don’t reply, then the e-mail address might or might not be valid, or they might just be ignoring you. Or they might have complained about your message to their mail server operators, who have then added you to a blacklist. You won’t know for sure in those cases, but the more information you give them explaining why you’re trying to send them e-mail, the more likely you are to get a positive response. And hopefully, the less likely you are to get blacklisted.

bradknowles 5y ago
Oh, and if you are actually a bad actor who is asking for advice on how to get around the blacklists who should be legitimately stopping your traffic, note that I haven’t really given away much information here. EAV stopped being a legitimate tactic in the late 90s. So, In the case that you (or a future reader) is actually a spammer, we will still get you. And it won’t take us that much longer.