CBL is blocking me because HELO string is incorrect???

[tschallb]

Hi Folks,

This is an odd one that I hope someone has some ideas on...

Our Exchange Server has shown up on the CBL. We are not an Open Relay nor have we been infected with anything. Evidently they run a HELOCHECK on Domains that support Email and if the response they receive is "incorrect" you get added to the list. They provide a test email address of helocheck@cbl.abuseat.org and when you send a message to that address it will bounce back with your FQDN or IP Address.
See

http://cbl.abuseat.org/helocheck.html

When I run the check I receive the following:

<mail.myservername.org #5.5.0 smtp;550-Your HELO name for IP address 24.199.32.100 was>

The basic problem is that nothing shows for my HELO name. In Default SMTP Virtual Server Properties Advanced my FQDN is correct. I have tried adding a Masquerade domain and that has no effect. If I telnet is I get my server name when I issue a HELO...

I am hoping someone has some more ideas as myself and my local Exchange experts has no idea.

Of course, I can get myself temporarily unblocked but a week a two later the CBL runs the check again and then puts us back on the list. I am looking for a more permanent solution.

Thanks,
Tim

 

[smah]

I'm not too good figuring these things out, but you are listed in one of the spam database lookup. It looks like this database might be including others in your RoadRunner IP block (that might be sending spam). However, if I'm interpreting the details correctly, it might also be related to the fact that the reverse dns comes back to a road runner business domain - not whatever your domain name actually is. It looks like this would have to be fixed before they'd even tell you why you ended up in the spam database.

 

[tschallb]

Hi Smah,

Thanks for the response. The IP address I listed had a typo in it. The real IP is 24.199.32.210 and the reverse DNS comes back to my correct domain.

Thanks
Tim

 

[smah]

I don't even use exchange in a production environment, but often these problems are related to dns records. Have a look at this DNS report. Note the first mail server warning. Your reverse pointer records seem to be telling the world that these are the same server, when in fact it seems that they are not.