IP Address listed at http://cbl.abuseat.org

[Lidinho]

Hi All,

I recently received the following mail delivery notification:

Reporting-MTA: dns; localhost.localdomain
Received-From-MTA: DNS; mail01.somedomain.com
Arrival-Date: Wed, 22 Nov 2006 14:27:09 GMT
Content-Type: text/plain

Final-Recipient: RFC822; johndoe@somedomain.com
Action: failed
Status: 5.7.1
Remote-MTA: DNS; mail02.somedomain.com
Diagnostic-Code: SMTP; 557 5.7.1 Rejected XX.XX.XX.XX - see [URL unfurl="true"]http://cbl.abuseat.org[/URL]
Last-Attempt-Date: Wed, 22 Nov 2006 14:27:15 GMT

I had a look at

http://cbl.abuseat.org

and our IP address is black listed.

This server acts as a mail and webserver, hosting a number of web applications, of which only about 4 or 5 send sporadic emails (not more that 10 emails a day).

Basic Server Details
OS: Fedora Core 4
Sendmail: sendmail-8.13.4-2

Sendmail has not been configured to send email, and for the above-mentioned applications, "localhost" is used as the SMTP server.

So far inbound email does not appear to have been affected, but some emails are being rejected when sent from these applications.

According to the Composite Blocking List a couple of issues may have caused our IP address to have been blocked
1. HELO "localhost", "localhost.localdomain", and other generic "unconfigured" names.
2. HELOs that are bare IP addresses (without enclosing square brackets).

The first line of the delivery notification (above) is:

Reporting-MTA: dns; localhost.localdomain

According to point 1, this could be the (or part of) problem.

After further investigation, still on the Composite Blocking List site, where they have some possible solutions to the problem:
a. Performing a HELO check by sending and email to helocheck@cbl.abuseat.org, the rejection should be immediate and the error message should be similar to the one below:

#5.1.1 SMTP; 550 Your HELO name for IP address 1.2.4.6 was "localhost.localdomain"
#5.1.1 SMTP; 550 Your HELO name for IP address 1.2.4.6 was "localhost"
#5.1.1 SMTP; 550 Your HELO name for IP address 1.2.4.6 was "smtp"
#5.1.1 SMTP; 550 Your HELO name for IP address 1.2.4.6 was "1.2.4.6"
#5.1.1 SMTP; 550 Your HELO name for IP address 1.2.4.6 was "[1.2.4.6]"
#5.1.1 SMTP; 550 Your HELO name for IP address 1.2.4.6 was "mail.example.com"

where the first four examples are syntactically wrong by RFC2821. The last two are valid.

b. Altering the hostname so that it is similar to mail.example.com


I have tried point a. and got the following message (which I am unsure what to make of it):

Reporting-MTA: dns; localhost.localdomain
Received-From-MTA: DNS; x1234567
Arrival-Date: Thu, 23 Nov 2006 09:35:47 GMT
Content-Type: text/plain

Final-Recipient: RFC822; helocheck@cbl.abuseat.org
Action: failed
Status: 5.1.1
Remote-MTA: DNS; mail.cbl.abuseat.org
Diagnostic-Code: SMTP; 550-Verification failed for <root@localhost.localdomain>
Last-Attempt-Date: Thu, 23 Nov 2006 09:38:02 GMT

Regarding point b. I am weary about changing the machine name as I am not sure what (if any) implications this may cause.

I would really appreciate it if someone would be able to point me in the right direction so as to resolve this issue.

Thanks,
Lidinho

 

[mrballcb]

Without the actual IP your machine is, it's impossible to know exactly why yours is being blocked. Give the IP and someone can get detailed info and prescribe a fix.

 

[Lidinho]

Hi mrballcb,

Thanks for your reply, the IP address is: 80.175.44.162.

Thanks,
Lidinho

 

[Lidinho]

Hi All,

I have changed the hostname and requested a de-listing at CBL. I will continue to monitor this situation too see if anything else needs to be done in order for the IP address not to be listed again.

Thanks,
Lidinho