Re: false blacklisting messages

[rob@xxxxxxxxx]

The problem was that it only started happening since we upgrade our domino 
from 6.0.3 to 6.5.4.  Management told me to drop spamcop from our list of 
blacklists.  They feel (and maybe rightly) that since we filter through 
message labs it was rather redundant.  Management would just as soon have 
me shut off all of the Domino blacklisting capability.

Also, you used to be able to do a 
SHOW STAT SMTP.DNSBL* and see the black listing statistics.  Since message 
labs is supposedly catching them all I have no DNSBL* entries

SHOW STAT SMTP.*
...
SMTP.Command.RSET = 1 
SMTP.MessagesProcessed = 5443
...

sho stat smtp.MSG*
SMTP.MsgRecipients.Ave = 1
SMTP.MsgRecipients.Max = 9
...

> sho stat smtp.DNSBL* 
SMTP not found in server statistics table

Rob Berendt
-- 
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





seanmurphy@xxxxxxxxxxx 
Sent by: domino400-bounces+rob=dekko.com@xxxxxxxxxxxx
04/27/2005 12:39 PM
Please respond to
Lotus Domino on the iSeries / AS400 <domino400@xxxxxxxxxxxx>


To
domino400@xxxxxxxxxxxx
cc

Subject
Re: false blacklisting messages






We have lots of False positives. When they complain, I check their MX 
records and  then to the whitelist. (Exclude these connecting hosts from 
anti-relay checks)
Not a true whitelist until R7, but it works fine. The blacklists are 
invaluable and keep us from receiving millions of junk email every week. 
It also
stops dictionary attacks against our system.

What shows up in the log/console?

You should see the senders IP and the message. look for the message based 
upon the time and day rejected, and add it to the whitelist. 

IE:

04/27/2005 00:28:14   SMTP Server: Remote host 12.222.14.69 
(12-222-14-69.client.insightBB.com) found in DNS blacklist at 
bl.spamcop.net
04/27/2005 00:28:14   SMTP Server: Message from 12.222.14.69 
(12-222-14-69.client.insightBB.com) rejected by DNS blacklist filter

We have lots of False positives. I verify the sender and then add them to 
the whitelist. (Exclude these connecting hosts from anti-relay checks)
Not a true whitelist until R7, but it works fine. 

You can also do a multi blacklist lookup here. Warning there are a few 
databases on that list that always block email from the USA, etc.

www.openrbl.org

Sean

http://www.bedbathandbeyond.com



domino400-request@xxxxxxxxxxxx 
Sent by: domino400-bounces+seanmurphy=bedbath.com@xxxxxxxxxxxx
04/27/2005 01:01 PM
Please respond to
domino400@xxxxxxxxxxxx


To
domino400@xxxxxxxxxxxx
cc

Subject
Domino400 Digest, Vol 3, Issue 89






Send Domino400 mailing list submissions to
                 domino400@xxxxxxxxxxxx

To subscribe or unsubscribe via the World Wide Web, visit
                 http://lists.midrange.com/mailman/listinfo/domino400
or, via email, send a message with subject or body 'help' to
                 domino400-request@xxxxxxxxxxxx

You can reach the person managing the list at
                 domino400-owner@xxxxxxxxxxxx

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Domino400 digest..."


Today's Topics:

   1. false blacklisting messages (rob@xxxxxxxxx)


----------------------------------------------------------------------

message: 1
date: Tue, 26 Apr 2005 16:49:25 -0500
from: rob@xxxxxxxxx
subject: false blacklisting messages

Occasionally an outsider will send email to us and our Notes will block it 


and send them the black list message.  They aren't on spamcop's black list 


when I check however.  Often these people can resend the message and it 
will come in fine.  Since we are using Message Labs I am under some 
pressure to just turn off Notes Blacklisting.  However I hate to throw a 
possible solution at a problem until I fully understand the problem.

This situation has only been occuring lately.  I believe we've been using 
message labs for awhile.  How long, I am not sure.

Rob Berendt
-- 
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com



------------------------------

_______________________________________________
This is the Lotus Domino on the iSeries / AS400 (Domino400) digest list
To post a message email: Domino400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/domino400
or email: Domino400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/domino400.



End of Domino400 Digest, Vol 3, Issue 89
****************************************

_______________________________________________
This is the Lotus Domino on the iSeries / AS400 (Domino400) mailing list
To post a message email: Domino400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/domino400
or email: Domino400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/domino400.