Ravenstar's Email FAQ's
The aim of this thread is to collate some of the stickies I have made in the past into one thread.
In here you will find the following FAQ's
Understanding Email Block Lists
SPF, DKIM, and DMA...
Forum Discussion
How Email Block lists Work
One of the common complaints encountered across the web is that people check their own IP address and find that it is on one or more mail block lists. This can lead to some consternation as people take this to mean that their IP has been delivering spam. However delving into the world of email reveals a few truths about block lists and how they work.
Understanding Email Delivery
When an email is sent by a user of a mail service (either an ISP's or a dedicated email provider) It follows a defined process.
The sender sends a mail through their providers Mail Submission Agent (MSA) – Ideally this should be done using SMTP authentication although some ISP's still allow their own IP addresses to send mail without authenticating.
The Mail is then transferred using the Providers Mail Transfer Agent (MTA), if it is for another of the mail providers users then it is delivered to their inbox, if not then the Mail is sent to the Mail Exchanger (MX) of the recipients email domain and finally delivered on to the recipient.
Because of the way email works the transfer to the MX has to be done without authentication. This would seem to be a weak point for spammers to attack, and this is where block lists come into play.
Block Lists block direct connections only.
Block lists are used by Mail Exchangers to determine if they should allow a direct connection from an individual IP.
As previously stated Mail Exchangers are a potential weak link for the entry of spam into a network. With spammers being able to set up on any address and send directly to an MX server, there has to be a way of identifying bogus mail sources. Block lists work in one of two ways.
Identifying addresses that should not be connecting directly – Policy Block Lists (PBL)
Identifying addresses that are known to send spam - Spam Block Lists (SBL)
Policy Block Lists
These are IP addresses that should not be connecting directly to mail exchangers.
Most residential customers of ISP's will find themselves on at least one of these. Two of the most well known are Spamhaus PBL and SORBS DUHL.
It's important to note that being on a PBL DOES NOT mean that your IP has been sending spam.
These zones in theory should list all public addresses assigned to customers via DHCP, (Spamhaus has also suggested it would also like to see all static IP's which do not host mail servers in this list as well). Therefore if you are on a PBL you should note that this is nothing to be worried about, it won't affect you sending mail.
Note also that if you are listed on on either PBL then your address may also appear in the master zones Spamhaus zen and dnsbl.sorbs.net, again provided you are sending through a legitimate mail service, this won't affect your mails as it's the Mail Transfer Agent's address that is being checked against the block list and not your own address.
Spam Block Lists
These are lists of IP's that are known to be sending spam. Often these are generated by cataloguing mail that is delivered to spamtraps as well as using aggregate spam reports from mail recipients. While finding your own IP on one of these is a little more concerning, especially if the report is current, again it shouldn't stop you sending mail through a legitimate email service.
If you have any questions about block lists please post them in a new thread and I will try to answer them for you.
Ravenstar68
CBL and XBL Blacklist Entries
I recently had problems sending mail - in my case to Hotmail account.
What I found was that my Home IP had become blacklisted on the CBL (Composite Block List) see the site below for more info and a lookup can be done here.
http://cbl.abuseat.org/ or here
http://www.spamhaus.org/lookup/
Spamhaus XBL includes CBL entries so I would recommend using their check.
While I don't normally advocate checking if your home IP is on a blacklist. I do recommend checking this one. As if you are on the CBL or XBL it would suggest a device on your home network is hosting malware.
Here's an example of a normal Spamhaus Listing
| Blocklist Lookup Results |
77.100.xxx.xxx is not listed in the SBL
77.100.xxx.xxx is listed in the PBL, in the following records:
77.100.xxx.xxx is not listed in the XBL
The middle entry is normal and so can be safely ignored.
However if you see
77.100.xxx.xxx is listed in the XBL, in the following records:
Then you need to click the link underneath.
This will take you to a page detailing why the IP has been listed and giving advice on how to deal with the problem.
In the case of the CBL there is also a link to click to de-list your IP, however it is important you check all PC's in your home for infection first, as if you don't rectify the problem your IP could be re-listed.
Note the CBL uses various methods to identify compromised IP's, and does de-list them when activity from that IP stops for a long enough period of time.
With that in mind it's important that an XBL entry is not just dismissed, Virgin IP's are very sticky (I've have mine for a few months now). So if you are on the XBL or CBL you should check EVERY computer on your home network.
In my case getting my IP removed from the CBL did solve my email problem, and I was able to get mails through to Hotmail again.
Ravenstar68