Telkom SMTP server spam listed

M

mitchmagi

Well-Known Member
Joined
Aug 10, 2003
Messages
403
Reaction score
3
Location
.
One of Absa's mail servers was also blacklisted on one of the RBL's Sorbs I think. I think it is very bad for an ISP to have a server blacklisted. That is normally a bad config not so?
 
No, its not a bad configuration - the server is not an open relay. But they have failed to respond to abuse queries which is bad - I do wonder though why this was expected to recieve a response from afrinic? It is not their job, and they have just as much problem communicating with SAIX.
 
I'm finding alot of my emails from @telkomsa.net accounts aren't going to South African companys, but having no probs to international. Just things like DStv, Multichoice, TELKOM, HiFi Corp.... or maybe I've been added to the 'Constant Nagger' blacklist :P
 
hehe! Not just telkoms SMTP server needs to be spam listed.
 
...sometimes helps switching between the two SMTP servers,
smtp.telkomsa.net
and
smtp.saix.net
only problem is... the sperm bank rejects it's own mail... LMFAO
rather send mail directly from your PC - no external server required.
http://www.softstack.com/freesmtp.html
This freeware proggy works like a charm - one snag tho'...
It will let you send max 10 mails per day :(
 
Last edited:
The problem with sending mail directly form your pc on a Telkom ADSL network is that your mail will be dropped by most servers using the Sorbs RBL lookups, as they have listed most of the dynamic Addresses from ADSL and Cable networks worldwide.

You can check you ip here or someone elses http://www.us.sorbs.net/lookup.shtml
 
NoRulez said:
...sometimes helps switching between the two SMTP servers,
smtp.telkomsa.net
and
smtp.saix.net
only problem is... the sperm bank rejects it's own mail... LMFAO
rather send mail directly from your PC - no external server required.
http://www.softstack.com/freesmtp.html
This freeware proggy works like a charm - one snag tho'...
It will let you send max 10 mails per day :(
Click to expand...


No properly configured mail server will accept mail from you.
 
In the best of a company's interests, a good sysadmin will block dynamic IP adresses as these are a hotbed of spambots.

Should you want to set up your own mailserver, get a static IP and employ some good security measures to ensure that your server doesn't get hacked.
 
Well the only way anything gets blacklisted is if someone is doing spam... and lets be honest.. there are jerks out there that got nothing better to do but do it and if you signed up on a telkom account they will be blacklisted.. i have a problem where i changed my domain completely as people were using my domain name to send out junk emails.. so dont think u guys can put the blame on telkom for this one .. but rather its users..
 
MotherofTechnology said:
Well the only way anything gets blacklisted is if someone is doing spam... and lets be honest.. there are jerks out there that got nothing better to do but do it and if you signed up on a telkom account they will be blacklisted.. i have a problem where i changed my domain completely as people were using my domain name to send out junk emails.. so dont think u guys can put the blame on telkom for this one .. but rather its users..
Click to expand...

Well thats i think perhaps the only reason why one gets blacklisted. Also one more thing is phishing - i know that many domains are blocked temporarily bacause their domains are phished for sending spams.
 
The_Librarian said:
In the best of a company's interests, a good sysadmin will block dynamic IP adresses as these are a hotbed of spambots.
Click to expand...

If you have directors travelling around who need to send mail, you'll be out of a job. You cannot just block all dynamic IPs. What you can do is allow authentication, and reject mail from dynamic IPs who haven't authenticated.

MotherofTechnology said:
Well the only way anything gets blacklisted is if someone is doing spam
Click to expand...

And that someone doesn't have to be you (or your clients) for your IP to get blacklisted. Idiotic "nice" features like bouncing mail with a cute message if the e-mail address is wrong, out-of-office replies, and forwarding all mail to an off-site address where you have no control over the mailserver hosting this off-site address) will all get you blacklisted without even trying.

Think about it. Spammer sends a mail to [email protected] - a bogus address. Like any true spammer, the Return-Path and From headers are both forged (and probably don't match anyway). Your server accepts the mail, sees, "oh dear, there's no such user," then sends a cute message back saying "sorry, I don't know who this is." This message, still containing the spam, goes "back" to someone who didn't send it to start with. They bitch at their ISP, their ISP blacklists takes the steps to backlist you.

Same thing happens when you forward mail off site. Your server accepts the mail, tries to forward it. Remote server is a bit tight-ass about what it accepts, and rejects some of the spam. Your server is now stuck with it. What does it do? Return it, of course. Repeat the previous paragraph. I see servers setup in this way on a daily basis. People configure a catch-all, then forward it to their hotmail/yahoo/gmail account. And then wonder why legitimate mails they send to someone's hotmail account don't show up.

MotherofTechnology said:
i have a problem where i changed my domain completely as people were using my domain name to send out junk emails..
Click to expand...

They weren't using your domain, they were forging it. That's what SPF is for - it's an anti-forgery tool (not anti-spam, which most people seem to think it is).

rohit147 said:
Also one more thing is phishing - i know that many domains are blocked temporarily bacause their domains are phished for sending spams.
Click to expand...

Some overzealous admins will setup some rules to reject/drop mail coming from domains that are popular targets for phishers, without checking where the mail really comes from. Dumb idea.

Again SPF is your friend. Paypal is a big victim of phishing. Yet their mails are deliverd. Why? Here's why:

$ dig paypal.com TXT

; <<>> DiG 9.4.1-P1 <<>> paypal.com TXT
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34124
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;paypal.com. IN TXT

;; ANSWER SECTION:
paypal.com. 3600 IN TXT "v=spf1 mx include:s._spf.e bay.com include:m._spf.ebay.com include:p._spf.paypal.com include:c._spf.eb ay.com include:spf-1.paypal.com ~all"

Implement SPF checking on your server, and you won't be bothered with paypal phishing mails because your server will know if a mail is really coming from paypal or not.
 
someone made a good suggestion,

Get Your Own Domain, its about time anyway, these days one needs to do a bit of social branding.

Either that or stick to gmail.

RESISTANCE IS FUTILE.
 
koffiejunkie said:
If you have directors travelling around who need to send mail, you'll be out of a job. You cannot just block all dynamic IPs. What you can do is allow authentication, and reject mail from dynamic IPs who haven't authenticated.
Click to expand...

That's exactly what we do. SMTP Authentication helps a lot.

Can you help with doing a blog in SPF, as I haven't dealt with it yet? Will give full credit to you.


*mutter*

bladdy spammers
 
Anyways, take a gander at this snippet of my email server's logs :

Code: 
"SMTPD"	1332	35	"2007-10-16 02:36:34.441"	"196.43.2.30"	"RECEIVED: HELO ctb-netw1"
"SMTPD"	1332	35	"2007-10-16 02:36:34.441"	"196.43.2.30"	"SENT: 250 Hello."
"SMTPD"	1332	35	"2007-10-16 02:36:34.471"	"196.43.2.30"	"RECEIVED: MAIL FROM:<[email protected]>"
"SMTPD"	1332	35	"2007-10-16 02:36:34.481"	"196.43.2.30"	"SENT: 250 OK"
"SMTPD"	1332	35	"2007-10-16 02:36:34.581"	"196.43.2.30"	"RECEIVED: RCPT TO:<[email protected]>"
"SMTPD"	1332	35	"2007-10-16 02:36:34.591"	"196.43.2.30"	"SENT: 530 SMTP authentication is required."
"SMTPD"	1332	35	"2007-10-16 02:36:34.651"	"196.43.2.30"	"RECEIVED: QUIT"
"SMTPD"	1332	35	"2007-10-16 02:36:34.651"	"196.43.2.30"	"SENT: 221 goodbye"

Happens at regular intervals. So somebody's PC is compromised somewhere :D :D
 
The_Librarian said:
Anyways, take a gander at this snippet of my email server's logs :

Code: 
"SMTPD"	1332	35	"2007-10-16 02:36:34.441"	"196.43.2.30"	"RECEIVED: HELO ctb-netw1"
"SMTPD"	1332	35	"2007-10-16 02:36:34.441"	"196.43.2.30"	"SENT: 250 Hello."
"SMTPD"	1332	35	"2007-10-16 02:36:34.471"	"196.43.2.30"	"RECEIVED: MAIL FROM:<[email protected]>"
"SMTPD"	1332	35	"2007-10-16 02:36:34.481"	"196.43.2.30"	"SENT: 250 OK"
"SMTPD"	1332	35	"2007-10-16 02:36:34.581"	"196.43.2.30"	"RECEIVED: RCPT TO:<[email protected]>"
"SMTPD"	1332	35	"2007-10-16 02:36:34.591"	"196.43.2.30"	"SENT: 530 SMTP authentication is required."
"SMTPD"	1332	35	"2007-10-16 02:36:34.651"	"196.43.2.30"	"RECEIVED: QUIT"
"SMTPD"	1332	35	"2007-10-16 02:36:34.651"	"196.43.2.30"	"SENT: 221 goodbye"

Happens at regular intervals. So somebody's PC is compromised somewhere :D :D
Click to expand...
In 2004/5 when I started getting those I complained! They explained to me it's
SAIXs way of identifying open relays on their network. Other big providers also use similar techniques. If you're server relays, the ISP temporarly blacklists your IP from sending through their servers, & may result in abuse warnings.


Also Wikipedia has a nice description and basic implementation of SPF: http://en.wikipedia.org/wiki/Sender_Policy_Framework
 
The_Librarian said:
HELO ctb-netw1

Happens at regular intervals. So somebody's PC is compromised somewhere :D :D
Click to expand...

I'll agree with Brandon there. It's Saix checking that you're not an open relay. All the hosting providers I've dealt with do this, as do my current employer (big hosting company). There's this business called "IP reputation" - I'm not sure who is in charge of it, since I don't deal with it directly, but basically it comes down to the following:

If you have one spamming IP address in your network, it affects the "reputation" of your whole block. Some big mail providers us this reputation as part of their checks and might just refuse mail from you if they deem you to be dodgy.
 
Last edited:
hence I have my own SMTP server... and i give my clients a user name and password... so you have to log in to share and I know if someone spams then. if anyone wants to use my server drop me a line...
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X