[SpamCop-List] Re: Rejected because SpamCop marked this message as SPAM

[Andrew]

Thank you for the quick response Mike -

Let me see if I understand what could be causing this:
--First, I am blacklisted because my server sent 1 or more messages to a 
SpamCop 'spam trap' which is a bogus address that triggers the blacklisting.
--This can be caused by viruses, as well as the various types of 
auto-responders.
(Say the auto-responder I have if a virus is detected) <-- guessing this 
would be the culprit.

The first step I will do is to disable the virus auto-responder.  Of course, 
it would be nice to be able to search the logs for the spam trap email 
address so I can see exactly what caused it.  Do you think there is any 
chance of that?

Thanks again.
-Andrew

"Mike Easter" <MikeE at ster.invalid> wrote in message 
news:d6ij5n$or2$1 at news.spamcop.net...
> Andrew wrote:
>> Hello - I apologize, because I'm sure this has been answered before,
>> but search returned nothing and looking over the posts available, I'm
>> still not clear on what's going on there.
>
> If you follow the link which the DSN provided you get a huge amount of
> information.
>
>> My users started getting these messages today:
>> --------------------------
>> SMTP error occurred while sending message to following recipient(s)
>> remoteuser at remotedomain.com
>> 553 5.3.0 Rejected because SpamCop marked this message as SPAM - View
>> additional information at http://spamcop.net/bl.shtml?165.236.236.194
>> --------------------------
>>
>> What does this message mean?
>
> Surely you can see the link in what you posted which leads to a page
> which starts "SpamCop Blocking List - Was your email blocked?"  -- that
> is, when an IP is SCbl/ed that link leads to a page which explains it
> and provides a link to another page which provides more explanation
> which is - Information about the reasons for listing (blocking) your
> mail server (165.236.236.194) -
> http://www.spamcop.net/w3m?action=blcheck&ip=165.236.236.194 - which has
> information like "System has sent mail to SpamCop spam traps in the past
> week  [..] If there are no reports of ongoing objectionable email from
> this system it will be delisted automatically in approximately 15
> hours."
>
> The first link tells about how servers hit spamtraps such as misdirected
> autoreplies.and that provides another link about autorespnders at
> http://www.spamcop.net/fom-serve/cache/329.html  Why are auto responders
> bad? -- which also has sublinks.
>
> In addition, there's a useful faq
> http://www.spamcop.net/fom-serve/cache/357.html  If my IP is listed,
> does it mean I am a spammer or my ISP hosts spammers?
>
>> I'm taking it as remotedomain.com has SpamCop checking on their
>> mailserver (as do we), and either it is scanning the message (which i
>> didn't think was available for SpamCop) or we somehow got on
>> SpamCop's blacklist and are now unable to send emails to anyone that
>> checks the SpamCop database.
>
> Your server 165.236.236.194  rDNS  concord1.concordenergy.com  is SCbl
> listed.  Those who use the SCbl will be blocking or tagging your
> server's mails.
>
>> But, as noted in another post, I cannot find any detail on how my IP
>> got on the blacklist.  I have singed up for the reports of my IP's
>> (hourly) as suggested in yet another post, but have not received one
>> yet.
>
> When your server hits spamtraps it doesn't get reports.  A spamtrap is
> an address which has never been exposed as a 'real' address, and mail
> going to spamtraps means that your server is addressing mail to a never
> exposed address.  One cause of that is if your server accepts a mail for
> delivery which has a bogus From [such as spam and viral propagations
> use] and that bogus From belongs to a spamtrap.  Then, after your server
> accepts the mail, it belatedly attempts a so-called 'bounce' which is
> actually a newmail addressed to the bogus From.
>
> Then, that newmail hits the spamcop spamtrap in sufficient numbers, and
> that causes your server to become listed for abusive behavior.
>
> Hopefully the result will be that you reconfigure your server to not
> abusively newmail bogus Froms.
>
>> I just want to know the date/time or message header that triggered the
>> blacklisting.
>
> Generally you don't get much information about items to spamtraps, but
> you can communicate here http://www.spamcop.net/fom-serve/cache/91.html
> How can I contact a real person about this? - or an email address
>
>> Emails sent off to SpamCop for information, but this seems like such a
>> simple and common request that I must be missing something.
>>
>> help?
>
> You are provided with a wealth of information by following the links
> which the DSN starts you off with.
>
>
>
> -- 
> Mike Easter
> kibitzer, not SC admin
>