IP Address Blacklisting

If you're reading this, you have gotten an email bounce message saying that your IP address was blocked from sending mail to acme.com. You're probably wondering why. We have a number of different IP blacklists here, your address could be on any of them:

• Wormy IPs. If an address tries to infect us with a worm or virus, it gets blocked.
• Probers. Some spammers try to send mail to thousands of different names, hoping some will work. When we detect this behavior, we block it.
• Flooders. These are the folks who try to send thousands of messages very rapidly.

This is not a complete list, there may be others. Most of these blacklists expire entries after a few days. If we still see lots of connection attempts during the blacklist period, we keep the listing around until it shuts up. And a few addresses have earned permanent listings.

If you get your IP address from your ISP via DHCP, instead of as a permanent static address, you may have gotten an address that the previous owner was abusing. If you find yourself blocked from sending us mail because of this IP address reuse effect, you have a few options:

• Use the telephone.
• Wait a week and then re-send the mail.
• Send the mail from some other system.
• Send the mail to some other system. If you know me, you probably know one of my other email addresses. They don't have the blacklists, or at least not the same ones, so your mail will go through.
• Disconnect from the internet, wait a minute, and then reconnect. Often this results in you getting a different IP address.
• Tell your ISP you want a static IP address. If you are running your own mail service you really ought to have one.

It's also possible you're sending mail through your ISP's SMTP servers, but other customers of the same ISP using the same servers have worms. If this is the case I need you to do two things:

• Notify me through an alternate channel, as described above, and I will add your ISP's addresses to a permanent whitelist.
• Tell your ISP to install worm-blocking filters. Lots of folks are starting to do IP address filtering, and not all of them will be as accomodating about whitelisting.

As for why we're doing this: before we started IP blacklisting, crapmail was using up almost half of our incoming bandwidth. Now it's down to only about 15%. The blocking is accomplished using blackmilter, a nice simple tool that can efficiently block millions of IP addresses.