Email from Yahoogroups bouncing

[mharvey]

I have seen my email to my host (on www58) bounce back messages to Yahoogroups many times before, but I have never seen this bounce message:

Status: Hard Bouncing
Last Bounced Message
Remote host said: 550 (Worm.SomeFool.Gen-2) [BODY]

Has anyone seen this message before? What does it mean? I am wondering if a yahoogroups message had an attachment that the email server here thought contained a virus/worm.

[ryan]

Virus in the email Worm.SomeFool.Gen-2. The email virus scanning caught it, either on ther end or ours.


http://www.f-secure.com/v-descs/netsky_d.shtml

[mharvey]

Ok, my email from Yahoogroups is bouncing again. This time the bounce message is:

Last Bounced Message:
Remote host said: 550 http://www.hostpc.com/emailnotdelivered.php [RCPT_TO]

What is going on here. I went to the URL in the bounce message and I see that HostPC has enabled some sort of Spam filtering that is bouncing the email (rather than putting it in a Spam folder like SA does). How can I get this disabled. I do not want emails to me bouncing because some spam filter that I have no control over thinks that the email is spam.

[admin]

Open a helpdesk ticket if you want it disabled.

[mharvey]

I have opened a helpdesk ticket and had this taken care of.

I would really appreciate it if a notification would be made in the forums here when you make a change like this. I had no idea that you added a new form of spam blocking. I know for a fact that it was bouncing emails that were not spam (from Yahoogroups I was able to verify that the bounced emails were not spam). I rely on the email on my host and I need it to be reliable... which is why I moved to HostPC from my previous host a couple of years ago.

Thanks again.

[starfighter]

It was added as an emergency measure because the server was being flooded with several hundred thousand spam emails, Several servers were affected, and the only way to keep them from going down under the load was to add everyone to the additional spam blocks.

[tonydi]

I have to agree with mharvey about the notification thing. While I'm sure everyone here really appreciates the effort you guys went through, it's important that we know how our email will be affected by these changes.

I don't know if I'm on one of these servers or if any of my clients who are hosted here are. It would also be important to know exactly what got blocked so if we have any business associates who send from these domains we could make temporary arrangements to still be able to communicate. As it stands now, we have no idea. I suspect I'm on one of the servers (www42) because my daily spam load of 25-30 has dropped to 2-3 over the last couple of days.

So how about it guys, can we get some more details about this?

Thanks!

[mharvey]

I do not really receive that much spam on my domain. It is a manageable amount when I use Spam Assassin. My concern is that I do not want to have any legitimate email falsely marked as spam. I would rather have a few spam messages slip through.

It is not acceptable to me to have filtering that bounces email that may be real email without me knowing this is happening. At least with Spam Assassin I can look though the spam folder if I suspect that I am missing an email.

[Nick]

Login to your account .. go to the domain .. click Spamassassin Setup

You have a few options ..

Either disable Spamassassin altogether

Choose to Redirect Spam into your Inbox

Change your threshold to a lower score

Add the group to your whitelist
NAME OF GROUP@yahoogroups.com

Do some homework about your problem and QUIT whining about it here

[mharvey]

Do some homework about your problem and QUIT whining about it here

If you read this thread you would see that I know how Spam Assassin works. I am not having a problem with Spam Assassin. It is working fine.

The problem I have is that a new spam blocker was added to the server that I am on, without any notice. This spam blocker can not be controlled by me or the other customers on the server(s) that this blocker was added to. When it determines that a message may be spam, it bounces the email with an error message. The big proble is that I have no control over this spam blocker (what ever it is... I have no idea what process or filter is being used) and it is bouncing email that is not spam.

[admin]

Due to the massive email floods we experienced this past week, we enabled several filters:

relays.ordb.org
sbl.spamhaus.org
dnsbl.sorbs.net
bl.spamcop.net
rhsbl.sorbs.net

If you had email bouncing, then the senders IP/mailserver is listed with one of the top 5 Blacklists in the world... above. These are IP's of known spam offenders, spam sources and 3rd world internet proxy's. They identify open relays as well, which is a major problem when dealing with spam.

out of 100 customers, 99 have written to say they appreciate the major difference the spam filtering has provided. We are aware that not everyone will be happy with the choice, but it's done for the majority - for the benefit of the customers.

If you want to be exempted from the filtering, all it takes is a helpdesk ticket and ask to be "removed from the rbl filtering" with your domain name.

There is no user control interface at HostPC. Because we're using the services of the top 5 blacklist and relay lists in the world, the issue would need to be addressed with them as to why the block exists. We can not influence their lists in any way. Each list we use has specific instructions for the senders IP/mailserver to be "de-listed". HostPC works dilligently to insure our servers do not end up on these blacklists - we can't say the same for other senders.

If there comes a time when these lists are erroneously filtering mail that affect a majority of our customers, then we'll deal with removing that specific filter. For now, if you DONT want spam filtering, open a helpdesk ticket and ask to be "removed from the rbl filtering" with your domain name. It's that simple. For the other 99.5% of you - enjoy the free filtering you're receiving (and the reduced spam)

For the record, enabling these filters has brought our email processing needs down from 14.8 million incoming emails per day to less than 6.5 million per day, freeing server resources for other needs. (these filters are run before Exim even has to deal with the email)

Joe

[mharvey]

Joe,

Thanks for the update. I do appreciate all of your hard work to keep things around here running smoothly. I am happy now that I understand what is happening here and that there is an option to opt out of the new spam filtering. I am sure that many of your customers will appreciate this new filtering but I can not work with it.

I guess I am lucky in that I do not get all that much spam (knock wood) and I am able to deal with the spam that I do get using Spam Assassin.

For some reason Yahoo has a problem and they end up in Spamcop all the time (for example 69.147.64.105 is listed today). They have many different email servers and at any given time they seem to always have one or more of their servers blacklisted. This problem is compounded when trying to subscribe to mailing lists using Yahoogroups. Messages from yahoogroups are bounced through several yahoo servers before they get to you. So the likely-hood of getting a hit on one of these blacklists is high. For this reason I have yahoo.com in my spamassassin whitelist.

Filtering it and routing these messages to a Spam folder is one thing. But if a spam filter bounces a message back to yahoo they will then stop sending email from all of the groups that you are subscribed to. You do not even know that this has happened until you notice that you are missing messages. You then have to manually reactivate the email address. Today I was having the reactivation request emails from yahoo bounced back to them too. That was the cause of my frustration for the past day or so.

Thanks!

[vickys]

mharvey, you are not alone, but you and I must be the only HPC customers that use yahoo groups. Unlike you, unfortunately, I do get spam. I get lots of spam and often no yahoo groups email. The yahoo groups mail that I do get tends to come in over and over and over - for a week or more. Taken together this makes yahoo groups nearly unusable for me. I do not believe this is a widespread problem, as one yahoo group I moderate has 460 members, of which 133 receive either individual emails or daily digests. Of those, only two are bouncing. Perhaps I have an enemy at yahoo and it has nothing to do with HPC. What I do know is that I have not found an acceptable substitute for either. While I love my yahoo groups, having a reliable, affordable host is currently more important.

[skidawg]

I have not noticed any messages from yahoo groups bouncing (I am in about 15 groups).

I have noticed recently that any message sent from a yahoo mail address sent to a yahoo group is being marked as spam by spamassassian. I am not able to whitelist these because they come from many different people. I don't want to whitelist the entire @yahoo.com because I do get a lot of spam from forged (or not) yahoo mail addresses.

[mwisk]

out of 100 customers, 99 have written to say they appreciate the major difference the spam filtering has provided.

Well, count me as another one out of those 99 who has been losing legitimate emails for the last 2 weeks. The bouncing is erratic and emails from osu.edu and aol.com will bounce one minute and then, when resent 5 minutes later, will come through fine. The next day, the same thing. The day after that, the same thing.

I have no idea how many other people I know (or online retailers) are sending me emails that aren't getting through. But I can't have colleagues at major Universities sending me emails that end up bouncing.


If you want to be exempted from the filtering, all it takes is a helpdesk ticket and ask to be "removed from the rbl filtering" with your domain name.I requested this "2d 10h ago" and changed the state to "Urgent" "23h ago". Any chance it'll happen?

[mwisk]

I requested this "2d 10h ago" and changed the state to "Urgent" "23h ago". Any chance it'll happen?

All taken care of now. Thanks guys!

[tonydi]

Joe, looks like one of your tools is gone, huh? I wonder how long the others will continue to try and fight these ^$#)*&.


ORDB.org is shutting down
2006-12-18 11:34

We regret to inform you that ORDB.org, at the ripe age of five and a
half, is shutting down. It's been a case of a long goodbye as very
little work has gone into maintaining ORDB for a while. Our volunteer
staff has been pre-occupied with other aspects of their lives. In
addition, the general consensus within the team is that open relay RBLs
are no longer the most effective way of preventing spam from entering
your network as spammers have changed tactics in recent years, as have
the anti-spam community.

We encourage system owners to remove ORDB checks from their mailers
immediately and start investigating alternative methods of spam
filtering. We recommend a combination involving greylisting and
content-based analysis (such as the dspam project, bmf or Spam Assassin).
DNS and the mailing lists will vanish today, December 18, 2006.

This website will vanish by December 31, 2006.

[Sean]

ORDB is just one of many RBL's we use. While RBL's are an unfortunate evil, I personally have issues with some of their heavy handed tactics.

[tonydi]

Agreed 100%, Sean. I've had to drop the new rbl filtering for some of my clients here because too much of their legitimate email was getting blocked.

[ozee]

Agreed 100%, Sean. I've had to drop the new rbl filtering for some of my clients here because too much of their legitimate email was getting blocked.

Ditto here -- and it's always been ORDB-related... None of the other RBL's.