Deprecation of SPFBL DNSBL

We’re always happy to investigate new blacklists to see how they work for our customers and how they provide additional information on our customers’ email deliverability.  If anyone ever has a blacklist that they suggest we add, please email us.

Over the last few weeks, we’ve given SPFBL, a Brazilian-based DNS Blacklist, a trial here at MxToolbox.  Like all new Blacklists, our trip included display of results with low severity.  However, during the trial we noted that the majority of customers reporting issues with this blacklist were due to simple, and routine reverse DNS issues.  For example, reverse DNS might point to a 3rd party load balancer application, which in no way should break email delivery.

Since this is the case, we’ve decided to suspend use of SPFBL until utility of the list changes.

PagerDuty is now integrated

Many of our customers over the last few months have requested that MxToolbox support PagerDuty as a notification mechanism.  We listen!  The most critical factor in determining what we build at MxToolbox comes from users like you. If you have any feedback on how we can improve our tools or monitoring please let us know.

We’re happy to announce that the integration is complete and ready to use!  PagerDuty integration is included in all paid monitoring subscriptions from the Basic Plan and up.

Free Users

Upgrade today to get access to more monitors and PagerDuty!

Paid Users

To integrate your PagerDuty account with MxToolbox simply head over to your alert notification policy. From there, scroll down until you notice the “Alert with PagerDuty” section and follow the link over to PagerDuty to authorize the integration. You will then be redirected back to MxToolbox on success.

pagerduty_notifications_nav

pagerduty_notification_policies

pagerduty_box

pagerduty_signin

 

Protected Sky Delisting

Recently, we’ve received a number of enquiries about delisting with Protected Sky.  For the last week or so, Protected Sky has had a maintenance notice reminding users that delisting is not available.  Over the weekend, they added another announcement:

Automatic removal will occur for IPs that are seen to be clean

MxToolbox Support is currently trying to contact Protected Sky for clarification, but we have an operating theory.  Currently, we believe this to mean that they have a system in place to automatically delist an IP address if it is not captured in one of their spam traps or reported by one of their customers as spam.

Once we have confirmation or update from Protected Sky, we will update this post with more information.

Are blacklists legal, ethical, etc?

Blacklists came about as a response to unethical and illegal spam.  Blacklists have no other purpose but to stop bad or malicious acts, so they typically occupy the ethical high ground. Since they are used by businesses, universities and internet service providers to screen traffic, they are incented to be ethical, list only known bad actors and not list legitimate commercial traffic.  To do otherwise would undermine the value of their service to their own customers.

All that said, MxToolbox carefully curates a list of the most used and best maintained blacklists.  All the blacklists we check provide free delisting services.  We feel that requiring payment for delisting is not ethical.  However, a few blacklists offer expedited delisting services, which is a bit of a grey area.  Other blacklists may ask strange or seemingly random questions.  Think of this as geeks being geeks, rather than anything malicious or unethical.

What does being blacklisted mean?

Being on a blacklist is a sign of trouble for your email deliverability.  Since companies screen out traffic from blacklisted IP addresses, your emails may be dumped into a spam folder or refused completely.  If your email server’s IP address is blacklisted, it could make doing business difficult.  It’s also a sign that your servers may have been used for spreading spam, viruses or malware.  This could indicate a security breach or an employee issue.  

If your website IP address is blacklisted, then you have a bigger problem.  Typically, web servers do not send email.  Since the primary means of collecting bad actor IP addresses is via email, your web servers might be sending email without your knowledge.  This is definitely a sign of a malware or virus infection on those servers, or someone running email inappropriately from a web server.  

Occasionally, small businesses will run email and web on the same servers.  If you do, you run the risk of a blacklist event taking out all your e-commerce channels because companies may deny access to your website and email activity based upon your blacklist status.

Domain blacklisting is a serious issue.  It means that someone is using your domain for malicious activity, either on a server hosting your website, or by breaking into your DNS.  If the activity is coming from a server in your datacenter, then you need to root out the virus or malware on your servers, patch your servers, and upgrade your security systems and firewalls.  If the activity is coming from a server outside your datacenter that is using your domain name or a subdomain, you have another big problem.  In this case, your DNS has been hacked and the attackers have added subdomains that use your brand.  The attackers can utilize the remote server to host malware and viruses all the while using your brand to make their attacks look legitimate.

Regardless of the type of blacklist, being blacklisted could be a serious issue.  MxToolbox Monitoring services can help you by letting you know when you have been blacklisted, giving you notice before it becomes a serious business issue.

Recent Welcome Emails

While we were improving our unsubscribe code, we reset our email filters.  This had the effect of triggering a new email to all our existing customers.   You can disregard the email.  Nothing has changed with your account status.

Feel free to email us at anytime with any questions you might have.
Thanks,
MxToolbox Support
support@mxtoolbox.com

How do I get delisted?

Each blacklist has it’s own method for delisting.  Sometimes it’s a webform, sometimes it is an email.  Almost always, you need to include the steps you took to fix whatever problem put you on a blacklist.  Many blacklist operators see themselves as righteous crusaders fighting against spam, malware, viruses, bad email configurations and poor email operations, so remember when dealing with a blacklist operator, you are the bad actor seeking forgiveness.

Tips for delisting:

    • Read the description of the blacklist – Descriptions on MxToolbox Blacklist Info Pages give you everything you need to know about the blacklist and your reasons for being listed.  
    • Ask yourself “Do I need to be delisted?” and “Is this affecting my business?” – If you do not do business in Spanish, chance are you don’t need to be removed from the NoSolicitado blacklist that only serves Spanish language emails.  If you aren’t seeing any emails bouncing back, then this isn’t a huge issue, yet.  Don’t waste time or get frustrated over listings that have no effect on business.  
      MxToolbox provides filters that allow you to ignore alerts on irrelevant blacklists.  We also provide an MxReputation report that tells you what your global reputation is.  If it’s still high, you might be fine ignoring this blacklist.
    • Take care of the problem that caused the blacklisting – Once you know why you were listed, fix those issues.  Patch servers, run anti-malware/anti-virus software, fire the guy in marketing that was CCing all your customers or whatever you need to do. A blacklist will not delist you if you have changed nothing.
    • Have a detailed list of remediation steps you have taken –
      What did you do to clean viruses or malware?
      What did you do to close hacked accounts and prevent future attacks?
      Have you changed outbound email policies to prevent spam?
      Have you patched servers or firewalls?
    • Visit their site and fill out the required forms carefully and completely – MxToolbox has links to all the blacklist websites, including delisting forms.  Their forms are for their protection.  Their users will question a delisting if it results in further spam, so filling them out completely will aid your case.
    • Be polite – Most blacklists have evidence that your servers have acted badly.  Treat this as a respectful request that your servers be delisted because you are technically the bad actor here.
    • Explain the business impact – Let them know that you have a business that is impacted by being listed.
    • Be patient, wait a few days for a response – This is not an instantaneous delisting process.  Some of these blacklists are small shops with a handful of employees.  They also need time to validate that you are no longer spamming, sending malware or other issues.  They will wait to see that your emails are no longer hitting their spam traps or being reported by any new customers.  Be patient.
    • Don’t make multiple requests – It’s okay to make a second request if you have heard nothing in a few days, but refrain from making multiple requests in the first few days of an inquiry.  Blacklists get hundreds or thousands of requests daily and often duplicates drop to the bottom.
    • Don’t pay to delist – All the blacklists checked by MxToolbox provide free delisting services.  A few offer paid expedited delisting services.  MxToolbox does not recommend paying to delist and we do not condone services that require payment.  

After you’ve gone through these steps, you should consider setting up monitoring on your important IP addresses, especially Email and Web servers.  Monitors can alert you to blacklist events as they emerge, rather than waiting for serious business impacts.  MxToolbox offers a wide range of monitoring solutions from Free, single IP solutions, to real-time large network blacklist monitoring.

How do I know if I am listed on a blacklist?

Typically, the first time you find out that you are blacklisted is when customers start telling you that they aren’t receiving your email.  Bounced email is the number one symptom of being blacklisted.  Unfortunately, this is finding out about the problem only after it has impacted your business.

The other way to find out if you have been blacklisted is monitoring.  MxToolbox provides active monitoring solutions for blacklisting events.  Our free IP Blacklist monitor checks your server’s IP address every 7 days to give you a general warning of blacklist issues.  Our paid subscriptions check every 4 hours and premium services check at least once an hour, up to real-time blacklist checking.  The higher the frequency of checks, the more likely you will know about being blacklisted before it becomes a customer issue.

How are blacklists used?

Organizations use blacklists to limit security threats like spam, malware and viruses. The IP address of a server sending email is pulled from the email’s header and compared to the blacklist.  Anything that originates from an IP address on the blacklist is refused, quarantined or dumped to a spam folder.  Similarly, content of an email is scanned against the domain blacklist.  Any emails from or containing a domain on a blacklist will be dealt with.

Some companies also utilize blacklists to scan inbound or outbound web traffic or to create web or email filtering appliances.  Many companies purchase or utilize multiple blacklists along with their own blacklist information to minimize the potential for spam, malware or viruses passing through their servers.

MxToolbox provides insight into the blacklist reputation of your IPs and Domains.

 

What is a Blacklist?

A blacklist is simply a list of IP addresses or domain names that an organization has decided to block for one reason or another.  Blacklists started as a means to combat email spam.    Early on, it was just a list of IP addresses or domain names that were sending junk email.  These lists were manually managed with IPs added and removed based upon human interactions between a few systems administrators.  As the Internet evolved these individual lists became larger, more centralized and list curators developed unique tools, spam traps and service models to make the lists more widely available, and more accurate.

There are a few different types of Blacklists that you need to be aware of to fully understand the market.

Public/Private

Public Blacklists are shared publicly via the web or, more traditionally, via DNS.  A public blacklist can be referenced by anyone online to check individual IP addresses.  Checking more than one list or more than one IP requires development of tools, like MxToolbox that can programmatically check these lists.  Often a subscription to the full list can be purchased for use internally, or commercially in appliances or software. Examples of public blacklist are SORBS and Spamhaus Zen.

Private Blacklists have been setup by a company for their own security usage and are not made available externally.  Often, these are considered proprietary or trade secrets because proprietary methods of data collection are used in the curation of the list.  Examples of these include your ISP’s blacklist, Microsoft’s blacklist and those used by security companies.

IP/Domain

IP Blacklists contain a list of IP addresses that are suspect.  Typically, each IP blacklist has a different method of generating suspect email or web traffic and therefore different reason for listing the IP address.  Typical reasons for listing are:

  • Spam has been received from this IP in a honey trap, directly by the organization or has been reported by subscribers to the list.
  • Malware or viruses were sent from this IP address.
  • Open relays or other configuration issues allow for bad actors to exploit the server at this IP address for spam or malware distribution.
  • This IP address has been marked as dynamic (DHCP) by the owner and leased out to their customers.  Since it is dynamic, no servers should be on these IPs and you cannot trust the ones that are.

Note: If you are on a dynamic IP address, you will automatically be blacklisted by most blacklists.  This is normal.  If you’re not sure if you are on a static IP, then you’re probably not on a static IP.

Domain Blacklists simply list domains that have been found in spam email or are known to be sources of malware infections.  There are only a handful of domain blacklists or blacklists that list domains alongside IP addresses.  While a Domain Blacklist is a useful tool to alert you to reputation issues, they do not contain comprehensive domain reputation information.  In general, checking your website’s IP address against an IP blacklist is also necessary to protect the reputation of your website and checking the IP addresses of your email servers is necessary for protecting your email reputation.

You can find the full list of blacklists checked by MxToolbox here.