Cisco Ironport and Senderbase...how to get delisted?

Wed Aug 17 18:09:53 UTC 2011

We weren't listed in the PSBL.  First thing I did was a few multi-DNSBL lookups
and only found a couple of obscure (to me) ones, which I immediately filled out
for delisting.

Interestingly, comcast.net was BLing us, complete with URL to do apply for
delisting.  I did, and got a response that we weren't listed.  I don't date take
down re-routing just yet.... :-/

> Just went through this the other day.  In our case once we removed the IP
> from the PSBL, our senderbase reputation went back to neutral within about
> an hour or two.  Seemed to be pretty directly related.  I suspect senderbase
> checks a handful of "reliable" BL's and your IP reputation is greatly
> affected by listings in them.  As far as I can tell there is no way to
> contact them to expedite things.  Worse is this one:
>
> http://www.commtouch.com/Site/Resources/Check_IP_Reputation.asp
>
> Unless it's just me, that page is broken and it's the only way to check
> listings or request removals.
>
> Andrew
>
> -----Original Message-----
> From: up at 3.am [mailto:up at 3.am]
> Sent: Wednesday, August 17, 2011 1:58 PM
> To: nanog at nanog.org
> Subject: Cisco Ironport and Senderbase...how to get delisted?
>
> We had two users fall for a phishing email recently, and of course the
> result was
> that he gave his user/pass to a spammer.  We caught one of them in time, but
> the
> other got out many thousands of spam the other night before being
> discovered.
>
> I am in the process of cleaning this up.  Spamcop and others were good about
> delisting us promptly.  Others will within the next day.
>
> However, "Senderbase", apparently used in Cisco's Ironport, will let you
> look up
> your IP and tell you that your reputation is "poor", but offers no way to
> get
> delisted.  It refers you to Spamcop, which I imagine they rely on for
> listings,
> but not delistings.
>
> For now, I'm re--routing per domain to a second server, but I'd appreciate
> any
> tips if there are any.  Seems a lot of .edu's use senderbase.
>
>
>
>
> -----
> No virus found in this message.
> Checked by AVG - www.avg.com
> Version: 10.0.1392 / Virus Database: 1520/3840 - Release Date: 08/17/11
>
>