Eir IP on blacklist

boardtc

I have an issue with my own domain email ending up in Junk folders. My host provider got me to check my IP4 address on https://mxtoolbox.com/blacklists.aspx

I assume this is the reason my emails are going to people's junk folders on occasion?

Have Eir always been like this? Is there anything that can be done?

niallb

When you send email are you logging in to an SMTP server in your email client settings or just relaying via ISP?

Do you send the emails that are flagged as Junk using a webmail interface or with a program?

Are you hosting your email service at home?

If not, finding your own IP address blacklisted isn't likely to be relevant and I would expect ISP assigned user IPs to be listed to protect from spambots.

You'll need to start by finding some DNS records for your domain. Most importantly the MX records which are the servers that have agreed to accept your email for delivery. Check those addresses on the blacklist tool.

There are other records which are important to raise the trust level of email you send. The SPF records (Sender Policy Framework) lists addresses that are expected to relay email for you. If you're sending emails you must send through a server that is on that list and not on a blacklist to pass those tests.

There are a few further steps after those, but finding out if these are wrong will be a good place to start.

boardtc

Many thanks for the questions and information, really good to learn a little.

1. I use an SMTP server on my hosting service
2. The emails I send are from Thunderbird (via SMTP) or Gmail (via the same SMTP)
3. I am not home hosting
4. I checked the SMTP server on https://mxtoolbox.com/blacklists.aspx and it's clean.
5. https://dnschecker.org/all-dns-records-of-domain.php shows the NS servers for my domain
6. I found https://mxtoolbox.com/spf.aspx and I got all green for my domain

Any advice very much appreciated!

niallb

Thanks.

Just to be sure, can you confirm that you need a username and password to access your SMTP service?

What did you actually get for the SPF record? Did it include the addresses of your SMTP server? No such thing as "green" here! That just means the record exists.

boardtc

Yes, for SMTP, I login with a username/password over SSL/TLS.

It pass for al these prefixes, except the last one (all) - does that help? No mention of the SMTP server.

+ a

+ mx

+ ip4

+ include relay.mailchannels.net

+ ip4

+ a

+ a

+ a

+ ip4

+ ip4

+ a

- all

I looked up all the 4 IP4 addresses, 1 is my current ISP, 2 are my old ISP (pre December 2020) and I was unsure of the last 1...

niallb

They're not a set of tests, they're a list of what servers are approved to transfer email for your domain. You need to get your SMTP server into the record to rule out the most likely reason for your mail to be downvoted.

The list is so redacted I can't help much, but you need to identify them all yourself to get an understanding of what's going on.

You could remove the two ip4 entries for your old ISP unless there's still a valid reason for a machine there to send email on your behalf. Take a look at the +a records and see if they're still necessary. Besides your isp's mail relays they may include web servers your domain might have web forms installed on

The +mx record permits mail from systems registered as MX hosts for your domain, which might include the SMTP relay.

The specific entry for relay.mailchannels.net suggests it processes email for your domain as a spam filter and then forwards it on. You may find it is this system that's flagging your emails as a little bit dodgy.

When you dig a stopped email out of the junk or spam folder take a look at the "original" email with the dozens of headers in the top. They will list the servers that passed it on (received) and also might record who downvoted it and even why.

niallb

and the -all at the end says "don't trust email saying it's from my domain if it comes from anywhere else..."

boardtc

Really great info @niallb !

I went through all your info and tried to apply. I found out that via my

CPanel->Zone Editor ->My domain -> Manage

I was able to see/edit what was shown under https://mxtoolbox.com/SuperTool.aspx for my domain.

Everything showing there was related to my new ISP except for the TXT record for my domain which had all the IP4 addresses mentioned and the include relay.mailchannels.net. It was a free form edit so I replaced it with:

=spf1 +a +mx +ip4:MY_ISP_IP +ip4:my_ISP_SMTP_server_used_in_mail_client

Fingers crossed I start to see a difference and don't have people telling me they found my email in their Junk.

Thanks a million for your time and advice!

niallb

You're very welcome. email delivery is more complicated than you'd expect, but it's consistent and you know how to make changes now.

Check some of the received emails you've dug out of junk to see if they've passed through relay.mailchannels.net too.

If so it's worth putting it back in as it may be the next step out for your ISP.

Once you're happy you've got it though, put the -all back in at the end of it!

boardtc

Actually, my ISP got back since and said rather than the SMTP server the records should include that. So I reset it to:

v=spf1 +a +mx +ip4:MY_ISP_IP include:relay.mailchannels.net ~all

Oakes

Today I discovered that the IP address used by Eircom (95.45.28.242) was blackisted.

This was after noticed that people using gmail were not receiving my emails. I spoke to my hosting company (bluehost) and they did some work in the background. Then I received a 'message delayed' message from my own gmail.com account which I had sent a test email to yesterday. The message is below. I located Eir IP address and went to blacklistmaster website. It showed that both Spamhaus PBL and Spamhaus ZEN blacklisted the IP address provided by eir. I checked my domain names on the site too, but they were clear. I followed the process to unblock and the message I received was "95.45.28.242 has no issues".

I don't understand how a user's input could convince Spamhaus to unblock something outside his/her control. Anyway, this is just FYI in case it helps someone else one day.

Oakes

https://www.boards.ie/discussion/comment/119402187#Comment_119402187

I cannot post the links nor the message I received because there are links in it and I am a newbie at boards.ie