Spamhaus dbl index on only few emails

clickt

clickt

New Member
Hi
probably you already faced the same problem.
I´ve sent just few dozens of emails to my active users on new mailwizz setup but same doble opt sending domain and i´m warming up my ips. 500 emails / day 16 ips

Now spamhaus is listing my new mailwizz domain not sending domain.I did the de-listing procedere now 4 times and spamhaus dbl keeps indexing domain, even when i´m not sending any emails (0 emails sent) .

Who faced same problem and how did you resolve it, if you resolved...
 
Take a look here: https://forum.mailwizz.com/threads/spamhaus-i-hate-you.4674/

I had the same issue except it was my IPs that kept going on there, but that issue went away and now i have the exact same issue as you where the SENDING DOMAIN is constantly being added to the list (not the IPs like it used to be). I'm using 20 IPs for this sending domain in question.

Strange thing is i have another sending domain using other dedicated IPs and that sends from 10 other dedicated IPs and i have no issues at all with that.

So im guessing somewhere along the lines Spamhaus puts a block on the Domains that send from more than 10 different IPs. I'll do a test, ill disable 10 of my delivery servers for the domain thats using 20 IPs so it makes it to 10 and see if it continues after a few days and will report back.
 
So since I cut the delivery servers down from 20 IP to 10 so far after 17hrs the domain has not been re-listed.

So it does look like if your sending from more than 10 IPs using the same domain that it will keep being listed.

Anyone seeing anything different?
 
sendmedialtd said:
So since I cut the delivery servers down from 20 IP to 10 so far after 17hrs the domain has not been re-listed.

So it does look like if your sending from more than 10 IPs using the same domain that it will keep being listed.

Anyone seeing anything different?
Click to expand...
It is a common anti-snowshoe measure, since even large providers can send legitimate email with only half a dozen IPs.
 
Hmmmm so maybe it's not because of the IPs.

My other domain is now being listed aswell as the other one. The only thing I've changed is the number if emails per hour to send from each IP from 40/hr to 80/hr.

I've been slowly pre-warming the IPs as follows:

Day 1) 10/hr
Day 2) 10/hr
Day 3) 10/hr
Day 4) 20/hr
Day 5) 20/hr
Day 6) 30/hr
Day 7) 40/hr
Day 8) 40/hr
Day 9) 80/hr
 
sendmedialtd said:
Hmmmm so maybe it's not because of the IPs.

My other domain is now being listed aswell as the other one. The only thing I've changed is the number if emails per hour to send from each IP from 40/hr to 80/hr.

I've been slowly pre-warming the IPs as follows:

Day 1) 10/hr
Day 2) 10/hr
Day 3) 10/hr
Day 4) 20/hr
Day 5) 20/hr
Day 6) 30/hr
Day 7) 40/hr
Day 8) 40/hr
Day 9) 80/hr
Click to expand...
The pattern you set is a slow by 10 increase, but then you doubled, so perhaps some filter tried to be smart...and detected an "out of pattern" data point and triggered a listing (or some sub complained) ;)
 
But even after 9 days of mailing there shouldnt be an issue of sending 1920 emails a day and it should still be classed as fine. I've checked the Sending Scores of all 30 IPs and ALL of them have a sending score of either 98, 99 or 100. So i know its nothing to do with complaints or spam traps or anything like that.
 
sendmedialtd said:
But even after 9 days of mailing there shouldnt be an issue of sending 1920 emails a day and it should still be classed as fine. I've checked the Sending Scores of all 30 IPs and ALL of them have a sending score of either 98, 99 or 100. So i know its nothing to do with complaints or spam traps or anything like that.
Click to expand...
I agree, the volume is low and does not look like there is a problem, but if some admin classed it as UBE/UCE/snowshoe then this might be why. If it was a true error or you have the confirmations then you might be able to delist quickly.
 
frm.mwz said:
I agree, the volume is low and does not look like there is a problem, but if some admin classed it as UBE/UCE/snowshoe then this might be why. If it was a true error or you have the confirmations then you might be able to delist quickly.
Click to expand...
I can de-list without a problem but I feel the domain will keep getting re-added everyday like I've experienced before.
 
sendmedialtd said:
I can de-list without a problem but I feel the domain will keep getting re-added everyday like I've experienced before.
Click to expand...
Then it might be worthwhile asking for the reason a particular blacklist has your domain(s) listed. Some blacklists are well-known extortion ops though, and their "opinion" is regularly ignored by even the most reputable ISPs ;)
 
spamhaus is just a big bully and their CEO does not even follow USA law. "Non-profit organization... LOL"

Spreading volume on multiple IPs/Domain. also known as Snowshoes Spam. I believe ESP use many IPs/Domains. they only call it "IP Pool". they don't get listed or flagged.

I know one thing for sure. DBL can happens regardless of the data hygiene.. And once blacklisted on any spamhaus BL. its very hard to get off their radar.

Looking forward to see more input on this maybe we can figure something out.
 
sendizo said:
spamhaus is just a big bully and their CEO does not even follow USA law. "Non-profit organization... LOL"

Spreading volume on multiple IPs/Domain. also known as Snowshoes Spam. I believe ESP use many IPs/Domains. they only call it "IP Pool". they don't get listed or flagged.

I know one thing for sure. DBL can happens regardless of the data hygiene.. And once blacklisted on any spamhaus BL. its very hard to get off their radar.

Looking forward to see more input on this maybe we can figure something out.
Click to expand...

SpamHause are a UK company, from their 2017 accounts they reported:

£2,996,427.00 in the Bank and £3,869,022.00 in Assets. As they are a UK company they dont need to follow the US law of making it a "Non-profit organization", even though they may have offices in the US their company head quaters are in the UK and any deals they do with the major ESPs are probably done in the UK.

I'm talking to a few people behind the scenes that work closely with SpamHaus and they have said "I will get back to you as soon as I receive updates from our Spam Intelligence Service Provider." They have also told me the following info which may be useful:

We also discussed SecurityZones’ “Spamhaus Score” tool:

- click this link to be access tool directly: http://domaincheck.securityzones.net/

- you can also access it by hovering over the “resources” section on our main webpage (www.securityzones.net), and clicking on “Spamhaus Score”

- simply enter any domain you wish to know the ‘Spamhaus Score”

- this will give you some very interesting data on the exact ‘score’ of the domain (with a negative (-) score being the most optimal and (+) score indicating that it is or close to being listed.)


Please know that access is rate limited for security concerns, but we can offer a commercial license if you find it to be a useful tool.
Click to expand...
 
sendmedialtd said:
I will get back to you as soon as I receive updates from our Spam Intelligence Service Provider." They have also told me the following info which may be useful:
Click to expand...
Usefull!
In my case there was no spamtrap
Spam trap hits: no
Still blocked after 521 Mails (active users who also bought something on our shop)

"Please know that access is rate limited for security concerns, but we can offer a commercial license if you find it to be a useful tool."

Delete coockies and you can keep checking more domains.
 
Hi,

I have a domain with 60 ips, never got listed on spamhaus dbl. But few domains got listed and they only have 1 IP assigned to it. Still they are listed on dbl. Any specific reason?
 
You must log in or register to reply here.
Back
Top