[7.904][BUG][FIXED] std.rbl.ctipd.astaro.local too agressive

This was mentioned before https://community.sophos.com/products/unified-threat-management/astaroorg/f/102/t/69397 but I didn't have any problems before. Now some of the emails are being blocked from hotmail and yahoo.

I know some people say block free webmail but you can't function these days without gmail, yahoo, and hotmail.

The first one is spam but still relayed via yahoo

H=n6-vm0.bullet.mail.gq1.yahoo.com [98.137.26.79]:38220 F= rejected RCPT : 98.137.26.79 blacklisted at std.rbl.ctipd.astaro.localgatekeeper exim[21657]: 2010-04-29 00:07:10 SMTP connection from n6-vm0.bullet.mail.gq1.yahoo.com [98.137.26.79]:38220 closed by DROP in ACL

The second one is legit email from hotmail still rejected

2010:04:29-00:09:31 gatekeeper exim[21678]: 2010-04-29 00:09:31 H=blu0-omc3-s25.blu0.hotmail.com [65.55.116.100]:53218 F= rejected RCPT : 65.55.116.100 blacklisted at std.rbl.ctipd.astaro.local

2010:04:29-00:09:31 gatekeeper exim[21678]: 2010-04-29 00:09:31 SMTP connection from blu0-omc3-s25.blu0.hotmail.com [65.55.116.100]:53218 closed by DROP in ACL

0 Astaro Beta Bot over 15 years ago

Astaro Beta Report

--------------------------------

Version: 7.904

Type: BUG

State: CLOSED/FIXED

Reporter: Billybob++

Contributor: barkas, BrucekConvergent, quasar3c279

MantisID: 13583

Target version: 7.910

Fixed in version: 7.910

--------------------------------

0 mle over 15 years ago

Hi Billybob,

If you think the IP address 65.55.116.100 under the control of hotmail.com is allways a legitimate sender you're free to add an exception for this ip address. Additionally you can report this message as false positive by a few clicks in the Mail Manager.

Regards
mlenk
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 barkas over 15 years ago in reply to mle

Hi Billybob,

If you think the IP address 65.55.116.100 under the control of hotmail.com is allways a legitimate sender you're free to add an exception for this ip address. Additionally you can report this message as false positive by a few clicks in the Mail Manager.

Regards
mlenk

You can't seriously expect users to explicitly whitelist sites like hotmail. What will you blacklist next? gmail?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Billybob over 15 years ago in reply to mle

If you think the IP address 65.55.116.100 under the control of hotmail.com is allways a legitimate sender you're free to add an exception for this ip address.

The point of having a RBL is to make life easier for yourself. You can't expect someone getting thousands of mails a day that never reach the end users to go through the logs to find the IPs and then tell astaro to whitlelist every IP address or ask the end users to do it.

Additionally you can report this message as false positive by a few clicks in the Mail Manager.

That is not a problem for beta testing but you don't buy an appliance in enterprise environment to report false positives and hope they get corrected. You just want it to work out of the box.

I don't know why this is becoming an issue, if the RBL is controlled by astaro, just make it a little less strict. Most admins would be glad to receive a couple of extra spams than loose one single legit email that was needed by someone important in the company. That makes the admin look bad and thats not what we want.

FEATURE Give us control over the astaro rbl so we can run it in relaxed or restrictive mode.

Best Regards
Bill.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 mle over 15 years ago in reply to Billybob

Hi,

You can't seriously expect users to explicitly whitelist sites like hotmail. What will you blacklist next? gmail?

You're right. However this was meant as a workaround for the current problem.
I don't know why this is becoming an issue, if the RBL is controlled by astaro, just make it a little less strict.

In order to guard against misunderstandings: This RBL is not controlled by Astaro.

We're currently sorting out why Hotmail/Yahoo mailservers got blacklisted.

Regards
mlenk
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 quasar3c279 over 15 years ago in reply to mle

Hi,

web.de mailserver (217.72.192.247) is also blacklisted.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 mle over 15 years ago

The problem seems to be a broken integration of the ctipd RBLs. We will fix this in one of our next releases.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 15 years ago in reply to mle

I take it these are CommTouch RBLs? Just curious.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 quasar3c279 over 15 years ago in reply to BrucekConvergent

Yes, this are commtouch RBLs. Further info here:
How GlobalView Mail Reputation Works | Commtouch - Messaging and Web Security Technology

You can check the blocked IPs here:
Check IP Reputation | Commtouch - Messaging and Web Security Technology

Just checked the failed web.de address an got an low risk status.

Besides the problem with public email services this service has been very effective for our spam detection.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Billybob over 15 years ago in reply to BrucekConvergent

I take it these are CommTouch RBLs? Just curious.

Maybe the problem is broken integration of the ctipd RBLs but yahoo and hotmail IPs are low risk in commtouch.[:(]

This RBL is not controlled by astaro.

Thats good to know. Only thing is astaro is putting its name on it which is not necessarily a good thing.

I am sure it will all work out in the end. Afterall we all hate spam[;)]
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel