Hacker News Reader

Comment by huhtenberg | Hacker News Reader

> Or I can leave the current hosting company

Yep, that's the one.

If your hoster doesn't care about spam spreading from their IP space, you should take your mail server elsewhere. There's literally nothing to think about.

And if they do care about this issue, they are likely to be taking steps to remove any of their IP space from the blacklists, without being nudged.

PS.

I've been running a mail server for close to 20 years now and I do blacklist by /24 netblock on the second offense. This doesn't bounce emails though, just tags them as spam. So I had a quick look in the logs and Hetzner, Digital Ocean, OVH and LeaseWeb are all spamming a lot. LayerHost, Colo Crossing, Liquid Web, Host Winds and Servion are also close to the top. Anecdotal data, obviously, so caveat emptor and all that.

View on HN

I have run my own mail server about as long, run an RBL, and a transactional mail service too. This is a hard line approach and blacklisting a /24 on a second offense that never expires just doesn't work long term but at least you are not completely blocking it and accepting it but as spam.

Lets be real there is spam coming from gmail and hotmail/outlook as well and places like abuseix specifically state they don't block these ranges. So the large providers get excused for clean up because they are too big. Sure blocking colo crossing probably won't get any one to complain, but Digital Ocean is probably going to get some collateral damage. For your own mail server fine, don't accept it, send to spam - but there is a reason real RBL lists are very careful to skip the big providers or make sure they expire. Spamcop always had the best method - expire when the spam stops. Does it keep getting listing? Keep it longer. Rspamd also has a good method where an RBL increases the score. The hard line approach gives gmail and microsoft a large share of the email market and hurts smaller providers when they are not held to the same standards as everyone else. If gmail emails start bouncing when they have a heavy spam hit, then maybe gmail users will change isps and help gmail clean up. These are two trillion dollar companies that also have spam problems.

As far as UCEprotect. Their level1 is actually reasonable, especially for spam traps. The timestamps easily allow for you to find exactly what the spam is from with the smtp response and time frame. Their scanning methods are less so. Dos prevention measures can get you listed there and are not valid. The level2/3 lists are utter shit.

I think the issue is that, short of customers running their own BGP routers and hosting their own subnet, anything smaller than a /24 assigned by the ISP is completely transparent to BGP databases and thus spam filters / IP reputation databases.

Any hosting company where some random person can buy a VM for $5 on a credit card has this problem. Mostly I feel sorry for the support and staff at the hosting companies who do not have the time/manpower/resources to deal with it properly, and this is an intentional business decision by the people who own and run the companies.

It's a race to scraping the bottom of the barrel on per customer profit margin and pricing.

When I first started monitoring spam connections years ago, it was almost always home cable+internet providers. They seem to have gotten the message and cleaned up thier acts.

As of last night, the number one source of spam for both the personal and company servers I maintain is Digital Ocean.

Which is a shame, because otherwise I'm a happy Digital Ocean customer. But because of this, I would never move any of my commercial projects there.

> home cable+internet providers. They seem to have gotten the message and cleaned up thier acts.

By blocking outbound connection to port 25 outright. I don't want my VPS hosting company to "clean up" this way.

> I don't want my VPS hosting company to "clean up" this way.

Most ISPs submit their domestic ranges voluntarily to certain blocklists, e.g. the Spamhaus PBL.

I used to have a bunch of blocklist services in my MTA configuration, with different lists having different weights and so on. Eventually it became clear to me that nearly all true spam that hit any one list would also hit Spamhaus Zen. So I scrapped my list of lists, and relied entirely on Zen. My life became easier.

Note: Zen includes the PBL; so if you block using Zen, then you will block mail from domestic ranges. Zen is pretty safe (unless you are expecting mail from domestic ranges). It's safest to use Zen as part of a scoring system, with something like Spamassassin to add heuristic content scoring.

I'm not sure that home IPs have cleaned up their act, I think it is that no large email host accepts their email any longer so spammers have stopped sending from there.

I have a similar experience: Some hosting providers / AS host shady stuff and I understand that VPS ranges end up on block lists quite easily.

I only block AS 4134 and AS 4837, some AS that host services like shodan, and aggressive crawlers like semrush.

Anything that sends packets to my server get ratelimited quickly. Still barely noticeable for occasional human interaction. I also started with /24, but I am now up to /12.

PS. By the way, has anyone ever seen spameri@tiscali.it in the logs? It shows up almost on a weekly basis as RCPT TO address from literally all over the world.

> By the way, has anyone ever seen spameri@tiscali.it in the logs? It shows up almost on a weekly basis as RCPT TO address from literally all over the world.

Yes, I see it all the time in my logs.

>/24 netblock on the second offense.

That seems excessive and abusive, I am not aware of any commercial ISP that is giving out /24 anymore. /29 is most common, I had to practically beg to get a /28 so what is the justification for banning an /24???

Block registers don't deal with "justification".

If they did, what would be Google's justification for blocking senders that send too few emails?

I wish I knew. I have a user google keeps blocking for spam (not even marking, outright blocking) while at the same time their reporting tool say the user doesn't send enough e-mail to google for any data to be displayed (the user's domain generates less than ten e-mails per day, many/most of which not to google).

> That seems excessive and abusive

Good thing it's my own mail server then, isn't it?

The practical reason is that virtually all Whois lookups of offending IPs return blocks of /24 or larger, so that's a reasonable default. Besides, as I said, this doesn't result in a "ban", just tags emails as spam and passes them through. At my scale an occasional false positive is not a big deal.

Reply on news.ycombinator.com