Home page logo

nanog logo nanog mailing list archives

Re: Cisco Ironport and Senderbase...how to get delisted?
From: up () 3 am
Date: Wed, 17 Aug 2011 19:40:05 -0400

Thanks for the tip (BTW, top-post haters, I didn't start it!).  I was quickly
delisted by SpamCop, but here is their response:

Once all spam issues have been addressed, **reputation recovery can take anywhere
from a few hours to __just over one week__ to improve**, depending on the specifics
of the situation, and how much email volume the IP sends. Complaint ratios determine
the amount of risk for receiving mail from an IP, so logically, reputation improves
as the ratio of legitimate mails increases with respect to the number of complaints.

Speeding up the process is not really possible. SenderBase Reputation is an
automated system over which we have very little manual influence.

Mailflow policy is the sole domain and responsibility of the recipient;SenderBase
has no control over how passive or aggressive Cisco-IronPort customers choose to be
when implementing SenderBase reputation information.

While the reputation is improving, we suggest contacting domains which are rejecting
or throttling mail from the IP, and request they whitelist the IP temporarily.

-SenderBase Support

In sort, wait...  Once you're de-listed from SpamCop (which is owned by
IronPort and plays a non-trivial part in their SenderBase scoring) you
should find that your reputation increases fairly quickly - normally within
24 hours presuming that the spam has actually stopped.


On Wed, Aug 17, 2011 at 1:57 PM, <up () 3 am> wrote:

We had two users fall for a phishing email recently, and of course the
result was
that he gave his user/pass to a spammer.  We caught one of them in time,
but the
other got out many thousands of spam the other night before being

I am in the process of cleaning this up.  Spamcop and others were good
delisting us promptly.  Others will within the next day.

However, "Senderbase", apparently used in Cisco's Ironport, will let you
look up
your IP and tell you that your reputation is "poor", but offers no way to
delisted.  It refers you to Spamcop, which I imagine they rely on for
but not delistings.

For now, I'm re--routing per domain to a second server, but I'd appreciate
tips if there are any.  Seems a lot of .edu's use senderbase.

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]