SORBS

[ATNotts]

I have just spent hours this week trying to free up e-mail communication between my office and our parent company in Germany, whose ISP is Arcor.

It seems an organisation called SORBS - based in the Netherlands has arbitarily blocked communication from what we thought was a static IP address and their clients.

Checking their website and google-searching it looks as though it's an arrogant geek who has set himself up hiding behind a fairly childish homepage to police spam mails. Thats very laudible, but when it results in international commerce being screwed up it's almost bordering on cyber terrorism.

Has anyone else come accross this organisation, and how have you managed to deal with them? Were you successful in getting your IP address unblocked?

[Saab Dastard]

I know nothing of your organisation, and all I know about SORBS is what I have gleaned from their website. I will not comment on the rights or wrongs of the situation, just the technical aspects

I would hazard from the little information that you have provided that you have your own email server.

It appears that email communication between your server and the destination email server in the parent company is being blocked by an intermediate mail relay server because that intermediate subscribes to SORBS.

There will be at least 4 mail servers in the chain - yours, your ISP, the German ISP and the Parent email server. There may well be more.

It is unlikely to be the Parent email server that is blocking you, and I'm sure that your ISP would have alerted you if they were blocking you, so the probability is that the German ISP is the SORBS subscriber - or else an additional intermediate relay server.

It would appear unlikely that it is an arbitrary block, it could be because your email server (or your ISP's mail relay) is incorrectly configured and is vulnerable to mail relay abuse, and as such the SORBS-enabled intermediary has blocked your email. I would have to say that the balance of probability is that it is your email server.

Assuming that you have control over your own email server, then you should check and re-check your server configuration (or hire someone to do so). Then request a re-test from SORBS. If you don't host your own email server, then it is up to your ISP to sort it out.

An alternative strategy might be to set up a VPN between your office and the Parent office. That would give you a number of options - for example, you could directly connect an email server to the Parent system, keeping your existing email server to connect to the rest of the world, or dispense with the existing email server and route all your email via the Parent system etc. etc.

SD

[ATNotts]

Thanks for that.

The curious thing is that no other businesses that we are e-mailing with has caused us any problems.

Having exhausted our own (very limited) expertise we turned to our IT Support Company - and they too couldn't sort it out. The best suggestion we had is to pay for a Static IP address for our e-mails. But then another advisor suggested this may also not be immune to organisations such as SORBS blocking us.

The VPN idea sound interesting. I will explore that with said IT Support guys.

Thanks again

[Saab Dastard]

The curious thing is that no other businesses that we are e-mailing with has caused us any problems

Not really - the block only occurs between you and parent company, so the blockage must be in that chain. If it isn't your ISP then it must be nearer to the parent. So as long as you do not email anyone who shares the same ISP or upstream mail relay as the parent then you won't have problems - unless they start to subscribe to SORBS.

Static IP address for our e-mails - this wouldn't help, as your email MX records and mail server will be addressed by name, not IP address. The blocking is done by name, not by IP address. So if you change IP address and keep the same domain name, you will not have changed anything!

You would need to change domain name AND IP address!

And unless you address the reasons WHY you are being blocked, the new name would probably also get blocked.

I assume that you have discussed this with the Parent?

Cheers

SD

[Gertrude the Wombat]

The best suggestion we had is to pay for a Static IP address for our e-mails.
The best suggestion is probably to stop your sever sending out spam.

There are lots of blacklists out there, and if your server is sending out spam you'll end up on all of them in due course, regardless of whether you have a static or dynamic IP address. And the longer your server is spewing out spam the harder it will be to get off the blacklists once you've fixed it.

It might not be that your mail server is misconfigured, to be an open relay or in any other way. It might be that one or more machines in your office has been turned into a zombie and is spewing out spam via your perfectly corrrectly configured mail server.

"One of the machines in your office" could of course be a laptop that was plugged in to your network temporarily ... or, if your office has a wireless network that isn't properly secured, "one of the machines in your office" could in fact be a laptop in a passing car.

[Saab Dastard]

GtW,

It might be that one or more machines in your office has been turned into a zombie and is spewing out spam via your perfectly corrrectly configured mail server.

"One of the machines in your office" could of course be a laptop that was plugged in to your network temporarily ... or, if your office has a wireless network that isn't properly secured, "one of the machines in your office" could in fact be a laptop in a passing car.

What you say is possible, but not applicable in this case, I think - as I understand it, SORBS feeder servers ONLY check the configuration of the Mail relay host attempting to connect to them, not the email sent to them.

SD

[Keef]

SORBS is one I know. It doesn't do any filtering in its own right, it just provides its database to subscribers. I've had stuff "blocked" by it: it's probably the most aggressive of the bunch.

However, to get yourself listed on SORBS, there must have been something to cause that - Spam, or an open relay, or who knows what.

When it happened to me, my ISP found that the cause was ONE subscriber on the ISP who had done something silly (but quite a lot of it). It was sorted and the problem went away.

I'd start with your ISP. In theory, they should care!

[Tarq57]

I've come across this :mad: outfit. You don't necessarilly have had to be a spammer (or other config. problem) to be blocked.
I'm not on a network, private email address, single computer, not spamming, all security software functional and effective. No problems with emails to almost anywhere, anyone, anytime.
Had several emails to one friend returned - unable to be delivered, SORBS blocked them, (Ironically for a while I was able to contact the recipient via my Hotmail acct., but not always.)
So I contacted SORBS with the particular ref # supplied, to be told that because one computer with my ISP's host address had sent spam, no-one from that ISP could get through to the destination ISP, as they had (hired?) SORBS to block all spam. So I replied, explaining the situation, and their reply was I should sort it out with my ISP; they being the "guilty" party, for allowing spam. My own ISP, whilst sympathetic, refused to do business with SORBS because (in a nutshell) it was percieved the way they did business amounted to cyber-blackmail. Catch22.:ugh:
End result? My friend, who had had a considerable number of valid emails blocked, and unable to get satisfaction from his ISP, changed ISP's to one who doesn't use SORBS.
All happy.:)

Edit PS; Sorbs charges $50 (or did) as a one off payment to have your address de-listed from their database.