How to tackle a Blacklisted IP ?

[MrWu]

Hi all

 

I have been using a SMTP server to relay emails for Copiers, finance server noticfactions etc, working absolutely fine for years, even after changing to schools broadband last August

 

Past 2 days I have been recieving NDRs on the error logs, indicating:

 

Status: 5.7.1

Diagnostic-Code: smtp;550 5.7.1 Service unavailable, Client host [85.92.XXX.XXX] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/85.92.XXX.XXX AS(1440) [AM5EUR0xxxxx.eop-EUR03.prod.protection.outlook.com]

 

Now I delisted this this morning, and after 4pm, was blacklisted on SBL again

 

My SMTP relay server only allows certain IP addressses to relay, and I have cleaned this up since the blacklist also to discount any potential PCs getting infected.

 

Sending through Outlook 365, Outlook clients absolutely fine (I think this sent out via a different external IP address though, so just copier scan docs and notfiactions fom servers dont work.

 

Whre else could I look? I have asked my SB to see if there is any unsual traffic coming out of my site, also should I also tell them to stop anything from Port 25 on the Firewall level bar just my servers and copiers I have on my SMTP relay list?

 

thanks as always!

[Guest Guest]

Is your relay on prem? If so i'd get them to block access to port 25 as communication between the relay and O365 shouldn't be on 25 Edited January 15, 2020 by Guest

[MrWu]

Is your relay on prem? If so i'd get them to block access to port 25 apart from the relay server

 

Yes, Relay is on Prem, and good call with blocking access to 25 on prem.

 

I have removed any unecessary server IPs from the on prem relay server itself, but will call them to block 25 globally on the firewall as well

[SchoolsBroadband]

Hi @MrWu sounds like a plan.

 

Remember if you're a secondary school you can also logon to your firewall and make this change yourself too although we're still happy to do it

[MrWu]

Hi @MrWu sounds like a plan.

 

Remember if you're a secondary school you can also logon to your firewall and make this change yourself too although we're still happy to do it ��

 

Oh ! Did not know that, would love to have a play... will call tomorrow !