today I found that my server is (was) blacklisted due to "spam" (which is not the case) or trojan (which is not the case) or misconfiguration of smtp server.
How to exactly chechk what they are atlking about??
This is the answer that I received from http://cbl.abuseat.org
(After I complained they removed me from their blacklist, but I would like to prevent such cases, especially becuse besides my IP is smell network, not single machine)
Which config files shuld I check to see if there is a problem with "localhost.localdomain" as HELLO string?
The IP 220.127.116.11 was detected most recently at:
2006:07:02 ~02:00 UTC+/- 15 minutes
sending email in such a way as to strongly indicate that the IP itself
was operating an open http or socks proxy, or a trojan spam package.
You will need to examine the machine for a spam trojan or open
proxy. Up-to-date anti-virus tools are essential.
If the IP is a NAT firewall, we strongly recommend configuring the
firewall to prevent machines on your network connecting to the Internet
on port 25, except for machines that are supposed to be mail servers.
Note: 18.104.22.168 was found to be using the following name during
Which is an illegal name according to the RFC2821 SMTP mail
protocol standards. RFC2821 requires that the machines claim names
that are a fully qualified domain names or IP addresses enclosed
in square brackets.
You will need to investigate why this is happening, and stop it from
This is usually a spamware/trojan infection. In the off chance
that it isn't, we recommend you examine your mail server configuration
and ensure that your mail server is using an appropriate domain name.
One way of testing whether your mail server is misconfigured
is to send an email through it to firstname.lastname@example.org. You will
get a virtually immediate rejection. Examine the error message,
and you should see something like:
#5.1.1 SMTP; 550 Your HELO name for IP address 22.214.171.124 was "smtp"
It should be the fully qualified domain name for your mail server.
Like "mail.example.com". If it's localhost.domain, or things without
".", this is what you need to fix.
Variations on "localhost" at best suggest that you're running
relatively old mail server software that hasn't been configured.
Apparently old versions of sendmail (particularly those on Linux),
and the Perl Net::SMTP module default to this value, and need
to be configured properly.
Information on configuring sendmail can be found here:
More information on these detections can be found here:
Apparently the "MXLookup" plugin for SpamPal helos as localhost.
Turn it off until you can get a fixed version. It is unknown
as yet whether a fixed version is available.
The Perl "CheckUser" module
defaults to improper "HELO" and "MAIL FROM" strings: "localhost.localdomain"
and "email@example.com" respectively. The former is illegal, the latter
impersonates user.com - they probably don't like that. [Besides, by not
using your own domain, some spam filters will lie to your RCPT TO.]
You will need to change $Helo_Domain = to be "<DNS name of your server>"
and change $Sender_Addr to be something in _your_ domain (ie: "check@<mydomain>").
If you're using fetchmail: older versions of fetchmail almost always
use "localhost". The latest version (as of 2006/02/22 is 6.3.2) will
use "localhost" if the gethostname() function fails. You should upgrade
to the latest version, and make sure that gethostname() returns the
fully qualified domain name of your machine - which will probably
involve mucking about with /etc/hosts and sethostname/setdomainname.
If all else fails, hack the source.
If you're running Smartmax Mailmax, please let us know.
http://spamlinks.net (see "Securing your System" and "proxies")
For more information on securing NAT firewalls/gateways, please
I've removed the entry from the list.
It may take a few hours to propogate to the public nameservers.
WARNING: the CBL WILL relist this IP if the underlying issues are not
resolved, and the CBL detects the same thing again.
-- Jay, CBL Team
As far as I understand those things my server has valid HELLO string, or it does't ?
Reporting-MTA: dns; server201.web-hosting.co.yu
X-Postfix-Sender: rfc822; firstname.lastname@example.org
Arrival-Date: Sun, 9 Jul 2006 03:19:30 +0200 (CEST)
Final-Recipient: rfc822; email@example.com
Diagnostic-Code: X-Postfix; host mail.cbl.abuseat.org[126.96.36.199] said:
550-Your HELO name for IP address 188.8.131.52 was 550
"server201.web-hosting.co.yu" (in reply to RCPT TO command)