How to remove my IP from the RBL (Realtime Black List)??

kstinius

Somehow our Spectrum IP address has been added to the RBL (Realtime Black List). My wife and I use the Outlook 2010 client on our Windows 10 PCs with POP and SMTP to read and send email on our Earthlink (Mindspring) accounts. We each send 2 to 10 emails per day to single recipients, nothing remotely approaching spam-level abuse. Our Spectrum IP address has been designated a spam abuser and was added to the RBL (Realtime Black List). This was confirmed by Earthlink's tech support. As a result, messages we try to send languish in the Outbox for hours and days.

When I enabled logging on our Outlook clients I found this:

1. 2022.01.28 15:26:15 <removed by moderator> SVPOA BOD: Synch operation started (flags = 00000001)
2. 2022.01.28 15:26:15 <removed by moderator> SVPOA BOD: UploadItems: 1 messages to send
3. 2022.01.28 15:26:15 SMTP (smtpauth.earthlink.net): Begin execution
4. 2022.01.28 15:26:15 SMTP (smtpauth.earthlink.net): Port: 587, Secure: Auto, SPA: no
5. 2022.01.28 15:26:15 SMTP (smtpauth.earthlink.net): Finding host
6. 2022.01.28 15:26:15 SMTP (smtpauth.earthlink.net): Connecting to host
7. 2022.01.28 15:26:15 SMTP (smtpauth.earthlink.net): Connected to host                  
8. 2022.01.28 15:26:15 SMTP (smtpauth.earthlink.net): <rx> 550 5.7.1 Connection refused - OXSUS003_101 - https://postmaster-oxsus.vadesecure.com/#OXSUS003_101
9. 2022.01.28 15:26:15 SMTP (smtpauth.earthlink.net): End execution
10. 2022.01.28 15:26:15 <removed by moderator> SVPOA BOD: ReportStatus: RSF_COMPLETED, hr = 0x800ccc69
11. 2022.01.28 15:26:15 <removed by moderator> SVPOA BOD: Synch operation completed

Note: "<removed by moderator> SVPOA BOD" is the name of the email account, <removed by moderator>.

Apparently Spectrum has enlisted Vade Secure to monitor and block suspected spam abusers. Earthlink tech support has washed their hands of this problem, it is apparently all Spectrum's responsibility.

1. How did we get on the RBL?
2. How can we get our IP removed from the RBL so we can send email? I hope the solution doesn't involve money or dead cats in a cemetery at midnight.

Thanks and regards,

William_M

Hi @kstinius !

I'm not seeing any problems with your IP. The only blacklists I see are for Spamhaus and SORBS which are standard for the majority of internet users, myself included. These should only cause an issue if you are trying to run your own mail server.

Information on the error you are receiving is available here; Fix email delivery issues for error code 550 5.7.1 in Exchange Online

Are you unable to send emails to any recipient at all, including between you and your wife? The error indicates it could be an issue on the recipients end.

Are you able to send emails through webmail instead of Outlook?

Can you send emails through Outlook when connected to a network other than your home Spectrum internet?

kstinius

Hello William_M,

Thank you for your immediate response.

I use an email client, Outlook 2010 (Version 14.0.7268.500), and the POP and SMTP protocols to access my mailboxes on mindpring.com (earthlink.net).

This configuration has been functioning properly for more than 15 years.

Currently, when I try to send a message, regardless whether the recipient is on mindspring/earthlink or some external address, I get the SMTP error "550 5.7.1 Connection refused - OXSUS003_101 - https://postmaster-oxsus.vadesecure.com/#OXSUS003_101".

I have enabled logging in Outlook and here are the relevant lines from the log (with the timestamp removed):

"xxx@mindspring.com: Synch operation started (flags = 00000001)

xxx@mindspring.com: UploadItems: 1 messages to send

SMTP (smtpauth.earthlink.net): Begin execution

SMTP (smtpauth.earthlink.net): Port: 587, Secure: no, SPA: no

SMTP (smtpauth.earthlink.net): Finding host

SMTP (smtpauth.earthlink.net): Connecting to host

SMTP (smtpauth.earthlink.net): Connected to host

SMTP (smtpauth.earthlink.net): <rx> 550 5.7.1 Connection refused - OXSUS003_101 - https://postmaster-oxsus.vadesecure.com/#OXSUS003_101

SMTP (smtpauth.earthlink.net): End execution

xxx@mindspring.com: ReportStatus: RSF_COMPLETED, hr = 0x800ccc69

xxx@mindspring.com: Synch operation completed"

When I follow the link in the error message to postmaster-oxsus.secure.com, I see this information:

"OXSUS00X_101

550 5.7.1 Connection refused

We could not accept your email because your email provider is listed on the Vade Secure Threat Network list.

This list contains IP addresses which have been identified as sending spam. 

We use this list to protect our subscribers from receiving spam".

To be clear, I do not send spam. My wife and I send 2 to 10 messages each per day, mainly to single recipients. If anything has been done from our IP address to trigger being blacklisted, it is unintentional and without our knowledge. I don't know anyone else with a mailbox at Earthlink to ask whether they are having the same problem.

To verify the refused connection, I tried two other email clients, as well.

Using BlueMail (Version 1.1.122-3.1.98-72 Build 12574) to send to mindspring.com and gmail.com (in two separate messages):

"Send Failure

Could not send the message to one of the recipients.

Invalid greeting: Connection refused - OXSUS003_101 - https://postmaster-oxsus.vadesecure.com/#OXSUS003_101"

Using Mozilla Thunderbird (91.5.1 (64-bit)), likewise to send to mindspring.com and gmail.com (in two separate messages):

"Send Message Error

Sending of the message failed.

An error occurred while sending mail: Outgoing server (SMTP) error. The server responded:

Connection refused - OXSUS003_101 - https://postmaster-oxsus.vadesecure.com/#OXSUS003_101"

From the Earthlink webmail interface, I can send to my own mindspring.com address and I can send to an external recipient at gmail.com with no problems.

Finally, the link you provided to Microsoft is about Exchange Online and Exchange Server. Of course, I have no access to the email server at Earthlink - I don't even know what email server software is in use.

William_M, I appreciate your time and attention. Please let me know what additional steps I can take to solve this problem. Our ability to send from Outlook has been blocked since last week

Thanks and regards,

kstinius

More information:

I just sent an email from the mail client on my Android phone using mobile data, not my home LAN, so the client was using a different IP address, not the one that is being blocked. The message was addressed to my mindspring account. went right through and was received.

I repeated the test and was able to send to a gmail address.

Regards,

Steph_S

Good Morning! Are you able to send via our Webmail to see if the messages send?

kstinius

Steph_S,

yes, sending from the *EarthLink* Webmail interface/site works fine because then I am already on the mail server and the SMTP protocol is not being used.

I do not have an email account on Spectrum/Roadrunner's Webmail system, so that is not the issue.

Steph_S

Understood, thank you. With you being able to send fine via Earthlink's webmail this sounds like an issue within Outlook itself. At this time I would contact Earthlink to see if they can assist you with verifying the server info as well as troubleshoot this further. In the meantime I can suggest using Earthlink's Webmail page to send/receive your mail.

kstinius

Steph_S, the problem is not with Outlook specifically, it is with the Vade Secure Threat Network black list protecting the SMTP mail server at Earthlink which is blocking my IP address. As I noted above, I can reproduce the problem also with BlueMail and Mozilla Thunderbird, email clients which both use the SMTP protocol to send messages.

When I contacted to Earthlink support, they said I had to talk to my ISP, Spectrum, but that only makes sense if Spectrum (you) run the SMTP server and the anti-spam service. Is that true?

How do I get my IP address removed from the Vade Secure Threat Network black list?

I think I need to go back to Earthlink support and get them to investigate.

I also may try to shut down my cable modem and router for 30 to 60 minutes, power up again and see whether Spectrum's DHCP will give me a new, different IP address, which is not blocked.

Thank you for your assistance and please let me know whether Spectrum (you) can remove my IP from the black list.

Regards,

kstinius

Hello again, I just chatted with the Earthlink Support and they said because Spectrum provides the IP address, Spectrum is responsible for adding it to or removing it from the Vade Secure Threat Network black list.

Please help me get my IP address removed from the black list so I can use email properly, or tell me how to get it removed if I have to contact someone else.

Thanks,

James_M

I am not aware that we use Vade. A quick Google search yields that Vade is the security tool used by Microsoft 365. There was a link on the page https://www.spamresource.com/2020/06/what-is-vade-threat-list-how-do-i.html.

To request removal from the Vade Threat List, visit abuse.vadesecure.com and fill out the form

It is likely that your message (and subsequent IP) was either flagged or marked as spam, either accidentally or intentionally. Contacting Vade directly would likely be a good starting place.

kstinius

Hello James_M,

I am not using Microsoft 365, rather Outlook 2010 on a Windows 10 PC with POP and SMTP to send and retrieve email. The Outlook/Windows configuration has been working properly and well for more than 15 years. Somehow the IP address assigned to me by Spectrum has been added to a black list.

A link to VadeSecure appears in the 550 error message returned when I try to send an email via Earthlink's SMTP relay, smtpauth.earthlink.net. This is from the Outlook log file when I try to send a single message:

xxx@mindspring.com: Synch operation started (flags = 00000001)

xxx@mindspring.com: UploadItems: 1 messages to send

SMTP (smtpauth.earthlink.net): Begin execution

SMTP (smtpauth.earthlink.net): Port: 587, Secure: no, SPA: no

SMTP (smtpauth.earthlink.net): Finding host

SMTP (smtpauth.earthlink.net): Connecting to host

SMTP (smtpauth.earthlink.net): Connected to host

SMTP (smtpauth.earthlink.net): <rx> 550 5.7.1 Connection refused

- OXSUS003_101 - https://postmaster-oxsus.vadesecure.com/#OXSUS003_101

SMTP (smtpauth.earthlink.net): End execution

xxx@mindspring.com: ReportStatus: RSF_COMPLETED, hr = 0x800ccc69

xxx@mindspring.com: Synch operation completed

Following the VadeSecure link informs me:

OXSUS00X_101 - 550 5.7.1 Connection refused - We could not accept your email because your email provider is listed on the Vade Secure Threat Network list. This list contains IP addresses which have been identified as sending spam. We use this list to protect our subscribers from receiving spam.

Following the link to abuse.vadesecure.com takes me to https://sendertool.vadesecure.com/en/, where I am instructed:

This interface allows message senders to report what they believe to be false positives generated by our tools.

To request a review, we need to make sure that you are the author of the concerned messages.

To do so, you must follow a few steps:

  1. Create an account using a business email and choose double opt-in authentication.

  2. Link all the IPS you use to your account and choose an authentication based on the addresses in Whois.

  3. Create a request on one of the verified IPs of your account.

Note: I do not have a business email address, I am a retired, "civilian", private customer of Spectrum and Earthlink. I would not know how to create an email with double opt-in authentication. My only IP address is the one assigned to me by Spectrum. I don't know what "choose an authentication based on the addresses in Whois" means. Finally, as a customer of Spectrum and Earthlink, I don't think it should be my responsibility to deal with VadeSecure. I am a customer and I would like to be able to use a service made available through my subscriptions with Spectrum and Earthlink.

My wife and I have been customers of Earthlink since the early 1990s and Spectrum since 2012.

Please help us solve this problem.

Regards,

James_M

I can understand this is frustrating. To clarify our scope of support, we support Spectrum email issues. Your issue is with Earthlink email. While we can often assist with suggestions, we can only guide you to answers that may be useful in your individual situation. We do not have a direct solution for this specific problem. In this situation, we provide the internet signal. Since it works for sending email under some conditions, the internet signal provided by Spectrum is eliminated as a source of the issue.

The error code you reported is:

550 5.7.1 Connection refused

We could not accept your email because your email provider is listed on the Vade Secure Threat Network list.

This suggests that issue is with the email or email provider (Earthlink). Since you reported you can send emails through Earthlink webmail, but not the email client then there is likely an issue with email client or the device you are using. I've included a link to Why Is My IP Blacklisted, which also includes a link to IP Address Blacklist Check. I was able to locate your IP address and checked it against the blacklist, and I am not seeing the IP address blacklisted. I would invite you to check your IP address as well.

Another possibility is that the email recipient has either marked your email as spam, blocked your email, or there is another triggering event such as malware or a virus on the device you are using that is either being identified by the security software or has been attached to the email, resulting in the email being rejected. This would also explain why you can send emails using a mobile device without error as well as why the issue has occurred suddenly.

I hope these suggestions are helpful in your ongoing investigation. Let us know if you have additional questions, and please let us know if you are able to identify the source of the issue.

kstinius

Back now, after almost two weeks. I finally reached a comprehending and understanding tech at Earthlink who escalated the problem to his Level 2 support. A few hours later the SMTP connection was no longer blacklisted and I was able to resume email activities. To Earthlink’s credit, the next day I received a phone call checking whether the problem had been solved and whether they could close the ticket. The tech could not tell me specifically what had been done, but I assume they were able to remove my IP or the domain from the blacklist in question.

Several blacklist reporting sites tell me my IP is still on blacklists; it may be the Earthlink domain, but at least it doesn’t prevent me from sending email.

Thanks for all the comments here. As the IP address is issued by Spectrum and the SMTP relay is managed by Earthlink it wasn’t clear who would be responsible for removing my address from the blacklist.

Randy_S

We are very glad to hear the issue has been resolved. Thank you for taking the time to let us know.

Randy