How to disable Backscatter - get delisted from backscatterer.org

Go to this link

http://www.backscatterer.org/?target=test

Put your external ip address here and test. This will force a manual check on your ip. If everything is okay, you should be delisted after awhile

Testresult for xxx.xxx.xxx.xxx:

This IP IS CURRENTLY LISTED in our Database.
Please note that this listing does not mean you are a spammer, it means your mailsystem is either poorly configured or it is using abusive techniques.
If you don't know what BACKSCATTER or Sender Callouts are, click the links above to get clue how to stop that kind of abuse.


To track down what happened investigate your smtplogs near 07.09.2009 16:10 CEST +/-10 minutes.

You will either find that your system tried to send bounces or autoresponders to claimed but in reality faked senders, or your system tried sender verify callouts against our members near that time.

So you should look for outgoing emails that have a NULL SENDER or POSTMASTER in MAIL FROM and which got rejected at remote systems.

Read the rejection texts carefully and it shouldn't be a big deal to figure out what caused or renewed your listing.


History:09.05.2008 21:30 CEST listed  
06.06.2008 22:30 CEST expired  
25.11.2008 01:20 CET listed  
23.12.2008 02:00 CET expired  
08.02.2009 09:00 CET listed  
31.08.2009 20:30 CEST delisted 109 Impacts were seen while it was listed.  
07.09.2009 16:10 CEST listed  

A total of 1 Impacts were detected during this listing. Last was 07.09.2009 16:10 CEST +/- 10 minutes.
Earliest date this IP can expire is 05.10.2009 16:10 CEST.

 


--------------------------------------------------------------------------------

This IP is temporary listed.
The listing will expire automatically and free of charge 4 weeks after the last abuse is seen from that IP.
Expedited manual expressdelisting is available as an option if you do not want to wait for the automatic and free expiration.
You will be charged 50 Euro's using one of the following payment services.
WARNING: Before requesting expressdelisting make sure the problem which caused the listing is fixed, otherwise you are at risk to get listed again if new abuse becomes known.







Also - I didn't have smtplogs logging enabled at that time so there was nothing to check.  

I've also checked my firewall traffic monitor and this is the entries that are coming back:

2009-09-17 17:06:33 proxy[1966] 1:1253221593: smtp response '421 mail.mydomain.com has refused your connection as your mail server appears to be blacklisted\x0d\x0a' msg_id="1B03-0211"       Debug

Turn on Recipient Filtering (if it is not already) to drop messages destined for invalid recipients:

http://www.msexchange.org/tutorials/Sender-Recipient-Filtering.html

Also - check your IP on www.mxtoolbox.com/blacklists.aspx to see if you have popped up elsewhere.

What are you using for Spam filtering?

Receipient Filtering is turned on and tar pitting has been enabled.  I have restarted the SMTP Service after that.  (This was done earlier today, but I did just verfy the configuration)  The exchange server has not been rebooted.

Results from mxtoolbox:
Backscatter.org  LISTED Sorry 68.248.135.132 is blacklisted at Detail
Return codes were: 127.0.0.2 2100 140

For spam filtering I am using Surf Control - Email Filter.

Sender filtering has not been enabled.

we are able to send emails out but we can not receive any from the outside world.

in regards to enabling the tar pitting function, how well does that protect from directory harvest attacks?

The recipient filtering needs to be done by whatever is accepting email from the internet. If that is Surf Control then that product needs to it. Doing it on Exchange is too late and will cause back scatter.
You need to reject the email at the point of delivery, at the edge.

If Surf Control cannot do recipient validation then you will have to put something in front of it that can.

Simon.

I wasn't able to find any place to do this within surf control.  Is there a way to just add all of our users to a whitelist and have all of the other emails go into a folder that eventually gets deleted?  Would we still get NDR's if that was the case?

Or do you have any other ideas on something else that would do what you mentioned?