I've been with a large and, until now, very helpful hosting company for over 7 years and have 4 separate accounts with them (one a reseller account). I've always received great support but recently I had the strangest thing occur.

One of my clients (who shall remain brainless oops nameless) kept exceeding the max emails that may be sent via the hosts smtp server (despite numerous warnings). After 3 IP blocks the host finally blocked their IP for good (understandably) and we set them up on an external smtp last week.

That's all well and good but...

Suddenly I couldn't send emails from my home or my office - a single IP had been blocked and zapped my ability to smtp out through the host. Here is the weird part: the email address they say was spamming from my IP was the same client we just moved to external smtp!!

This client is 10 miles away from us and has nothing to do with our business except we built their web site and provide hosting. I'm in Costa Rica where the ISP is a monopoly...

What in the heck happened?

Any help/advice would be greatly appreciated...

My suggestion would be that your ISP uses dynamic IP addressing, and therefore each time you connect then you get a different IP address?

If that's correct, then it's entirely possible that the IP you tried to email from (i.e. were connected with) is the one that your "nameless" customer used before and ended up blacklisted etc.

Otherwise, it sounds like your ISP blocked more than a single IP address?

My question would be - why did you set them up with an external SMTP server if they've abused "your" service and caused all these problems? Unless this SMTP is somehow more appropriate for their mailing needs, won't the same issue occur again?

Thanks for the reply Damien.

Actually we resell hosting and the provider has a limit of xx of emails that can be sent in one hit (50). The new SMTP setup is with a different provider and totally separate from our current host provider so the problem is definitely zapped for good but I could not figure out how we were suddenly tied to the spamming customers IP. I think it may be one of 2 things:

a) Dynamic IP's that somehow got assigned to us just after the block.
b) Clerica error on the part of the hosting provider.

I'm guessing b)

I really wouldn't know whether it was (a) or (b) - although I'm not sure whether it's good that you expect it to be your provider's fault as the most likely cause..!

Anyway, another thought came to mind... why did they block the IP rather than their user?

I'm assuming that you have to authenticate via mailbox user/password in order to send mails via your SMTP (i.e. to avoid open spam relay scenario), and therefore blocking the user rather than the IP is probably more reliable (since IP may be dynamic or otherwise easily bypassed via proxy etc).

Have you check your IP against SPAM Blacklist providers? Check in Spamhaus.org to make sure your Ip is not in their list.

Most of hosting provider will using this lists to reduce SPAM or attack.

That kinda makes sense because if it's a reseller account all of your hosted domains share the same IP. SMTP uses the server IP to connect with the outgoing mail connections, and when they block the IP, that will in turn block all of the domains on that IP.

Solution? I'm not really sure about that. Maybe see if the parent host can lift the ban and block by the resulting domain instead, or find if there is a way to force a limit to the SMTP or bandwidth usage for your accounts.

Originally Posted by dannybedor

Have you check your IP against SPAM Blacklist providers? Check in Spamhaus.org to make sure your Ip is not in their list.

Worth checking this, but based on what the OP said I don't think this will be the cause of the problem... still a good idea to check it to eliminate this as a potential cause. Good thinking!

Originally Posted by mgraphic

That kinda makes sense because if it's a reseller account all of your hosted domains share the same IP. SMTP uses the server IP to connect with the outgoing mail connections, and when they block the IP, that will in turn block all of the domains on that IP.

I think maybe you (or I) misunderstood? My understanding is that the customer was sending lots of emails from their own connection - not from the server. Therefore the IP which was blocked would've been the one the customer had on their Internet connection...?

Also it's typical for an entire server to send mail from a specific IP (particularly if the mailserver is on a different physical server, rather than sharing the same box) and therefore what domain is hosted on what IP makes no difference.

In terms of establishing a connection to the mailserver from the server itself (e.g. if they're sending via SMTP from a script on their website) then this would most likely be connecting from localhost/127.0.0.1 in which case blocking either would be completely stupid! - and wouldn't prevent remote SMTP for the OP as described either.

Originally Posted by damien_ls

I think maybe you (or I) misunderstood? My understanding is that the customer was sending lots of emails from their own connection - not from the server. Therefore the IP which was blocked would've been the one the customer had on their Internet connection...?

It all depends if you are using your web server's SMTP or your ISP's. If it's the web server's, then it makes more since why this would happen.

Huh? If they're connecting to the web server's / hosting provider's SMTP directly from their home/office (i.e. ISP) then the offending IP is the ISP's. If this is dynamically allocated then some other user would effectively be blocked incorrectly - which is my best guess as to the problem here.

If they're not connecting to the web server's SMTP in any sense (i.e. not from their computer, or from scripts within their website on the server) there wouldn't be any reason for the hosting provider to block any IP? E.g. if they send via ISP's SMTP then the only one potentially blocking by IP would be the ISP (but they'd more likely terminate service to the customer, and/or contact them etc.).

So the only way a blocked IP on the hosting provider's SMTP server could cause this problem is if both of the following are true:

• blocked IP belongs to the ISP both customer and reseller are using (e.g. not IP of the server / hosting account or w/e at the hosting provider)
• ISP dynamically assigns IP addresses

If only one (or neither) are true then the only explanation would be that the hosting provider made some mistake - or the OP missed some important point in the story

Ok - I see where we are missing each other's point. I was thinking that the host was blocking IP of the web server itself, not the clients IP from thier own ISP. If clients IP is blocked by thier ISP then it does not make any sense, but if the web server IP is blocked then it does make sense because all the domains on that server use the same SMTP service.

It just may be the simple solution to use your ISP's SMTP and not your web host.

Originally Posted by mgraphic

It just may be the simple solution to use your ISP's SMTP and not your web host.

I would love to use my ISP's SMTP...but in Costa Rica, unless you have a domain registered with them (zzzz.co.cr) they won't let you use their mail server (aaaaarrrrgh). There is a referendum up to join CAFTA in the next couple months - if they do that it will zap the local monopoly and bring in competition. That should eliminate the problem.

Finally my Host decided to place the ban by individual email address (much better solution), rather than banning by IP. This has helped for the tme being but I am still worried about what might happen in the future so I may set up my own SMTP server in future. Eliminates the problem entirely.

Thanks to everyone for your feedback. You guys are great.