Blocklists

Overview

Once in awhile, Stanford's email gateways get placed on an Internet spam blocklist. When this happens, email sent from Stanford mail servers gets delayed or bounced back to its sender, even when the message is perfectly legitimate (non-spam) email.

Why does this happen? Can Stanford do anything about it? 

This document explains the problem, describes what University IT does to attempt to avoid this problem and describes things you can do if your mail is being delayed or rejected due to blocklisting.

Stanford and email blocklists

Why do Stanford's email gateways (such as smtp.stanford.edu) get placed on a spam blocklist?

This most commonly happens following successful phishing attacks:  Spammers forge messages pretending to be from system administrators asking users to disclose their password; when users fall for this the spammers then use their accounts to send large quantities of spam through Webmail or other systems on campus.  Other commons causes include misconfigured email servers that spammers can use to funnel their messages through to our central gateways, and virus-infected systems.

What does Stanford do in response to these blocklists?

We do a number of things as a normal course of business to attempt to avoid this issue. Detailing all of the various approaches here would not be advisable because spammers could use this information to help them thwart our efforts.  Generically, we run several tools internally to detect and deal with spam before it leaves our network and we act on reports of abuse sent to us from the larger Email Service Providers (ESPs).  When accounts have been compromised we disable them and work with the user to set a new password.  Where possible we've worked with ESPs to get allowlisted or have a higher threshold set before our servers are blocklisted.

Despite these efforts we will inevitably be blocklisted from time to time. The standard practice by most ESPs and organizations that maintain these blocklists is to automatically remove servers from their lists after a period of time. We have automatic monitoring of our outbound email IP addresses to routinely verify the status with several of the major ESPs.

In some rare cases some direct contact with the ESP or blocklisting organization may be necessary, however, we will only pursue this in the case of a major ESP blocking us and if that block has lasted for more than two days.

If you need assistance with such a situation please submit a Help ticket.

What can I do?

You can always attempt to contact the administrators of the system to which you were trying to send email. Usually, however, it's better to contact the actual person to whom you were trying to send mail (through other means, such as telephone) and urge this person to contact their system administrator. This works better because system administrators listen to their own users better than they listen to strangers. In either case, make sure the system administrators understand that your legitimate email was rejected by their system. Ask them not to reject mail based on third-party blocklists. Alternately, you can ask them to allowlist any email coming from a Stanford email server. Towards this end, you may also want to direct that administrator to:

spamcop.net/bl.shtml

which explains the SpamCop blocklist and includes, among other things, the following note:

The SCBL aims to stop most spam while not blocking wanted e-mail. This is a difficult task. It is not possible for any blocking tool to avoid blocking wanted mail entirely. Given the power of the SCBL, SpamCop encourages use of the SCBL in concert with an actively maintained allowlist of wanted e-mail senders. SpamCop encourages SCBL users to tag and divert e-mail, rather than block it outright. Most SCBL users consider the amount of unwanted e-mail successfully filtered to make the risks and additional efforts worthwhile.

Hotmail/MSN Issues and Advisory

Stanford has had mail blocked by Hotmail/MSN far more than any other major ESP.  We've seen these blocks last for inexplicably long periods of time and had no success going through their normal support channels to have these blocks alleviated in a timely manner.  We've gone to unusual lengths to escalate this issue through our Microsoft support representative but unfortunately that has not resulted in any appreciable improvement in the situation.  Since we feel like we have no recourse to improve the situation we make the following recommendations to the Stanford Community:

• If you have a need to forward your mail to an external account we recommend you select an ESP other than Hotmail/MSN.  When they are blocking mail from us this will prevent you from receiving your forwarded copy.
• If you are trying to correspond to a Hotmail/MSN user while we are being blocked you may wish to send them ail through an external address or to ask them for an alternative address you can send to.