Recurring listing on CBL for Plesk 12 for using several different EHLO/HELO names

[furnax]

I've been plagued by CBL listing for quite some time now, on a linux server with Plesk 12.

After months of a fierce fight against every possible malware on the about 120 various websites on this server, extensively monitoring clients emails, enabling restrictive policies and finally even hiring a private security firm to investigate the problems further, we were sure that not a single spam message was sent by our server in any way.

So we finally contacted CBL, exposed the issue and got this answer:

The CBL attempts to detect compromised machines in a number of ways
based upon the email that the CBL's mail servers receive.

During this it tries distinguish whether the connections represent real
mail servers by ensuring that each connection is claiming a plausible
machine name for itself (via SMTP HELO), and not listing any IP that
corresponds to a real mail server (or several mail servers if the IP
address is a NAT firewall with multiple mail servers behind it).

54.194.XX.XXX was found to be using several different EHLO/HELO names during
multiple connections on or about:

2015:01:09 ~16:30 UTC+/- 15 minutes (approximately 3 days, 21 hours, 14 minutes ago).

The names seen included:

xxx1.xx, xxx2.xx, xxx3.xx, xxx4.xx, xx.xxx5.xx, veniceberg.com

Note that the above list may include one or more names that are not
fully qualified DNS names (FQDNs). Host names (ie: Windows node names)
without a dot are not FQDNs.

[...]

The final possibility is that 54.194.XX.XXX is not a NAT firewall, and
is instead a single box with many domains provisioned on it, some that
send email directly, setting the HELO as the sending domain. If this
is the case, to prevent a relisting we strongly recommend setting the
mail software on the box so that a single identifying name is used in
outbound SMTP connections
mail software on the box so that a single identifying name is used in
outbound SMTP connections. As an alternate workaround, you can
configure the mail software to relay its outbound email through an
intermediate mail server. Even a co-resident mail server package
(such as IIS on Windows) will do fine.​

This pointed me to this Plesk Mail setting (not sure if this selection is the default). Now we are waiting a few days to see if changing to "Send from domain IP addresses" solves the issue.

I think this is a kind of issue which deserves attention by Parallels to avoid other users go trough our fatiguing ordeals. If this setting is responsible for getting servers blacklisted, it should be highly discouraged.

 

[SGISoft]

Hi Andy,

Just'm in your same situation. Contacting CBL-Spamhaus I discussed the same thing.

Previously had all my accommodation (+ -20) in Plesk 10 and had not had any problems.
After migration and lots of optimizations (with care and documentanto all) a pretty decent server is me.

But since three days ago I see hell begins ...

I think there finding out what he says may be true, for I had activated the option:
Send from domain IP address and use domain names ...

I have been given a period of three days to make changes and I hope I have managed to find the right solution.

Could someone confirm that this is because of this otion?

Thank You.
A greeting.

 

[SGISoft]

Hello Fumax,
In the previous post I mistook name. Sorry.
I contacted again with the CBL Spamhaus service and this was his reply:

Often there is confusion Between the SMTP "banner" and the SMTP
"HELO" (or EHLO) command. These are Completely different things,
and proper understanding is important.

First some terminology (somewhat simplified to aid understanding):

A "SMTP client" is a piece of software That Makes SMTP connections to SMTP
servers to send a piece of mail to the server. Most E-mail servers
consist of an "SMTP listener" (to listen for and handle connections
made to them by SMTP clients), an SMTP client (to send emails to
other mail servers) and a local delivery agent (LDA) to deliver
email to "local" users (eg: via POP or IMAP).

Just thus, SMTP clients make connections to SMTP listeners, and issue SMTP
commands to the listener.

The "HELO" (or "EHLO") command (see RFC2821) is a command issued
by the SMTP client to identify identity the name of the client. "HELO
example.com "mens, Essentially," Hi there, my name is example.com ".

The "SMTP banner" is what the listener says in the initial response
connection or in response to the HELO command.

The CBL works in many cases by seeing what SMTP clients say (in the
HELO / EHLO command) When the client connects to a CBL detector. since
the CBL NEVER does SMTP probes, it has no way of Knowing how GIVEN
IP banners.

You can test SMTP banners with like telnet and other diagnostic
tools, but you CAN NOT test SMTP HELO / EHLO.

For That, you can send an email to [email protected]. That will
reject the email (as an error), and the bug will show you what the
HELO / EHLO was.

Really I do not understand if this has something to do with reports, but I'll try to send a test email to this address and see if I have good configuration.

 

[SGISoft]

Finally I confirm that the option "Send from domain IP address and use domain names in SMTP greeting" is a bad idea if you have hired several domains.
It would be good that those responsible for Plesk añadiesen a note on that option to not diesen us these scares.
Furnax, you can rest assured, I have confirmed from Spamhaus is correct configuration using "Send fron domain IP address".
It's a shame you can not use the above, for surely it is essential to use digital certificate mailings using SSL, although I can not guarantee 100%.

Thank You.