Blocked on SPFBL by spammers
SPFBL is a remote blacklist. It stores data about known spammers and serves it to subscribers over DNS.
Spammers also use it against legitimate mail servers.
In our case, a host at vinhedo.nuvemidc.com (client=vinhedo.nuvemidc.com[179.127.30.78]) tried to send us spam from contato@goomarketing.com.br.
Some digging:
$ dig MX goomarketing.com.br +short
0 _dc-mx.910d187fe7de.goomarketing.com.br.
$ dig _dc-mx.910d187fe7de.goomarketing.com.br. +short
179.127.30.78
$ dig -x 179.127.30.78 +short
vinhedo.nuvemidc.com.
Greylisting stopped their spam. So they blocked our mail server’s IP on SPFBL. SPFBL let us delist it (SPFBL delist), but it is troubling that obvious spammers can block a clearly legitimate server.
The spammer’s domain is registered through the privacy registrar Domains By Proxy. Privacy matters for people like journalists and whistleblowers. For a mail server, it is harder to justify.
$ whois nuvemidc.com | grep Registrant | grep Proxy
Registrant Organization: Domains By Proxy, LLC
Registrant Street: DomainsByProxy.com
The IP 179.127.30.78 and the domains nuvemidc.com and goomarketing.com.br clearly belong on a blacklist. That alone may not be enough. Banning every domain registered through Domains By Proxy could help. Running a whois query for every incoming message is not practical, but we can do it after the fact by keeping our own RBL.