T-online.de blacklist “host refused to talk to me” (BL)

emailpostfix

I got following error message for several days, as my server tried to send a message to an emailadress at t-online.de:

host mx02.t-online.de[194.25.134.9] refused to
talk to me: 554 IP=xx.xx.xx.xx - A problem occurred. (Ask your postmaster
for help or to contact tosa@rx.t-online.de to clarify.) (BL)

At several forums I read that this problem without the (BL) appendix occurs if you sent 100+ messages a day and/or they were spam. They say, after 24 hour, this quota will be set to zero again and you get unblocked automatically. But this did not happen. We were still blocked after 3 days.

Our server did not send any spam and was not compromised. Also, a possible reason could be redirect domains, e.g. user@example.com redirects to user@t-online.de . In this case, the hostmaster of example.com will be made "guilty" if he forwards spam he received. However, our server also uses no email forwarding, so this couldn't be the reason either.

Also, our server was not listed at any blacklists of ipvoid.com .

So, the question is why are we getting this error message and is our server probably compromised by hackers?

Best Answer

I have finally found out that all the pages I visited during research were talking about the error message without the (BL) suffix. Without "(BL)", the server wants to tell you, that you are blocked automatically and will be unblocked automatically after 24 hours. You should check forward settings or spamming users, as discussed in the web forums.

In our case, the error message had the rare suffix "(BL)", which meant that our server was on the internal permanent blacklist which is a very rare condition and not well documented. Now it makes sense - BL stands for blacklisted, of course. Writing "Permanent blacklisted" would have helped.

After contacting the email address given in the error message, it turned out, that not our server itself was permanent-blocked, but the datacenter, because there were too many spamming users. Due to our request, only our server IP (xx.xx.xx.xx/32) was whitelisted.

Related Topic