For every IP available with OVHcloud products and services, as an Internet Service Provider, we will register and reserve it with organizations such as RIPE or ARIN. This means that we appear as the IP abuse contact for litigation in the WHOIS database.
If an IP is reported to organizations such as Spamhaus and SpamCop, which work to combat SPAM, malicious websites, and phishing, then the reputation of the entire OVHcloud network is at stake.
It is therefore important that OVHcloud takes care of the reputation, quality, and security of the network, which also forms an important part of your service.
How does the protection system work?
Our system is based on the Vade Secure anti-spam technology.
Once an IP is "blocked for SPAM", an email will be sent to your account containing information like the example below:
Dear Customer,
Our anti-spam protection layer has detected that your IP 122.122.122.122 is sending spam.
In order to protect our network, we have blocked the port 25 of your server, at the network level.
To help you investigate about this problem and fix it, here is a sample of some advanced details on your emails:
Destination IP: 188.95.235.33 - Message-ID: d24aa492-5f37-457f-9595-23ddc9e0f714@xxxxxxxxxxxxx.xx.local - Spam score: 300
Destination IP: 188.95.235.33 - Message-ID: fc090jdhf934iu09bf084bfo92@xxxxxxxxxxxxx.com - Spam score: 300
Destination IP: 188.95.235.33 - Message-ID: P0hbfo93407684bfoqljrlqvpLatS3RRB9rZw7e8s@xxxxxxxxxxxx.online - Spam score: 300
Destination IP: 188.95.235.33 - Message-ID: 6ZUnls843bnf0934StxFasYGmhtDJRo@xxxxxxxxxxxx.online - Spam score: 300
Destination IP: 188.95.235.33 - Message-ID: zcb.3z54da3kdfkl45802n0c0q98rqcc57e3b8aadfac63b2c408e3f5f9a27. 1d44jkgnddfef.166489320375@xxxxxx.xxxx.net - Spam score: 300
Destination IP: 188.95.235.33 - Message-ID: zcb.3z54da33hn98v9bcq-nrf3r67cc57e3b8aadfac63b2c408e3f5f9a27.1d44jd9340252. 1655508652095@xxxxxx.xxxx.net - Spam score: 300
Instructions
What to do after receiving the email alert?
The procedure involves identifying the problem, resolving it, and then unblocking your IP.
Identify and resolve the issue
Before unblocking an IP:
- Stop sending emails (e.g., stop all email software such as qmail, Postfix, Sendmail etc.).
- Check the email queue (e.g. qmHandle for qmail, postqueue -p for Postfix) and clear it.
- Analyze your logs using the Message-ID found in the block alert.
- If you are indeed sending SPAM or illegitimate emails, we strongly recommend you to resolve the issue before unblocking the IP. Please consult the second part of this guide for email best practices.
Once the issue has been resolved, you can unblock your IP by performing the following steps.
WARNING: Do not unblock the IP under any circumstances without having suspended the sending of emails from your server, otherwise you will immediately get blocked for a second time (and a longer duration).
Unblock your IP
Unblocking your IP from the OVHcloud Control Panel
In your OVHcloud Control Panel, go to the Bare Metal Cloud section and, in the Network section, click on IP.
You can use the drop-down menu underneath My public IP addresses and associated services to filter your services according to category, or directly type the desired IP address in the search bar.
If you have an alert on any of your IP(s), there will be a red status icon in the IP Alert column.
Click on the more options ... next to the corresponding IP/service and select Anti-spam unblocking.
In the pop-up windows, click Unblock the IP at the bottom and confirm.
The IP is being released, the operation may take several minutes.
Once done, your IP will be unblocked.
Unblocking your IP from the OVHcloud API
Log in to the OVHcloud API interface according to the relevant guide and follow the steps below.
First, retrieve the list of IPs for each OVHcloud service (Dedicated Server/Hosted Private Cloud/VPS/Public Cloud):
In the type menu, indicate the type of IP (Dedicated, PCC, VPS, vRack, PCI, etc.).
Click Execute.
Here's an example of what you should see:
"2001:41d0:67:d200::/56",
"2001:41d0:68:a00::/56",
"2001:41d0:68:f000::/56",
"2001:41d0:117:db00::/56",
"122.122.122.121/28",
"145.56.222.96/28",
"188.81.49.30/28",
Next, search for IPs in a particular state with the following call. If you already know the IP blocked, you can move on to the next step:
In the ip menu, specify the IP block retrieved in the previous step with the netmask. For example, 122.122.122.121/28.
In the state menu, specify the state you are looking for.
Click Execute.
Here's an example result (in this instance, the 122.122.122.121/28 block was selected):
"122.122.122.122" If the IP is blocked, you can get information on the blocking with the following call. Otherwise, move on to the next step.
In the ip menu, specify the IP block retrieved in the previous step with the netmask.
In the ipSpamming menu, specify the previously retrieved IP in "blockedForSpam" state, for example.
Click Execute.
Here's an example result (in this instance, block 122.122.122.121/28 and IP 122.122.122.122 were selected):
time: 3600,
date: "2022-08-29T17:42:50+01:00",
ipSpamming: "122.122.122.122",
state: "blockedForSpam" Which means:
- The IP is blocked for 1 hour (or 3600 seconds).
- It was blocked on 29/08/2022 at 5:42 p.m.
- Its current state is blocked.
If you wish to obtain the statistics on what has been detected, use the following api call, otherwise move on to the next step.
In the ip menu, specify the IP block retrieved in the previous step with the netmask.
In the ipSpamming menu, specify the previously retrieved IP in "blockedForSpam" state, for example.
In the from and to menu, use the date format used in the previous function (YYYY-MM-DDTHH:MM+01:SS).
Click Execute.
Here is an example result:
{
"messageId": "2PXQSX-3JRAUU-SF@obfuscated.com",
"destinationIp": "188.95.235.33",
"date": 1385640992,
"spamscore": 410
}
Unblock the IP
WARNING: IMPORTANT! Do not unblock the IP under any circumstances without having suspended the sending of emails from your server, otherwise you will immediately get blocked for a second time (and a longer duration).
To unblock your IP, use the following call:
In the ip menu, specify the IP block retrieved in the previous step with the netmask.
In the ipSpamming menu, specify the previously retrieved IP in "blockedForSpam" state.
Click Execute.
Here is an example result:
"message": "This IP address is still blocked for 129 seconds"More than 129 seconds later:
time: 3600,
date: "2022-08-29T17:42:50+01:00",
ipSpamming: "122.122.122.122",
state: "unblocking" The IP is being released, the operation may take several minutes.
In case of false positives
In some cases, the antispam alert could be false positive. If you have checked and found that Message-ID are from your legitimate email, you should then ensure that your email messages comply with the RFC and the Best Practices indicated below.
RFC
RFCs (Request For Comments) are documents intended to describe technical aspects of the Internet. They are produced and published by the IETF (Internet Engineering Task Force), a group which basically produces and defines standards. For more information, see: RFC, IETF and Internet Draft.
Best Practices
Best practices are recommended methods which are often based on the RFC documents and are intended to advise you on the best way to proceed. In this instance, this means the basic rules to follow so that your emails are not marked as spam.
Sending Volume
If your outgoing email volume is very high, you are advised to:
- reserve an IP block dedicated solely to email usage.
- provide an 'abuse' address on this block in order to receive complaints.
- configure Reverses on all IPs correctly.
This operation will enable you to simultaneously isolate the IP and domain reputation if you send emails from various domains, to receive the complaints, and thus do what is necessary to get unblocked by various organizations. It also enables you to locate a problem more quickly on a form that uses domain X or Y, as the emails are not sent out from the same IP and don't have the same reverse.
Email Content
- Avoid using spammer keywords in your emails such as “buy” and “last chance”, and avoid capital letters, impersonal subjects, exclamation marks, and % discounts.
- Do not forget to provide an unsubscribe link for people who have not requested to receive your email or who believe it to be illegitimate.
- Pay particular attention to ensuring that your emails contain the sender's address (or an alias), a subject line and a correct ratio of text, images and links in the body of the message.
- The ratio of text to image and text to link should be high. Do not overload the email with hyperlinks and avoid Javascript.
FBL - Feedback Loop
This system enables you to follow up on feedback provided by some internet service providers directly, informing you that their users have flagged your message as illicit, and that it has therefore been classified as spam. This will allow you to interact directly with these ISPs regarding your reputation. Some FBLs include:
Authentication
Some authentication services allow you to protect your reputation:
- Sender-ID: An email authentication technology developed by Microsoft which validates the authenticity of your domain name by verifying the IP address of the sender. This technology is based on the IETF standard: RFC4406
- SPF: Sender Policy Framework is a standard for verifying the domain of the sender. It is based on RFC4408 and consists of adding an SPF or TXT field to the domain DNS, which contains the list of IPs authorized to send emails from this domain.
- Reverse DNS: Reverse enables your IP to be "translated” into your domain. That allows the domain associated with the IP address to be found.
- DKIM: This standard is described in RFC4871. AOL and Google (Gmail) work on this basis.
For more information on the above services, please consult our guide on How to Optimize the Sending of Emails.
Specific types of email sending
- To a Microsoft server (Outlook, etc.)
Microsoft uses a whitelist policy. This means that initially, everything starts off on a blacklist, and a specific procedure is required to validate your email server.
- To a Gmail server
If your recipients are with Gmail, adding specific records (e.g. a DMARC record) may ensure that emails reach them. Here is a Google article that can help you with this: Add a DMARC record.
Google also has a dedicated article regarding spam prevention to Gmail users.
Go further
For more information and tutorials, please see our other Dedicated Servers support guides or explore the guides for other OVHcloud products and services.