Plusnet IP addresses listed in SORBS blacklist

[#1]

Hey @gabrielgi,

I'm afraid this isn't something we can do, as @Gandalf has stated we don't have a working relationship with SORBS nor is it within our remit to support. Please go ahead with the workaround @Gandalf has suggested.

Thank you.

[#2]

Hi, Mads,

Thank you for getting back to me.

I'm afraid that using Gandalf's workaround is not something I can do, as I would lose my personal email privacy by sending to Plus Net all my outgoing emails.  I'm sure the community can agree with my point here - although I am more than happy to be proven wrong.

I understand that contacting SORBS may not be within your remit - can I ask you then who can I contact so that we find out which team in Plus Net can do this for us? You may not have a commercial relationship with SORBS, and you probably don't need one, but it is Plus Net the entity that can fix this problem, not Plus Net's customers.

I hope this makes sense - please let me know who the community can speak to, so that we can move forward.

Thanks,

Gabriel

[#3]

Hi Gabriel, we've discussed this with our email/networks team previously and I'm afraid that this isn't something we've any control over as we can't remove immutable blocks that SORBS have placed on a particular IP. There isn't any other team you or I can raise this to unfortunately.

As a workaround we can change your IP address which will be the 'fix' you'll get even if you move to another provider, with no guarantee the issue may not simply return at some point in the future. 

If you're using our email service then ideally you should be using our mail servers as they're designed to work with the service we provide. 

[#4]

@gabrielgi 

"I'm afraid that using Gandalf's workaround is not something I can do, as I would lose my personal email privacy by sending to Plus Net all my outgoing emails."

What is your real concern here?  Your emails are no more or less private sent via Plusnet's relay server than they are / are not going through any other MX routing / relay server(s).  You never have any assurance that an email you send is not going via a third-party in the end to end delivery from you to the recipient.  You have no assurance that GCHQ / CIA et al are not reading your messages.

If total privacy to so paramount to you (for whatever reason ... such as you are planning to over throwing president Thrump) then you need to look at end to end message encryption methods, which is a totally different ball game!  However govenment agencies can probably crack many of those if they wanted to.

[#5]

Hi, Gandalf,

Thank you for your response - I'm afraid we aren't exactly on the same page. I would never ask of you that you remove a block on a specific IP, as that would create an immense amount of work for Plusnet.  What I am asking is what team can find out and re-issue the description of the registration of the block of IP's that is marked as spam, as this will surely be useful to all customers who are in the same situation as mine and -most importantly- tell the truth i.e., Plusnet customers sometimes do run genuine servers on the internet.

Sadly, it requires an account in SORBS for you to find out which are these IP blocks. I have taken a screenshot for your convenience, which is attached.

Regarding your offer about chaging my IP address in particular, I would be more than happy to accept that - could you tell me in which block this IP would be, so that I double check with SORBS that they aren't reported as "NoServers"?

Regarding your mail servers, I don't wish to use them as I prefer to send emails directly to the domains I deal with - I hope you understand that otherwise you would have access to all my outgoing emails.

Thanks!

Gabriel

[#6]

Hi, Townman,

Thank you for your interest in this case.

I do not use MX relay servers, and wish to keep it that way.

What you suggest may or may not be true, depending on who you deal with. For example, any email sent to a @gmail.com address probably lacks of any privacy whtasoever. Implementing PGP in that case would be ideal, but difficult too.

For the domains I deal with, I know my connection is direct from my server and that of the destination's; I also know that the connection is encrypted. This is what I don't want to lose by relaying my email through Plusnet, and I guess it's not too much to ask either, as I have done this in the past and ultimately this is how SMTP is supposed to work between edge servers.

Regards,

Gabriel

[#7]

Hi Gabriel, I understand what you've said and from discussing this with the relevant team, there isn't anything we can do to influence SORBS.

As a gesture of goodwill I'm happy to provide you with a new static IP free of charge, however we wouldn't be able to find out the new IP you'll get before we add it as the system is automated in that respect, which means that it's only after we add it on that we'd know what the IP is.

If you have issues with the new IP, to change this to another static in the future, there'd be the usual £5 one off charge though.

Let me know if you'd still be happy with this and I'll arrange this when I'm in the office this afternoon.

Again we'd still recommend smart hosting through our relay server as this will resolve the issue.

[#8]

I do not use MX relay servers, and wish to keep it that way.

You do, you just dont notice it!. Your mail server will send to wherever the destination domain MX records point. That may well be a relay server , using the Plusnet server as a Smart host is no different.

I'm not sure anyone has mentioned previously but the Plusnet smtp servers now support secure connections. You can use SSL on port 465 or STARTTLS on port 587

[#9]

"For the domains I deal with, I know my connection is direct from my server and that of the destination's; I also know that the connection is encrypted"

What is the real fear you are trying to mitigate here?  As @MisterW mentions, you have no real knowledge or assurance what MX servers your target uses, all you know about is their edge MX service.  Also message transmission encryption via relay.plus.net has been around for a while now ... albeit not shouted about.

Connection encryption only protects the message during transmission.  If you want real privacy between sender and receiver then you need to (must!!) encrypt the message with PGP or better.

People get their knicker elastic unreasonably twisted over information security ... juest because it is possible then we must do it!!

I recall working with a big UK government organisation ... in the begining they posted 1,000s of confidentical medical records all over the country in brown envelopes through a known to be leaky postal sorting office ... and the risk was thought to be acceptable.  Then new technology became available and the same information was sent over automated fax services ... but ow security was paramount.  There had to be assurance that only the addressee had access to the fax machine ... oh and the sending fax gateway had to be behind two network firewalls ... even though the fax transmission server was attached to PSTN phone lines.

Later more new technology arraived and process changes allowed the same information to be sent via email ... however that could only be sent to an addressee having a .gov.uk email address ... connected over the hightly secure UK goverment network ... for if it were sent over the plain old internet ... someone might tap into the phone lines and steal the information.

Invarably people's fears over information security and privacy is inversely proportional to the real risk.  Brown envelopes sent through the postal system is high risk, but we do not worry about it.  Intercepting and abusing an email message takes a lot of highly technical effort and is therefore (compared to volume) low risk ... but we keep ourselves awake at night worrying about it and make our lives overly complicated to seeking mitigate that minimal risk.

[#10]

Hi, Gandalf,

Thank you for your response and offer and apologies that it's taken me so long to reply.

While I really appreciate your offer of a new static IP address, I wouldn't want to go ahead with it if it may not work, as it would generate work for you and me - have you got at least an example of an IP address that you provide? The first 3 octects would at least give me an idea to gauge if it's worth doing it.

Thanks!

Gabriel

[#11]

Hi, MisterW,

Let me rephrase - I do not use relay and smarthosting for my side of the communication chain.  I could also be confident that for certain destinations, the same care is being taken.  Using a smarthost is adding a piece to the communication chain that I or the recipient can't control.

Plusnet may support encrypted communication with their smarthost, but that doesn't mean that whoever controls that server will have access to the emails going through it.

PGP or other end-to-end technologies are good to add onto security, but it doesn't justify weakening the communication chain knowingly.

Having said all this, I would like to get back to the original issue on this thread, which is that Plusnet has registered the block of IP addresses -where mine and at least that of one other person is- as "residential use", basically stating that no servers run there, which is not true.  I feel like customers have to have the option to opt out of such things or at least be told in advance that that is the deal.

Regards,

Gabriel

[#12]

Hi, Townman,

I don't personally have any real fear, I just like to keep things running tidy where possible.  When you post a letter, you close the envelope, regardless of all exissting risks of it being read, lost, etc..

Thank you for sharing your tales about confidential information being mismanaged - I'm sure I have some of my own as well.  All this only encourages me to attempt to do things as properly as possible, not the other way around.

Like I mentioned to MisterW, I would like to go back to the original topic of this thread.  We could always open another one to debate SMTP hardening.

Regards,

Gabriel

[#13]

---

@gabrielgi wrote:

Hi, Gandalf,

Thank you for your response and offer and apologies that it's taken me so long to reply.

While I really appreciate your offer of a new static IP address, I wouldn't want to go ahead with it if it may not work, as it would generate work for you and me - have you got at least an example of an IP address that you provide? The first 3 octects would at least give me an idea to gauge if it's worth doing it.

Thanks!

Gabriel

---

Hi Gabriel, thanks for getting back to us. A static IP could come in one of any number of ranges. I'm afraid we can't predict which one you'll get before we add it. As an example static IP, my own personal one begins with 212.159.xx.xxx

[#14]

Hi, Gandalf,

Thank you very much for your example - indeed, the few ranges I checked in your example that belong to Plusnet don't appear to be in this forsaken SORBS database.

What is the process to get the change in my IP address? Shall I contact Plusnet and point them to this thread? I would like to request that the IP address they'll give me is within the example ranges that you posted - not sure if it will be possible, but at least I will ask!

Regards,

Gabriel

[#15]

Hi Gabriel, I can change your static IP for you but again we can't tell you or specify what range you'll get before we add it on. Adding a static IP is an automated process, we just click a button. If you're happy to go ahead still, let me know and I'll arrange this when I'm in the office today.