Jotform.com blacklisted - McAfee SaaS rolling block list (RBL)

  • Profile Image
    xcitemedia
    Asked on June 08, 2012 at 05:50 PM

    Our form notifications aren't being delivered. We have confirmed that jotform.com is on McAfee SaaS rolling block list (RBL) and the emails are being blocked. Can you please contact McAfee SaaS to remove your domain from the list? Their phone number is  877-695-6442

    Can you also provide a rough timeframe of how long this may take, or how long it usually takes?

    Your help is greatly appreciated!

     

     

     

     

     


  • Profile Image
    jeanettebmz
    Answered on June 08, 2012 at 07:20 PM

    @xcitemedia

    Your petition has been forwarded to 2nd level . I cannot provide you with a rough timeframe for the solution, but I think  it is something that needs to be taken care inmediately

    Thank you very much for notifying us

    Best regards

    Jeanette

  • Profile Image
    Mike_T
    Answered on June 08, 2012 at 07:54 PM

    @xcitemedia,

    Thank you for contacting us.

    How you found that our domain is being blocked by McAfee SaaS rolling block list? Do you use some McAfee product?

    Have you received any warning about blocked message? If yes, please provide us with screenshot if possible.

    We use several mailing servers and mailing methods, that is why I am asking for this information.

  • Profile Image
    mcolon02
    Answered on June 08, 2012 at 10:55 PM

    I would like to find out if this has been resolved.  I ahve had similar complaints from my customers int he past year.  Unfortunately, they do not send me their screenshots...  I had people telling me they would not respond to my forms because they would receive a warning...

  • Profile Image
    liyam
    Answered on June 09, 2012 at 04:26 AM

    Hello xcitemedia.  As of checking, JotForm.com is classified by McAfee as "minimal risk". The same classification they gave Google, Yahoo!, Hotmail, and other known domains.  So your problem about your emails might not be because of this case.  Can you confirm that you have already added the IP addresses used by JotForm for sending emails on your server's whitelist?

    Hello mcolon02. The problem you were referring to was actually resolved last year. 

  • Profile Image
    mcolon02
    Answered on June 09, 2012 at 07:35 AM

    Thank you.  Please note that the latest complaint I received was in April 2012. 

  • Profile Image
    liyam
    Answered on June 09, 2012 at 07:37 AM

    Hello mcolon02.  Can you start a new thread and provide us more details of the issue?  The URL of the form where this happens would be a good start so for us to be able to investigate.

    Thanks.

  • Profile Image
    xcitemedia
    Answered on June 11, 2012 at 11:19 AM

    I have asked for the IP addressess to be added and I should recieve confirmation soon. 

    Below is the error and reply from McAfee, Inc:


    The e-mail is being sent from an sending domain who's IP address is found on the McAfee SaaS rolling block list (RBL).


    The full bounce message may look something like the following:
      

    > ----- The following addresses had permanent fatal errors -----

    > 

    > (reason: 551 Mailhost is on our global blacklist (Mode: normal))

    > ----- Transcript of session follows -----

    >... while talking to domain.com.inbound10.mxlogic.net.:

    >>>> DATA

    ><<< 551 Mailhost is on our global blacklist (Mode: normal)

    >550 5.1.1 ... User unknown

    ><<< 551 Mailhost is on our global blacklist (Mode: normal)

     

    A rolling block list is a temporary list which is maintained with IP addresses that may have recently sent mass mailings with a large percentage of invalid recipients.  A high percentage of invalid recipients is an indication of a more serious situation such as a system infected with a spambot or other malware that is attempting to harvest valid e-mail addresses or execute a Denial of Service (DOS) attack.

     

    After an IP address is added to this rolling list, McAfee SaaS continues to monitor the traffic from this source for 2 - 4 hours to ensure that traffic normalizes.  If we see normalized traffic in this timeframe the IP will be removed from the list and mail will be allowed to flow to our customers.

     

    Domains and IPs on this rolling black list can not be added to the Sender Allow list to allow the traffic to pass.

     

    McAfee SaaS recommends that the sender attempt to resend the message 2 - 4 hours after the initial failure. 

     

    Another option is to opt out of the use of blacklists through the McAfee SaaS Email Protection service.  This is not recommended as it can allow unwanted traffic to be delivered to users.

     

    Customers wishing to opt out of the use of blacklists must explicitly do so and request the necessary form from their McAfee SaaS support provider.

     

    Should you have additional questions, please contact us at 877/695-6442 or log a service request for additional assistance.

    Thank you.

    McAfee, Inc.
    SaaS Email & Web Security Technical Support


  • Profile Image
    Gabriel Cisners
    Answered on June 11, 2012 at 04:59 PM

    @ liyam,

    Below is a list of IP addresses that have previously been added to our whitelist when troubleshooting of this issue initially began.  Please not that adding this list of IP addresses did not allow inbound messages to bypass the RBL and we received the error posted above by xcitemedia.  However, would you please confirm that this is the appropriate list of IP addresses?

    1.    188.138.116.138

    2.     107.20.173.204

    3.     174.34.57.218

    4.     174.34.57.216

    5.     174.34.57.214

    6.     174.34.57.219

    7.     208.117.50.251

    8.  85.25.117.56

    Thanks,

     

  • Profile Image
    Gabriel Cisners
    Answered on June 11, 2012 at 05:57 PM

    @liyam

     

    I have reach out to McAffe support with the IP list above and have been told that one of the IP addresses had been on their perimiter deny list since July of 2011.  Specifically 107.20.173.204.  Please confirm if this, as well as the others, is an "official" IP address of Jot Form.  Thanks,

  • Profile Image
    Mike_T
    Answered on June 11, 2012 at 06:09 PM

    We are very sorry for the inconveniences, but unfortunately, this issue is a little bit unclear.

    Yes, provided IPs are related to our services. However, it does not mean that you are getting the messages from all of these IPs.

    Moreover, we use 3rd party Amazon SES service to send the messages when the Sender E-mail is set to "noreply@jotform.com". This is our recommended sending method which has pretty good delivery rate.

    As far as I can see, amazonses.com domain is marked as minimal risk too.

    If you set Sender E-mail to some custom email address, you will get the messages from our own mail servers.

    Can you please contact McAffe support to find out what exactly domain/IP is blocked in your case?

  • Profile Image
    xcitemedia
    Answered on June 13, 2012 at 11:43 AM

    FYI, Gabriel and myself (Xcite Media) are both working on this issue with All City Floors and he is the main point of contact on our end. Gabriel is with an IT company that manages their server and email. 

    Also, the sender email in the All City Floors notification is set to "noreply@jotform.com" so you can rule that out.

  • Profile Image
    Mike_T
    Answered on June 13, 2012 at 04:52 PM

    Thank you.

    It means that your are receiving the messages from Amazon SES servers. They are using filtering technologies to scan email content for spam and malware, so that they can provide very good delivery rate and reliable service in general.

    I do not see any reputation warnings for amazonses.com & email.amazonses.com.

    If you get any more information from McAffe, please let us know.