Malware / Blacklist / And who knows what else

All of a sudden I start getting emails bounced back to myself when I sent to client’s who use the same provider. I called the provider who also provides my service and I could not get a satisfactory answer to anything.

I was told my IP address shows on a blacklist and one dept said to get off the list i need to apply to be removed, in which i have no idea what that entails and then another said to apply for a new Ip address, but the provider says you cant get a new IP address.

Ive always been super careful when it comes to security but now i need to find out is there malware on my system and can anybody recommend what i should use / or do? I called our Apple reseller and due to covid cant even get it looked at it for another week and then they will want to keep my imac for 3-4 days which would make business come to a halt.

Anything you can suggest would be most appreciated.

Three suggestions:

• Are you using a VPN? If so try sending email with it off, or from a different VPN node.
• Does your mail service have a webmail component? If so use it for now, as the webmail sends from their IP address, not yours and it should go through.
• Yes, if the IP address is blocked you need to contact customer service for whomever is doing the blocking. I get an email newsletter whose URLS are redirect-URLs using Mailerlite and links were blocked a week ago so I contacted Mailerlite and they unblocked my VPN’s IP address, which Cloudflare had flagged for spam.

You said “one department” somewhere told you they saw your IP address was on a blocklist, so one would think they could point you to whom to contact.

If this is your home machine you can probably get a new IP address by shutting down your modem for a while.

In general, the odds of you having malware vs. the odds of a mail server on the Internet having a problem come out heavily in favor of a mail server on the Internet having a problem.

But a few places to start digging…

Which IP is being blocked - your personal IP, or your sending mail server? The way you proceed is different in each case.
If it’s your sending mail server, is that sending mail server run by your provider? Or is it run by your web host? Or maybe Google, Microsoft, … ?
You can go to https://mxtoolbox.com and use the search bar. Type “blacklist:” followed by an IP address, and it’ll scan that IP against a number of common blacklists.

The thing is, frequently the owner of the blacklisted IP will have to apply for de-listing - and the “owner” for this purpose almost certainly isn’t you. So you may have to get either the admins of the sending server (if it’s your sending server) or the admins of your ISP (if it’s actually your personally-assigned IP address) to request the de-list.

Another option though, to hack around the problem temporarily…

If it’s your sending server that’s blocked, assuming you’re using email@yourdomain, and you control the DNS, you can use pretty much any sending server you want as long as you have credentials. So if you’re sending via your webhost, you can switch to send via your provider. Or vice-versa. Or you can even spin up a SendGrid account and use that for SMTP temporarily until the blacklist clears. All of this would require an adjustment to the DNS SPF / DKIM / etc. records, so it’s a little more complicated than just fixing the problem - but it’s a potential solution.

This is particularly thorny, and nobody really wants to help people in this mess - but with some persistence you can usually get through to the people that need to make the magic happen. Wishing you the best of luck!