Spamhaus Rising: Or Why Your ESP has Toughened Up
By Ken Magill
Attention email marketers: Has your email service provider become a little—or maybe even a lot—tougher on you about your permission practices over the last six months or so?
Is their increased vigilance pissing you off? If so, your anger is misplaced. They are reacting quite sensibly to market conditions apparently imposed by Spamhaus.
The anti-spam outfit significantly increased its blocklisting activity starting around June, according to multiple sources in a position to know.
Spamhaus maintains a file of IP addresses its volunteers deem to be sources of spam. Many ISPs and email administrators refer to Spamhaus listings as at least part of their spam-filtering formula. As a result, a listing on Spamhaus can cause severe email delivery troubles.
A listing can also result in Spamhaus imposing an onerous condition for delisting, such as reconfirming permission on the blocked sender’s list.
Moreover, Spamhaus has been known to list entire ranges of IP addresses, affecting more than just the sender in its crosshairs.
“That's why we don't take any shit from a client when they get on the SBL, because if you push back or ignore Spamhaus without careful thought, they could spank a whole bunch of unrelated clients unfairly,” said one ESP representative who did not want to be named.
One well-known ESP had 500 of its IP addresses blocked this summer and another had 250 blocked, according to the source.
Spamhaus started paying more attention to email coming from ESPs in 2011 than it had in the past, the source said.
Another ESP executive who did not want to be named also said Spamhaus began to get significantly more active in spring 2011.
“We don’t run into them all that often, but we have run into them more in the last six months than we had in the past,” said the executive.
The executive theorized that Spamhaus may have begun scrutinizing ESPs more closely after last year’s well-publicized data breaches where unauthorized access was gained to ESPs’ clients’ email lists.
The ESP executive said he believed the folks at Spamhaus probably figured the breaches would result in an increase in spam and, as a result, started paying closer attention to ESP email streams.
Steve Linford, executive director of Spamhaus, offered a much simpler explanation for the increase in blocklisting activity.
“That will probably be the SBL-CSS [Spamhaus Block List—Composite Snow Shoe], an automated snowshoe detector that has been working very efficiently since the summer,” Linford wrote in an email exchange with The Magill Report.
Snowshoeing is a term used to describe spamming that is disguised by sending smaller amounts of email over a large number of IP addresses.
“Senders who were previously spamming under our radar by sending small amounts of spam spread across many IPs are increasingly finding their IPs on the SBL-CSS,” wrote Linford. “CSS is a spamtrap-driven system (as you'll appreciate a spamtrap cannot possibly be an 'opt-in' address) that lists automatically and de-lists automatically a short time after the spam has stopped hitting the traps.”
Laura Atkins, principal at email deliverability consultancy Word to the Wise, said she believes the increased blocklisting activity is due to a number of factors.
The snowshoe spam list is apparently one. “[T]here are a lot of spammers who are snowshoeing. Many of them are advertising for legitimate companies,” she wrote in an email exchange with The Magill Report.
But also: “[Spamhaus is] getting tired of the bullshit from ESPs. Their new tools let them see the ESP streams better and identify which ESPs are really serious about fixing things and which aren't.”
She added: “It's getting ugly out there for senders, even the ones who previously had good inbox delivery.”
So if your ESP has been more of a pain in the ass about best practices lately, now you know why.