When GoDaddy Becomes NoDaddy

Some time ago GoDaddy manged to get the IP address of my VPS in their little black book and began refusing to receive any mail which originated from it. Unfortunately for me, I use GoDaddy for my E-mail hosting and that meant I stopped getting all E-mails that were sent from my server. A couple weeks ago I got around to calling them to see just what was going on. I would rather mud-wrestle a large sea-sick crocodile before repeating this tedious conversation with their bumbling excuse for tech support. Here are the details of my correspondence with them. My first attempt at conversation with GoDaddy was in the form of a 1 hour and 7 minute phone call to some guy who randomly answered the phone. I hit the buttons for E-mail support. He claimed to be from sales. I think he might have actually just been a janitor walking by a ringing phone. He was a polite you man, but unfortunately he knew NOTHING. Every question I asked him resulted in him placing me on hold for about 10 minutes while he talked to someone more intelligent than him. (It wouldn't be hard to find someone in that category) I basically started out asking about all the possible ways mail might be hindered from reaching my inbox. Here is his highlight reel:

• He started out claiming that GoDaddy in no way filtered mail.
• He quickly recanted admitting that they used a black list (though he didn't know which one), and they did scan incoming mail for spammy phrases and viruses though he didn't have any details.
• He had NEVER heard of SPF records
• I'm not sure if he even knew how SMTP works
• He claimed no one had EVER called in asking about not receiving their E-mail
• I'm pretty certain he started making up answers about half way through
• I caught him in several blantant lies. (Like when he told me they obeyed SPF records when they existed, but later claimed they reject ALL mail whose from address was from a domain not containing SPF records)
• I spent more time on hold then I did talking to him.
• He kept "forgetting" my questions and convenient ly changing the subject when I pointed them out. (I think he was just putting me on hold to have a smoke)
• After about the 10th time in a row he responded with "I don't know" I finally asked to talk to the next level of tech support. He transferred me to his manager.

His manager wasn't nearly as friendly and seemed to be making it job #1 to get me off the phone as quickly as possible. At least this had answers for my questions and didn't have to put me on hold. Here's the run-down:

• GoDaddy uses the Spamhause.org blacklist as well as their own internal blacklist of IP addresses. He refused to elaborate on how they build their internal list.
• All incoming mail is scanned for phrases that sound like spam. He refused to elaborate on what kind of phrases are searched for.
• All incoming mail is scanned for viruses. He refused to divulged what virus definitions are in use.
• If SPF records exists for the sending address, they are obeyed.
• Any mail deemed "bad" by the above rules is thrown in to a black hole.
• You WILL NOT be notified that you did not receive your mail
• You WILL NOT be able to retrieve this mail.
• You CANNOT turn these "features" off.
• You CANNOT white-list anyone.
• They DO NOT make exceptions
• They WILL NOT consider delivering the mail into a bulk folder for you to decide whether or not it is spam.
• They know best. You are too stupid to be allowed to actually receive all of your own mail.
• The specific IP Address of my VPS had been added to their internal blacklist though he couldn't tell me why or when. (The previous guy lied to me and told me that my IP was simply in a range of blocked IPs. When I pointed this out the manager refused to acknowledge the faulty information his employee had been giving me.)
• I was not allowed to speak to the all-mighty keepers of the black list, but he could put in an unblock request for me.
• There is no way for me to submit an unblock request online. (This one turned out to be another lie. Checking my SMTP logs revealed an address to submit an unblock request.)

The next day I received this form letter from GoDaddy's tech support:

Mon, Oct 26, 2009 11:07 pm

Dear Sir or Madam,

Our advanced technical support team has examined your IP unblock request. We are unable to unblock 69.60.116.244 at this time. This IP was detected sending spam to our users on 2009/03/30 08:07:45 (MST). This usually indicates a server that is compromised either from a virus or other security violations, and we cannot accept email from these sources. If the system administrator contacts us with information regarding what they have done to secure and configure the server, we can re-examine the request. Additionally, reverse DNS should specify a host which identifies the responsible administrative party as well as the server's intended use, such as mail.domain.com.

Please let us know if there is any other way in which we can help you

Sincerely,

Jason N
Advanced Technical Support

You're kidding me, right? I quickly shot back this reply:

Tue, Oct 27, 2009 12:23 am

This is very disappointing. You think my server was sending spam 7 months ago so you won't unblock it?? Firstly, I guarantee you my server was not sending spam in March, and secondly that is a very long time ago. Is that most recent "proof" of spamming you have?

Please provide proof of this alleged spam, who it was sent to, and what about the messages classified them as spam.

I assure you my server is not compromised. Its SMTP service only allows mail to be sent from localhost so it offers no open relay. It is a secure OpenSUSE install using Linux firewall with all extra ports closed. All passwords are very secure, there is no SSH allowed to the root account, and I regularly check the logs to monitor the system security. My IP address is NOT listed on www.spamhaus.org nor ANY OTHER spamming black list. What information do you have that could have possibly eluded dozens and dozens of Internet blacklists? Don't take my word for it-- see for yourself. Here are 101 known blacklists that all agree my server sends no spam:
http://www.mxtoolbox.com/SuperTool.aspx?action=blacklist%3a69.60.116.244

Please unblock my server. I have not been able to even get the results of my contact form on my website for months. I have been a long-time user of your mail service, but I am growing weary of your forced blacklists, spam phrase filters, and virus scanners for which you allow no exceptions, refuse to disable, and do not even allow for a simple whitelist feature.

Thanks.

~Brad

Later that day I get an almost identical reply from another tech support guy!

Tue, Oct 27, 2009 11:34 am

Dear Sir or Madam,

Our advanced technical support team has examined your IP unblock request. We are unable to unblock 69.60.116.244 at this time. This IP was detected sending spam to our users on 2009/03/30 08:07:45 (MST). This usually indicates a server that is compromised either from a virus or other security violations, and we cannot accept email from these sources. If the system administrator contacts us with information regarding what they have done to secure and configure the server, we can re-examine the request. Additionally, reverse DNS should specify a host which identifies the responsible administrative party as well as the server's intended use, such as mail.domain.com.

Please let us know if there is any other way in which we can help you

Sincerely,
Timothy G.
Customer Care

Ok, two can play at this let's-keep-sending-the-same-reply-over-and-over game. I pasted in my original reply again and bolded a portion. Maybe they would read it this time.

Tue, Oct 27, 2009 12:23 pm

This is very disappointing. You think my server was sending spam 7 months ago so you won't unblock it?? Firstly, I guarantee you my server was not sending spam in March, and secondly that is a very long time ago. Is that most recent "proof" of spamming you have?

Please provide proof of this alleged spam, who it was sent to, and what about the messages classified them as spam.

I assure you my server is not compromised. Its SMTP service only allows mail to be sent from localhost so it offers no open relay. It is a secure OpenSUSE install using Linux firewall with all extra ports closed. All passwords are very secure, there is no SSH allowed to the root account, and I regularly check the logs to monitor the system security. My IP address is NOT listed on www.spamhaus.org nor ANY OTHER spamming black list. What information do you have that could have possibly eluded dozens and dozens of Internet blacklists? Don't take my word for it-- see for yourself. Here are 101 known blacklists that all agree my server sends no spam:
http://www.mxtoolbox.com/SuperTool.aspx?action=blacklist%3a69.60.116.244

Please unblock my server. I have not been able to even get the results of my contact form on my website for months. I have been a long-time user of your mail service, but I am growing weary of your forced blacklists, spam phrase filters, and virus scanners for which you allow no exceptions, refuse to disable, and do not even allow for a simple whitelist feature.

Thanks.

~Brad

Tue, Oct 27, 2009 12:39 pm

Dear Sir or Madam,
Thank you for contacting online support.

I have sent an unblock request for 69.60.116.244 to
the appropriate department. They should be contacting you shortly after
the issue has been reviewed.

Please let us know if we can help you in any other way.
Sincerely,
Matt F.
Customer Care

Wow, thanks for the update Matt F. Am I unblocked yet?

Tue, Oct 27, 2009 3:29 pm

Dear Sir/Madam,

Advanced Tech Support has reviewed the issue with your IP address. When checking your IP address, 69.60.116.244 resolves to 244-116-60-69.serverpronto.com. However, 244-116-60-69.serverpronto.com does not resolve back to your IP address (which it should). According to the American Registry for Internet Numbers (ARIN), all active IP addresses must have valid reverse DNS entries. Once this is corrected, please reply back to this response. Please let us know if you have any further questions.

Regards,

Adam S.
Advanced Technical Support

What? Now you want reverse DNS too? *grumble grumble* I let them know I was on it.

Tue, Oct 27, 2009 4:20 pm

Thank you for the response. I am putting in a support ticket to my ISP now to get my reverse DNS properly configured. I will let you know when it is completed.

~Brad

And later...

Tue, Oct 27, 2009 10:34 pm

My ISP has processed my requests to configure my reverse DNS. You will now find that my IP address 69.60.116.244 resolves to bradwood.com which resolves back to the same IP address. Depending on the TTL you should be able to see these changes.

Thanks

~Brad

OK-- seriously, take me off your stupid list.

Tue, Oct 27, 2009 10:45 pm

Dear Brad,

Thank you for your response. We apologize for the inconvenience regarding this matter.

I have sent an unblock request for 69.60.116.244
to the appropriate department. They should be contacting you shortly
after the issue has been reviewed.

Please let us know if we can assist you in any other way.

Sincerely,

Robert A.
Online Support Team

Hey Thanks Robert A. What are you, the 20th DIFFERENT guy I've talked to? Less talk, more unblock!

Wed, Oct 28, 2009 5:57 am

Dear Sir/Madam,

Our Advanced tech support team has examined your issue and they have determined that your IP address of 69.60.116.244 is not eligible for unblocking. This server was detected sending spam/virus traffic at 2009/03/30 08:07:45 Mountain Standard Time. This usually indicates a server that is compromised either from a virus or other security violations, and we cannot accept email from these sources. If the system administrator contacts us with information regarding what they have done to secure and configure the server, we can re-examine the request. Please let us know if we can be of further assistance.

Regards,
Dennis S.
Advanced Technical Support

AHHHH. It's like that Star Wars episode where they got stuck in an endless loop reliving the same thing over and over. Wait, maybe that was Groundhog Day...

Wed, Oct 28, 2009 11:35 am

How many times must we have this conversation? Do you guys read anything I send you? I am the system administrator and I am telling you that there was no spam being sent from my server.

I have repeatedly asked you to provide proof of this alleged spam. My IP address is not blocked by ANY OTHER blacklist on the internet.
Please provide whatever special information you have about my server that has apparently alluded every other blacklist in existence and makes you think I am a spammer.

My server is very secure, and is not compromised. Lastly, the "date" you keep providing was 7 months ago! Are you serious? Please stop sending me the exact same form letter back and answer my questions.

~Brad

And later, just for good measure...

Wed, Oct 28, 2009 11:59 am

I have reviewed my Exim logs of all outgoing mail on my server on 2009/03/30 and found nothing out of the ordinary. Every piece of mail sent from my server on that day was sent to someone expecting mail from me. I would submit to you that you are wrong. You quite possibly identified perfectly fine mail traffic as spam when it was not. Please single out the mail messages sent out on 3/30/2009 that you think are spam and I will cross reference them with my logs to prove that they are not spam.

~Brad

Wed, Oct 28, 2009 3:59 pm

Your inquiry has been received. You should expect a response within 24 hours.

This is your Incident ID: 7690813

Thanks,
Customer Service

Hmmm, this guys name is apparently "Customer Service". I wonder how Mr. Service got a name like that.

Wed, Oct 28, 2009 4:51 pm

Dear Sir or Madam,

Thank you for contacting online support.

I have sent an unblock request for 69.60.116.244 to the appropriate department. They should be contacting you shortly after the issue has been reviewed.

Please let us know if we can assist you in any other way.

Sincerely,
Andrew S.
Customer Care

Gee Andrew S... do you mind if we are on a first name basis? I hate all of this "Sir/Madam" formality. I'd settle for a "Hey dude, you're unblocked now" message.

Wed, Oct 28, 2009 8:12 pm

Dear Sir/Madam,

At this time we cannot complete the unblock request for the IP address 69.60.116.244 as it was detected sending Spam to our users on 2009/03/30 08:07:45 (MST). Please use this information to review your mail servers log files and determine the offending message.

Also, the HELO message on the server during a telnet connection does not match that of the host name associated in the reverse DNS of the IP address.

When steps have been completed to prohibit a repeat occurrence, reply to this message outlining the steps taken so we can further process this request. We appreciate your understanding in this matter and please let us know if we can help you in any other way.

Please let us know if we can help you in any other way.

Sincerely,

Chris K.
Advanced Technical Support

GAAAAAAHHH. *bangs head on wall* *volcano erupts* *Hindenburg crashes* *men in white suits edge in closer* OH THE HUMANITY!! Ok, the gloves are off. No more mister nice guy.

Wed, Oct 28, 2009 11:34 pm

Hello? Do you guys even read the E-mails I send to you???
You keep throwing this 3/30 date out there (which I will point out was 7 months ago) and I have REPEATEDLY asked you to show proof of these alleged spam messages, but you keep ignoring my requests and sending me the SAME FORM LETTER over and over again.

And what's up with the telnet HELO name? I've had numerous E-mails from you and NONE of them mentioned it until now. Seriously, I don't even know why it matters. My mail server doesn't allow open relay so any connections on port 25 are in vain. Regardless, I changed the HELO name just for you so it says bradwood.com. Are you happy?
I already set up the reverse DNS for you, but apparently that wasn't enough to make you happy.

I've already given you the following information, but I'll repeat it once more since you all seem to have very short memories.

I HAVE REVIEWED MY EXIM LOG FILES FOR THE ENTIRE DAY OF 3/30/2009 AND CAN UNDENIABLY CONFIRM BEYOND A SHADOW OF A DOUBT THAT ALL THE E-MAILS GOING OUT THAT DAY (THERE WASN'T THAT MANY) WERE TO PEOPLE WHO HAD SPECIFICALLY REQUESTED TO RECEIVE THAT MAIL. NO SPAM WAS SENT ON 3/30/2009 AND YOU HAVE FAILED IN EVERY WAY IMAGINABLE TO PROVE ME OTHERWISE. YOU REFUSE TO DIVULGE ANY INFORMATION ABOUT THE MESSAGES YOU CLAIM TO BE SPAM IN ORDER FOR ME TO DEFEND MYSELF. IN FACT YOU HAVE YET TO EVEN ACKNOWLEDGE MY REPEATED REQUESTS FOR YOU TO DO SO.

Please, please, please stop sending me the same form letter over and over and stop making up silly "chores" to do on my server.

Let's run down the things I have already done for you:
1) I set up reverse DNS at your request
2) I synced the HELO name returned by my SMTP service at your request
3) I have reviewed and re-reviewed my logs for 3/30/2009 and see no unsolicited mail of any sort. All my logs show are error messages from your servers blocking mail to MY OWN FREAKING ADDRESS. That's right, you were blocking my OWN mail from MY OWN server that was supposed to be sent to ME on that date. Good job. I'm glad you're doing your part to keep the Internet safe.
4) I have double-checked my server to ensure it is free of viruses, malware, root kits, trojans, or anything else that would classify it as compromised and it is clean.
5) I have tried to be very nice even after sitting through an hour-long phone call with your bumbling tech support and reading your endless form letters while you seem to ignore everything I ask.

Now, please unblock my IP address so I can at least get mail from my OWN server.

Thank you.

~Brad

Please don't send me another form letter. Please don't send me another form letter. Please don't send me another form letter. Please don't send me another form letter. Please don't send me another form letter.

Thu, Oct 29, 2009 3:26 pm

Dear Valued Customer,
Thank you for contacting Advanced Technical Support. We have unblocked 69.60.116.244.

Please let us know if we can help you in any other way.
Sincerely,
Ray C.
Advanced Technical Support

*angles sing* *clouds part and rainbow appears* Thank you GoDaddy. Thank you phone-answering-janitor-who's-never-heard-of-SPF-records. Thank you rude manager who couldn't wait to get me off the phone. Thank you Jason N, Timothy G, Matt F, Adam S, Robert A, Dennis S, Customer Service, Andrew S, Chris K, and Ray C. Without your blind, clueless, form letters, lies, and ignorance none of this would have been possible.