1

okay, so, here's the sitch...

i've got a website that utilizes phpmailer to send form submissions to email via Mandrill.

please understand that this has been working perfectly for many months, and NOTHING about our code has changed!

i discovered a few weeks ago that the emails had stopped coming thru. after some investigation, i discovered that every email sent to the email address that phpmailer/mandrill sends the form submissions to, bounces back... no mater what.

so after some time communicating with our server admin, i found out that a few weeks ago, a different account on the server was compromised & used to send out a bunch of spam; and thus the server IP address was put on several of the big internet blacklist lists.

the server admin has fixed the vulnerability in that other account and is attempting to get the server UNblacklisted - but that process is taking FOREVER!

unfortunately, due to finances & other circumstances, i do not have the option of moving our website to a different server at this time.

what i'm confused about is...

  1. since our website & the phpmailer script is using a Mandrill account, and mandrill smtp settings, then why wouldn't the emails be able to hit the Mandrill server to be sent out?
  2. in looking at the Mandrill logs AND after consulting a Mandrill tek support person, phpmailer submissions are not even reaching Mandrill anymore, as they used to. so how does that process really work (in simply laymen's terms please)?

so my question is...

  1. so just because the site & phpmailer script reside/hosted on a server whos ip address is email blacklisted, that means ANY submissions being sent out from that will be blocked? even tho we are not using the email services from this server?
  2. is there a workaround to this situation to be able to get these emails to go thru whilst remaining on this server?

if anybody could throw some advice/thoughts/tips/tricks my in simple layman's terms, i'd really appreciate it.

THANKS!

  • It sounds like your best option is to get your app to use Mandrill again. What went wrong? I cannot say. You may have to get on the phone with Mandrill again and walk through setting it all up and making sure it works. I will leave room for someone who may have expertise in this area to answer. I wish I had an answer for you. But you do have my empathy. I am sure there is a solution for you. I rather suspect it starts with talking more closely with Mandrill. – closetnoc May 3 '15 at 5:19
  • Did you make any changes on your server? Does phpmailer have logs? – Daniel F May 4 '15 at 2:32
  • @closetnoc, thanks for your comment & empathy. i have had discussions with Mandrill and they assure me there is nothing wrong with my code nor their service. it's definitely the blacklist issue with our server. – SyberKnight May 4 '15 at 4:12
  • @DanielF, no there were no changes made on the server from my end. and the logs don't tell us anything useful; i suppose since it's not really anything wrong with my code or account. – SyberKnight May 4 '15 at 4:14
  • 1
    What if because you are blacklisted the Mandrill server is refusing your SMTP requests. How much work would it be to rewrite it using the REST API? From what I remember they're pretty similar. – Daniel F May 5 '15 at 2:41
1

Your problem is probably that because you are on an IP blacklist the mail that you are sending Mandril is never getting to them.

If I were you, I would look into the REST mandril API. They probably have a php client, and I remember a lot of examples on their website.

EDIT:

Here is a simplified diagram of how to message is sent

Your server ---> Mandrill ---> End recipient
             ^ 
             |
       In all the arrows, including this one, the message is transmitted through email.

Your code is just sending an email to Mandrill with special additional content that tell Manrill to forward the message to its final recipient, so it would be subject to similar blocking.

| improve this answer | |
  • The Mandrill PHP client can be found here: bitbucket.org/mailchimp/mandrill-api-php though I would probably check with Mandrill that they don't have the same security measures in place for the REST API as they do the SMTP API. I would think they would block blacklisted IPs from both, but maybe not. – nathangiesbrecht May 5 '15 at 14:43
  • hi guys, thanks for the comments. i'm afraid i don't know anything about REST. i'm not a programmer (except for html/css). so how it was explained to me by the server admin is that, since their IP is on several big blacklists, when phpmailer sends submissions to Mandrill, they're "outer layer" server saw the IP being on blacklists & blocks the submissions. apparently, that layer doesn't communicate with the inner layer that my account & analytics is on; so as far as it knows, it simply never receives the submissions. so there's nothing i can do until they get off the blacklists. :-( – SyberKnight May 5 '15 at 20:08
  • and, i'm getting confused by these options... first, in the phpmailer script, i use the SMTP settings Mandrill provides. is that not the same thing as using their API? please explain that to me. when looking at your link as well as others i've found, are they all not just examples of how to use Mandrill in your scripts? i've not read about them because the original php programmer we had had it working with the settings in phpmailer seemingly fine. – SyberKnight May 5 '15 at 20:11
  • I guess you need to talk to mandrill again at this point. – Daniel F May 5 '15 at 22:41
  • @all... so, can somebody give me a detailed explanation in layman's/simple terms about the path this process takes? if the phpmailer script has the mandrill smtp, port, & account info it tells you to use, then doesn't that essentially bypass my servers mailserver & use mandrills in its place? then if that's true, why would it matter at all if my servers mailserver is blacklisted? i'm not seeing how it's can be affected by that if it's going directly to/thru mandrill instead. thanks. – SyberKnight May 7 '15 at 4:37
1

The problem is that your blacklisted, and Mandrill won't want to send email for what they consider to be spammers.

As far as I can see, you have 2 options.

The first, obvious solution is to get yourself removed from all the blacklists that you can. In my experience this has usually taken less than 24 hours, but that was also years ago so could be longer.

Alternatively instead of changing servers, you could ask your hosting company if you can simply get a new IP address, as they'll likely have a pool of them to work with.

| improve this answer | |
  • good suggestions. thanks. i will inquire about the IP address option. – SyberKnight May 5 '15 at 20:06
1

The solution is: Fix the vulnerability (which you did), set up SPF and DKIM for the domain (which your admin probably did already), then request to get yourself off the blacklists. After that it will work.

You can use http://mxtoolbox.com/blacklists.aspx to check which blacklist(s) an IP is on, then email the list to request removal. It still takes less than 48 hours to get removed from blacklists in most cases, if you use the proper communication channel to get ahold of them. Obviously you can't email them via your blacklisted IP (since they will block the request).

| improve this answer | |
  • Excellent point about using SPF and DKIM. Likely want to verify the domain in Mandrill also. – nathangiesbrecht May 5 '15 at 15:00
  • @nathangiesbrecht Amen, good point also about Mandrill verify. For the OP SyberKnight: Keep in mind, you also need SPF (and possibly DKIM) in order to send email to AOL/Yahoo/Hotmail/Live users. They will hold all messages to those domains in limbo query (undeliverable) without it. Trying to persistently send emails to users on these TLD's without verified sender/domain mechanism will result in yet another way you could be added to a blacklist. Mandrill won't like that too much either. – dhaupin May 5 '15 at 18:20
  • @dhaupin & nathangiesbrecht, thank you for your comments. what is SPF & DKIM? i see that option in Mandrill but have no idea what to do about it. the script'n'emails have been working for over a year without. remember too, my account was not the cause of the blacklisting. also, the 48 hours floored me; it's been over a week so far w/the server admin dealing with the issue & still not resolved. – SyberKnight May 5 '15 at 20:05
  • SPF and DKIM are DNS TXT records that you add to specify that other servers (ie. Mandrill) are allowed to send on your behalf (SPF), and to verify that the contents of the email has not been altered (DKIM). Even if your mail was working previously, SPF and DKIM will decrease the # of your emails that get filtered to spam. I'd take the bull by the horns and contact the blacklists yourself to get removed if your hoster isn't getting it done. Use the mxtoolbox.com link above to find which blacklists you're on and contact them directly and explain your situation. – nathangiesbrecht May 6 '15 at 14:27
  • @nathangiesbrecht - thank you for your explanation & advice. i'll be starting my bull run tomorrow. – SyberKnight May 7 '15 at 4:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.