Remain calm!  Please read all of this message before acting.

We have received mail from your site that our system thinks is junk
mail, because it was sent to a `spambait' address.  We have therefore
made an entry for you in our blacklist for the offending system's IP
address (see the Subject line).  This blacklist entry will last for a
considerable time.

The Date header of this blacklist notification will be within a few
minutes of the offending message delivery attempt, and will be during
the life of the relevant SMTP session.

Your action now should depend on the nature of the IP address above:

1. End-user system with dynamically allocated IP address:

   Identify which user was using the IP address at that time.
   Probably the user has a virus infection, open proxy, or other
   computer security problem.  You should notify the user, giving your
   usual antivirus/security advice.

   We understand that the information we have provided above will
   probably not be specific enough for you to take Terms Of Service
   action against the user, or to completely resolve the issue.
   However, since we do not keep the junk mail we will be unable to
   provide more information.  This notification is a courtesy, and to
   allow you to warn your user and/or take other investigative steps.

   There is no harm in a dynamically-assigned end-user IP address
   being blacklisted as an SMTP sender, so the blacklist entry can
   stand.

2. One of your designated outbound mail servers:

   Use the timestamp information above to find the mail transaction in
   your logs.  You will then be able to identify the source of the
   junk mail and take appropriate action.  If your system has very
   high mail volumes then you may need to contact us for further
   information - see below.

   If the blacklisting entry turns out to be a mistake we will of
   course unblacklist you.  However, we do not unblacklist systems
   which have genuinely sent junk mail, except in response to an end
   user request.

3. A system with fixed IP address which should not be sending mail:

   The system is misconfigured and should be secured so that it cannot
   be abused by spammers or viruses.  The blacklist entry can and
   should stand.

There is usually no need to contact us about this blacklist entry.  If
you feel the need to write to us, please read the following common
questions and answers, first.  If you send us a message which is
covered by one or more of the following answers, we will simply ignore
it.  This includes automated replies, or semiautomated form letters.


Q. Please provide full headers of the junk mail.

A. We do not keep the headers or texts of the junk mails.  You should
   be able to identify the message or user in question from your logs.


Q. We do not keep our logs that long, so cannot identify the
   source of the junk mail.

A. As a participant in the Internet, we feel it is your responsibility
   to keep such logs, for a few weeks at least.  If you choose not to
   do this for operational (ie financial) reasons then you must accept
   the consequences, which include being blacklisted for sending junk
   mail.


Q. We have too high a mail volume to identify the transaction from
   only the timestamp.

A. Please contact us, as directed below, and we will supply some
   additional information about the offending mail.  We will usually
   be able to supply the recipient domain name and recipient host, at
   our end, and in some cases we can supply the envelope sender or
   part of it.

   We may also be able to provide a specific timestamp of the
   offending RCPT or DATA command.


Q. We run only confirmed opt-in lists.
Q. Tell us the email address you want removed.

A. Based on our logs, we are sure that the email address you mailed to
   could not have participated in an opt-in confirmation.  We are
   therefore sure that your list is not confirmed opt-in.

   To stop spamming, you must throw away that list completely.  If you
   bought it from someone, you should consider legal action against
   them.

   We will not tell you the bait email address, because that would
   allow spammers such as yourself to `launder' the list of bait
   addresses, decreasing the effectiveness of our antispam measures
   while allowing you to continue to use the spamlist.


Q. How dare you blacklist us without showing us proof !

A. We recognise that the information we have provided will not
   necessarily be convincing to you, or to a third party.
   Nevertheless, it (and other information that we are not prepared to
   reveal, such as the recipient bait address) is convincing to us,
   and it is our choice who we put on our blacklist.


Q. Please resend your report (and/or please direct future messages)
   to abuse@example.com instead.

A. Our system determines the email address to report to automatically
   by querying the DNS and using the only local-part (`postmaster')
   that the RFCs mandate *must* exist.  We do not keep a database of
   sites and corresponding abuse addresses, as we do not wish to incur
   the expense of maintaining one.  A WHOIS query might yield a
   different address, but automated use of WHOIS in this way might
   easily be considered abuse.  It is therefore not possible for us to
   mail to a different address.

   Please forward the notification to the appropriate part of your
   organisation, yourself.  If this is not convenient then you may of
   course ignore the blacklist notification.

   If you object to the notifications and wish us to ensure that you
   do not receive any in the future, please notify us - using the
   contact information below - of all of your IP address ranges.  We
   will then arrange to block all email from your systems, and there
   will be no need to send you any blacklist notifications.


Q. It was an open relay and has been fixed.
Q. We had a virus but have cleaned it out and improved our security.
Q. We have warned/terminated the user.
Q. We are a large ISP and our many users will be blocked.
Q. We have strong abuse policies, and this is an isolated incident.
... so please unblacklist us.

A. It is our policy to blacklist any sending site (by IP address)
   which sends our systems junk mail (including spam and viruses) and
   which does not have, at that time, an established email flow to us.
   In most cases we do this entirely automatically.

   We keep such blacklist entries until they expire, or until a need
   arises for an end-user of a blacklisted mail relay to contact one
   of our users.  When such an end-user's mail is rejected with a
   `blacklisted site' message, we hope that they will contact their or
   our postmaster (postmaster mail bypasses the blacklist) and we will
   then remove the blacklist entry.

   We do *not* remove blacklist entries just because the original
   problem, which opened the flow of junkmail from the blacklisted
   site, has been fixed.  We feel that an organisation which has made
   configuration errors allowing their systems to be abused for junk
   mail, or whose customers or users did so, is quite likely to make a
   similar mistake in future; this is much more probable than that
   they actually need to mail one of our users.  Therefore we feel
   that unblacklisting because the affected site claims the problem
   was found and fixed is not beneficial to our users.

   Likewise, we do not remove blacklist entries merely because of the
   size of the offending site.  It is not to our users' benefit to
   unblacklist large sites with many users, some of whom send junk to
   us, but none of whom currently want to talk to our users.

   Note that although in order to have a 0% collateral damage rate
   from our blacklist, you would have to have a 0% junkmail rate, that
   does not mean that we demand that you run our site in a way that
   completely eliminates all junkmail sent or relayed by it to the
   rest of the Internet.  We merely ensure, via our software and
   policies, that not all of the costs to us of junkmail from your
   site are borne by us and our users - instead, we return some of
   those costs to you in the form of blacklisting and hassle.

   Many other sites on the Internet operate similar (or even harsher!)
   policies to ours, but most do not notify site administrators of
   blacklistings.  You may find that your users will, after this junk
   mail problem, encounter a somewhat greater rate of mail
   difficulties with other sites besides ours.

   If you find these costs unacceptable we recommend that (in the case
   where your users or partner organisations are the root cause) you
   institute stronger local policies that allow you to recover your
   costs from those more directly responsible, or that (in the the
   case of errors on your part) you acquire more expertise to avoid
   mistakes in the future.

   We hope this explanation has been clear and helpful, and has not
   caused offence.  If you have further questions please mail us
   again.


Q. What is a `spambait address' ?

A. A spambait address is one which is published in newsgroups, web 
   pages, etc., in a way that will encourage automated address
   harvesters to pick it up, but with context which clearly
   discourages the human reader from using the address.  Whenever our
   system receives a mail for a bait address it automatically
   blacklists the sender.


Q. I would like to contact you.

A. Certainly.  Please read the Q-and-A above, and if your question is
   still not answered then you should contact us using the address
   `sauce-admin' at the hostname above.  Ie, replace `sauce-daemon'
   with `sauce-admin'.  That will bypass the blacklist.

   Do not reply directly to this message, to `sauce-daemon', as such
   mail is blocked or ignored.

-- 
