The Hidden Gotcha of Spam

Origin: ZDNet
Source: David Berlind
Date: 31/10/2002


In the recent account of my struggle to employ wireless computing at a Florida technology conference, I described my attempt, when all else had failed, to use a Web-based POP3 e-mail account. That backup plan failed, too, but for reasons I never anticipated--and there's a lesson here for all of us. The source of my woes? Spam.

After I was unable to access my company's corporate e-mail systems in order to send a draft of a column to my editor, I used a browser to access a POP3 e-mail account by the Web hosting company that hosts one of my personal Internet domains.

For under 10 bucks a month, ReadyHosting hosts my Web and ftp sites and gives me access to an e-mail server where I can establish separate e-mail accounts for family members and friends. I also use the site to Web serve digital pictures and to play around with CGI and Perl scripting. It's a great deal.

Prior to becoming a ReadyHosting customer, I ran my domain-- including a Web, ftp, and e-mail server--out of my basement. The neighbors were quite impressed when they saw the data center, replete with tower servers and drive arrays. But, impressive as a personal data center is, so too is the amount of time it takes to tend to one. Once other people started to rely on it for things like e-mail, I was on the hook to keep it running 24/7. It was fun, but it was the last thing I had time for. Outsourcing the responsibility of running it to a third-party, especially one that would charge me only $99 per year, was worth it. ReadyHosting was also highly recommended by CNET's Web hosting service finder .

But after that failed attempt to use my ReadyHosting-provided e-mail account from Florida, I began to wonder whether I should switch providers. Not only did my editor not get my e-mails, but my wife started complaining that no one was receiving her e-mails.

The likely reason for that failure, according to ReadyHosting's technical support, was that the physical server running my domain's e-mail system was blacklisted by other Internet service providers because it was identified as a source of spam. How could that be? I never spammed anybody.

One of the most common ways of dealing with spam is through the use of blacklisting services. For example, spamcop.net can digest your spam and notify all of the ISPs through which the spam passed that you were spammed and what system the spam came from. If those ISPs get enough of these notifications about one source, that source is blacklisted so that any outbound mail from the spammer's system is prevented from passing through their networks.

So, why was my mail, which wasn't spam, caught in the blacklisting dragnet? Because the server that ReadyHosting uses to host my e-mail system, along with its unique Internet protocol (IP) address, is shared with other Readyhosting customers and their domains-- and one of those customers is apparently a spammer. Since my e-mail system shares an IP address with the spammer's e-mail system, and blacklisting is usually based on IP address, all outbound mail from that system, whether it was mine or the spammer's, was blocked.

While ReadyHosting's president David Fricke didn't return my call or e-mail, I was able to learn from Ipswitch, Inc. product marketing manager John Korsak why such guilt by association was possible. Ipswitch makes iMail, the e-mail server software used by ReadyHosting to provide its customers with their own e-mail domain. Korsak says Ipswitch's iMail is running on about 30 thousand servers around the globe. According to Korsak, "there's a feature in iMail that allows a company like ReadyHosting to host multiple domain names on one IP address. Hosters find this very useful from a management perspective and because the number of available IP addresses is limited. But, from the domain owner's standpoint, the domains are completely independent."

ReadyHosting solved my problem by moving me onto a different physical system where I'm not sharing an IP address with a spammer. The technical support person I talked to said that it would take about 48 hours before everything was back to normal. It took over two weeks. In some cases, it took several days for my e-mails to make it to their intended recipients. Some intended recipients never got my e-mails.

Korsak says that the real solution for any consumers or businesses considering outsourcing their hosting is to make sure that they get a unique IP address to go with each domain.

"If you're not a spammer and you have your own IP address, then your e-mails should be able to avoid the blacklists," says Korsak. "iMail can work either way. Each domain can have its own IP address, or it can share an IP address with other domains. The licensing costs are the same for either configuration, so going one route or the other doesn't affect the price a licensee pays. That said, the trend for our customers over past two years has been to associate one IP address with any number of domains."

So, why don't hosters give every domain a unique IP address? There aren't many of them left, and there's an added expense associated with owning extra IP addresses, or blocks of them (which are even harder to come by). According to Korsak, "the number of domains is skyrocketing while the number of IP addresses remains fixed."

Relief is supposedly on the way. A new addressing scheme called IPv6 (we're currently under IPv4) is designed to greatly increase the number of possible addresses. But the Internet has been slow to move to the new scheme because migrating the entire Internet and all of its users is much easier said than done. But when and if that migration finally takes place, e-mail server vendors like Ipswich will likely build support for IPv6 into their products. Whether ReadyHosting and other Web hosters that share IP addresses amongst domains will offer unique IP addresses to their customers is a different question.

That's why you choose your Web hosters carefully, and see if you can get your own IP address. When I called ReadyHosting's sales department, a representative name Lissa aid "we do not offer unique IP addresses. IP addresses are shared here. The idea has been discussed, but currently, we have no plans to change that policy."

I can't fault ReadyHosting for this policy. Given the price, the service it offers is still a great deal, as long as it responds to situations like mine in a more timely fashion. For a bit more money ($120/year), ReadyHosting's competitor, aplus.net, offers a similar service with shared IP addresses, but with less storage and fewer allowed email addresses. ReadyHosting's prices are competitive. What aplus.net offers that ReadyHosting doesn't is the ability to get a dedicated IP address. But that privilege will cost you double--$240 per year.

Given ReadyHosting's value, and as long as I don't experience another interruption in service, the chances are slim that I'll switch to a more expensive service. But the experience is a great reminder: You get what you pay for.