I learned a couple of days ago my mail server got blacklisted by spamcop.net. They don’t reveal the reason for it, but it’s likely that I was blacklisted for running an autoresponder, in this case my own custom challenge/response spam filter which is the oldest operating one I know of.

I understand the debate about the merit of C/R spam filters. Like all autoresponders, they can generate unwanted mail when spammers and viruses send mail with a forged From address, and the responder annoys the innocent victim. However, this is a problem common to all autresponders, and unlike the even-more-hated open-relay, it doesn’t magnify the spam problem — there is one possibly annoying response per spam, not hundreds.

I am bothered because I don’t want to see anti-spam advocates fighting other anti-spam methods because they don’t agree with them, or blacklists in general used to punish people you don’t agree with. Spamcop should be fighting spammers, not anti-spammers.

In addition, e-mail autoresponse is an important mail tool. In fact, anti-spammers insist that mailing lists do a confirmed opt-in (also known as double opt-in), generally by autoresponse, before adding a person to a mailing list. When a mail server bounces directly delivered mail it can avoid doing an autoresponse, but if mail comes in through an MX — a vital feature of mail — it requires an autoresponse to bounce it. Vacation programs and many other tools use this ability.

Check to see if your mail system uses spamcop.net as a blacklist. If it does, disable it or switch to something else until they change this policy. Otherwise you won’t receive mail from me, and many others.

Update: My server is no longer blacklisted. I didn’t do anything (other than this blog post and a few complaints to people using the spamcop BL) so perhaps they auto remove. But it could happen again at any time until they change their policy. This is also a nasty DOS attack. Find anybody with any autoresponder, including a bounce of MX’d mail. Send forged mail to it with a From set to a spamtrap address — and they’re blacklisted. Also can be used against any sites that have you enter an E-mail address on a web page and then email that address to confirm you own it — you can get these sites blacklisted trivially. Every web form that can enter an E-mail address is at risk.