email sent to us from outside during this time period was rejected and should be resent.  Internal email was

not affected.

some duplicate messages.  The backlog should clear up over the weekend and email should be back to normal on

Monday.  We’re in the process of replacing this email server entirely so that this doesn’t happen again.

I’d like to explain what happened to our mailing list server that caused the large temporary backlog of messages. We fell victim not to a focused spam attack, but to the collateral damage of a spammer, so to speak. A spammer pretended to be sending possibly millions of spam messages from one of our lists – by forging the mail they sent to make it look like it was coming from the list’s address. The result was thousands upon thousands of “bounce” messages that were sent from around the world to our Sympa server.

Spammers generally have many thousands of bad email addresses in their sneakily gathered lists, and any email to a bad address generates a bounce. That bounce is sent to the sender’s (or in this case, the faked sender’s) address. The huge number of incoming bounce messages had to be processed by the Sympa server as they arrived, and the volume of additional bounces bogged the server down terribly, causing a backlog to build up. We identified the list that had been impersonated, shut it off (so the server would no longer concern itself with bounces to that list), and began culling the bad messages from the queue.

We are investigating whether there is anything we can do in order to prevent this in the future. It is a problem plaguing many high volume list servers. The difficult part is that the bounces themselves are not spam to be filtered, and filtering all bounce messages would break an important function of email servers.

The Sympa list server is now operating as normal again, and will be caught up with its message backlog within a few hours.

Matthew Ivaliotes
Information Technology & Telecommunication Services
American Library Association
(312) 280-4266

We have contacted Yahoo to explain that these emails were sent to subscribers of lists (such as AL Direct, which went out on Wednesday). We’ve received a reply, part of which is quoted below. According to Yahoo, the situation should be self-correcting: our email server retries sending messages. We are also investigating Yahoo’s best practices for bulk email, to attempt to lessen our resemblance to spam.

We’ll know more later today, now that the server has finished processing the backlog.

Tim Smith

From Yahoo:

“If you are seeing a 421 error code in your SMTP logs indicating that the messages you are trying to send are ‘temporarily deferred due to user complaints,’ this means that we have observed unusual traffic patterns from your IP address and have been getting considerable complaints from our users regarding emails from your server.

This is not a permanent error; your system may automatically re-try at a later time.”

If you have any questions or concerns, please let us know.

We apologize for any inconvenience.