- Products
- Network Security
Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
Security ServicesComprehensive security for your network security solution
Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
Capture ATPMulti-engine advanced threat detection
Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
Secure Mobile AccessRemote, best-in-class, secure access
Wireless Access PointsEasy to manage, fast and secure Wi-FI
SwitchesHigh-speed network switching for business connectivity
- Email Security
Email SecurityProtect against today’s advanced email threats
- Cloud Security
Cloud App SecurityVisibility and security for Cloud Apps
Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
Capture ClientStop advanced threats and rollback the damage caused by malware
Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
- Support Widget
- Products
- Network Security
- Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
- Security ServicesComprehensive security for your network security solution
- Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
- Capture ATPMulti-engine advanced threat detection
- Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
- Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
- Secure Mobile AccessRemote, best-in-class, secure access
- Wireless Access PointsEasy to manage, fast and secure Wi-FI
- SwitchesHigh-speed network switching for business connectivity
- Email Security
- Email SecurityProtect against today’s advanced email threats
- Cloud Security
- Cloud App SecurityVisibility and security for Cloud Apps
- Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
- Capture ClientStop advanced threats and rollback the damage caused by malware
- Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
- Support Widget
SonicWall HES IP address blocklisted by UCEProtect or Backscatter
05/03/2022 
1 People found this article helpful
28,763 Views
Description
Outbound emails from customers are being rejected or bounced with a message showing one of SonicWall's HES sending IP addresses as being blocked.
What is backscatter?
Backscatter emails are automatic responses via email (such as non-delivery reports, delivery confirmations and out-of-office notes), or so-called bounce messages. If the sender of the original email is faked, it can happen that said emails are delivered to innocent third parties.
UCEProtect and Backscatterer.org are owned by the same organization. UCEProtect and Backscatterer will list IPs that send spam and/or send backscatter (misdirected bounces). Both of these blocklists are considered extreme in that their listing policies are aggressive enough that we typically see very little actual impact to email flow.
UCEProtect is a public DNSBL that lists IPs that send spam to their spam traps. UCEProtect also charges a delisting fee which SonicWall will not pay and does not recommend paying for list removal.
Backscatterer.org lists IPs that send backscatter spam (misdirected bounces). Backscatterer.org also charges a delisting fee which SonicWall will not pay and does not recommend paying for delisting. Additionally, in our experience, we typically see very little actual impact to email flow due to Backsatterer.org's aggressive listing policies.
SonicWall’s recommendation is not to use SMTP rejects for backscatterer hits, but to process them as softfail: e.g., quarantine or tagging. But not to use a reject or bounce. This often prevents legitimate business transactions, which are extremely frustrating for end users. The external communication partner should not use the blocklist of backscatterer.org as the only classification criterion.
We recommend that SonicWall HES users contact the communication partner in order to achieve a configuration adjustment. In addition, if using Microsoft Exchange or O365, an outbound connector can be configured to send directly to the recipient domain.
Learn more at How to add O365 connector for domain specific routing.
Related Articles
- Windows Defender Smartscreen in Edge is blocking SonicWall's Rewritten Sandboxing URL
- Generate & Import a SSL certificate (PKCS#12) file for import on an Email Security appliance
- How to manually create FTP backup from CLI - Email Security appliance
YES
NO