Why are some of my messages tagged with "[Blacklisted Sender]" and "[Foreign Sender]"?

By default, the IP address-based filters (Country Blocking and Real-Time Blacklists), are enabled but don't block matching email. They only flag it as suspicious and modify the subject line with [Blacklisted Sender] and [Foreign Sender] as a warning to the recipient.

Country Blocking

The Country Blocking is static. If a sender's email is coming from an IP address in a foreign country that you are subscribed to for the Country Blocking feature, the message will be tagged with "[Foreign Sender]". It doesn't matter whether the message is spam or not. However, if it may be coming from a country that is known for sending a lot of spam. If you only have contacts in the United States, it's possible that these messages are unwanted, but the email did not trigger any of our spam filters. The tag is informational only and it may help you to determine whether to look at the message.

Real-Time Blacklists

The third party Real-Time Blacklists are maintained by third parties. These blacklists are of IP addresses that were reported to have sent spam to their users. If a sender's email is coming from an IP address on one of the blacklists that you are subscribed to, the message will be tagged with "[Blacklisted Sender]". We don't maintain these blacklists, and you will want to contact the list maintainer in order to determine why one of your senders was listed. The status of an IP address being listed does change, and it doesn't require any changes on your end to get more of your legitimate or spam email tagged by this filter from one day to the next. It just depends on who you receive email from, and whether they're listed in the real-time blacklist that day. It's possible that these messages are unwanted, but the email did not trigger any of our spam filters. The tag is informational only and it may help you to determine whether to look at the message.

Many organizations get listed in a real-time blacklist because a workstation on their network is sending spam. This can be the result of a virus infection, or simply a malicious spamming user, or unsound mailing list policies. Many ISPs could also have their email servers listed temporarily for the same reason, causing all email from that ISP to be tagged for awhile.

These filters typically will only identify less than 1% of your email. If you don't find these tags useful, you can disable them by unsubscribing from these filters in the SpamStopsHere Control Panel. Many anti-spam products only use these types of IP address based filters, and it used to be common to block messages identified by them. Due to their inaccuracy, we don't recommend DELETING or REJECTING messages caught by these filters, so there is no need to QUARANTINE (Professional and Enterprise Edition) the messages or whitelist the sender. These types of filters should simply be used to provide additional information about the source of the email message.

If you receive spam to your inbox that contains this tag, please report it to the email address provided to you for reporting spam that was not properly identified.

Our accuracy was rated #1 in the industry by Network Computing magazine without using these IP address based filters.

How can I explain messages tagged with "[Blacklisted Sender]" to my users?

This tag on the subject line means that the sender's server is on a Realtime Blackhole List (or "RBL") and that although this message was allowed through, many other services are possibly blocking messages outright.

Sometimes a server can be put on an RBL because one of their users was infected with a virus, or in some other way they were sending spam at one point. This does not mean that they are still sending spam, or that this message is spam. In fact, the reason SpamStopsHere doesn't block based on RBLs is because they frequently catch legitimate email as "spam". Typically, either their IT department will get their server's listing removed from the RBL or the RBL itself will remove the listing after a little time has passed (hours, days, sometimes weeks). Nothing is required on your end to fix this.


What should I tell my contacts if their messages are tagged with "[Blacklisted Sender]"?

This tag on the subject line means that the sender's server is on a Realtime Blackhole List (or "RBL") and that although this message was allowed through, many other services are possibly blocking messages outright.

Our service, SpamStopsHere only blocks messages on our proprietary filters by default since we can ensure that only 1 out of every 100,000 legitimate emails are accidentally blocked as spam (called a "False Positive"). Other services, however, often rely heavily on RBLs to catch spam. RBLs catch significantly more legitimate email (as is evidenced by the fact that your legitimate email was tagged by one), and many other mail services are likely completely blocking your email as a result of your mail server being listed on an RBL.

What can your contact do about this?

Have them let their IT department know that their mail server is on a blacklist and that they may need to take remedial action to remove the listing. Some RBLs remove IPs after a period of time (hours, days, or weeks), others require contacting them to get delisted. Once the mail server is not listed on these RBLs anymore these messages will not be tagged by SpamStopsHere, and will have a much better chance of reaching other recipients that block based on RBL Listing.


I see that I have a personal blacklist, can I just block the spammers myself?

We do not recommend attempting to block spam using your own domains blacklist. Spammer's sending domains, addresses, and IP addresses change extremely often or use legitimate, but temporarily hacked websites. Using your own blacklist could potentially block legitimate mail.


Other Resources