This forum is closed to new posts and
responses. Individual names altered for privacy purposes. The information contained in this website is provided for informational purposes only and should not be construed as a forum for customer support requests. Any customer support requests should be directed to the official HCL customer support channels below:
Post the headers (espacially the received part) of one or two of the spam mail. Perhaps the address is saying .in, but it is being releayed thourgh another country?
The blacklist only check the IP of the SMTP server connecting to your MX, not originating IP or any of the machines on the way.
I suspect that the connection is coming from somewhere else, that is why you want to use blocklists like SORBS and Spamhaus Zen. Those block spammy ISPs and known spammers/relays.
Five or six years ago, I would have recommended the usenet groups news.admin.net-abuse.blocklisting or news.admin.net-abuse.email, but these days those groups (especially nanabl) have very little traffic. Nanae have some more, but a lot of it are spammers complaining about being blocked...
However, there are some competent people in there that can help with tracing spam. You can also use http://www.spamcop.net/ for that purpose, they have/had a tool to let you enter the mail headers and parse it for you.
Feedback response number WEBB92URBG created by ~Dan Kikiterobu on 12/10/2012