My public IP is listed in UCEPROTECT

Symptoms

If you're seeing something similar to the logs below in your Exim logs (Where are the Exim logs?), it is most likely because your IP address is UCEPROTECT- listed:

Remote Server returned '554 5.7.1 <domain that rejected the email> #5.7.1 smtp; 554 5.7.1 Service unavailable; Client host ] blocked using uceprotect.net
<email@address>: host <host that reject the email> error: said: 553 NET 52.58.62.0/24 is UCEPROTECT- listed
host [x.x.x.x] said: 550-Blocklisted in dnsbl-3.uceprotect.net: 550-Your ISP AMAZON-02 - Amazon.comm Inc. US/AS16509 is UCEPROTECT-Level3 550-listed for hosting a total of xxxxx abusers. See: 550 http://www.uceprotect.net/rblcheck.php?ipr=x.x.x.x (in reply to RCPT TO command)

You can confirm this is the case by simply querying your IP address in http://www.uceprotect.net/en/rblcheck.php.

Disclaimer: Please note that cPanel, LLC only supports the cPanel-provided software and does not provide general system-administration services such as delisting your IP address from an RBL. You may, therefore, wish to seek assistance from a qualified system administrator for this issue.

Description 

Listing criteria for uceprotect.net:

If a set of IP addresses is seen spamming, it will start with a listing in the level one list (UCEPROTECT-Level1). If within seven days, that spam has not stopped, the listing will escalate to contain much broader ranges of IP addresses. Essentially a level one listing may contain up to 255 IP addresses; if that is escalated to a level two listing (UCEPROTECT-Level2), the number of IP addresses may be as high as tens of thousands. Finally, if still no action is taken against the spammers, a level three listing (UCEPROTECT-Level3) can potentially block IP ranges that contain entire service providers, which could mean hundreds of thousands of listed IP addresses.

useprotect.net is unforgiving with their listing policy, with a core belief that "people learn by consequence". uceprotect.net does not charge for delisting, delisting happens automatically as soon as spam has ceased, and no special treatment is given to partners or anyone in particular with regard to listing or delisting.

TLDR:

The UCEPROTECT blocklist provides blocklisting three levels of increasing severity:

• UCEPROTECT-Level 1: Primarily reports only single IP addresses.
• UCEPROTECT-Level 2: Primarily reports multiple IP addresses.
• UCEPROTECT-Level 3: Primarily reports all IP addresses within a group of IP networks. It corresponds to several hundred abusive IP addresses at smaller providers as well as thousands of abusive IP addresses at mid-sized or large email service providers.

Additional information:

Removal: www.uceprotect.net/en/index.php?m=7&s=0.
Lookup: www.uceprotect.net/en/rblcheck.php.

UCEPROTECT-Level1: http://www.uceprotect.net/en/index.php?m=3&s=3.

UCEPROTECT-Level2: http://www.uceprotect.net/en/index.php?m=3&s=4.

UCEPROTECT-Level3: http://www.uceprotect.net/en/index.php?m=3&s=5.

Solution

First, you need to check your listing status at the UCEPROTECT website. The process for getting off the blocklist depends on the level of the listing:

• UCEPROTECT-Level 1: Your IP address is automatically delisted 7 days after the last receipt of spam.
• UCEPROTECT-Level 2: Only your email service provider can request that your IP addresses be delisted.
• UCEPROTECT-Level 3: Your email service provider will be automatically removed, as soon as there are fewer than 0.2% of abusers from all of their IP addresses in Level 1 within 7 days.

As mentioned by UCEPROTECT:

Therefore we recommend:
Please send a complaint to your provider and request they fix this problem immediately.

If they are ignoring your complaint or claiming they can't do anything, you should consider changing your provider.
There are currently about 105,000 providers worldwide, but only a few hundred make it to get listed into UCEPROTECT-Level 3.

Workaround

As a workaround, you change the primary IP address of your cPanel server (How do I change the primary IP of my cPanel server?) or you can add an additional IP to your server (How to add an additional IP address) that is not listed in any blocklists and change the outgoing IP address for mail: Changing the outgoing IP for email.