Practice
So, your company has its own email server. On the one hand - great, on the other - not so great. The pros and cons of this approach are a whole separate topic, depending on a bunch of different factors, ranging from the number and qualification of the IT department's staff to the size of the company itself.
Let's settle on the fact that the e-mail server at your company is indeed your own. And it doesn't matter what it's built on, whether it's the trendy, fast and flexible Exim, the frequently encountered Postfix, or the creation of the fat-walleted company MS Exchange Server, or something else entirely.
The point is that to host your own server it needs some kind of public (white) IP address. Again, it doesn't much matter whether this is a dedicated public IP for the e-mail server (the best option) or a single shared IP whose SMTP/POP3/IMAP ports are NATed to the internal server.
One of the subtleties of hosting your own server is that its public IP can end up placed on so-called public black lists. These lists exist in order to maintain, more or less centrally, a database of addresses of low-quality email servers - i.e. servers from which a lot of spam comes. This helps the spam filters of the final receiving email servers assign their scores to letters coming from your employees.
For example, a letter from an employee of your company arrives at a server whose spam filter checks black lists (for example, DNSBL). And if it turns out that your sending server appears on some black list - the spam filter immediately sharply raises the probability that this letter is spam. As a rule, this does not turn out well - almost all letters from your employees start getting blocked on a bunch of email servers for no reason.
Why?
There are several ways your server's IP address or DNS name can end up on black lists. They can be divided into two types: manual (someone specifically added it manually, having decided that a lot of spam comes from your server) and automatic (many email servers, themselves using DNSBL, also send statistics to black lists - which servers most often send letters that are, with high probability, spam or are even marked as spam by the employees themselves).
Setting aside sabotage on the part of an ill-wisher, we arrive at an unfortunate conclusion:
How do I find out whether my server is on the black lists?
Stage one - as a rule, you find this out from the email server logs (you do keep them, right?) For example, some employee tells you that a letter of theirs is not reaching a given email address. You go into the logs and see something like this message:
Aha, the receiving server directly told you that it blocked the mail because your server is on black lists, and even indicated which one exactly. As a rule, servers that use black lists give quite clear answers - which list, and what address to go to.
Stage two - search for it yourself. This stage is not easy, because there are a great many black lists and you can't go through all of them - at least not by hand. But here a service that has proven very useful to me will help: http://multirbl.valli.org .
Go to this site, in the "Test" list choose "FCrDNS & DNSBL Lookups", and in the "IPv4/IPv6 address or domain name" field enter the IP address or DNS name of your email server, then click the "Send" button (located on the right).
In a clear form the service will give you results - where it found your IP address and in which category. Ideally - nowhere, or only in "Whitelisted". If you see yourself in "Blacklisted" - urgently go to that resource and try to remove yourself from the lists.
How do I remove myself from a black list?
You need to go to that black list's website and follow the instructions on it. The procedures differ everywhere, the sites are different, but the gist of them all, as a rule, comes down to the following:
How do I prevent this?
The main thing is instructing your organization's employees, if they are entrusted with some freedom of action. First of all - the departments dealing with advertising - they like to spam, and often don't get to the point of thinking about the consequences.
Secondary - is monitoring. This is not easy, because you either need to set scripts loose on the logs to detect moments of spam sending (as a rule this is a bunch of messages to different recipients in a very short period of time all at once), or check every day/week all the sent letters, if they are stored somewhere with you, at least visually via a list (because, for example, deeply and thoroughly checking several tens of thousands of letters sent every day is simply unrealistic).
Third - configure the email server so that:
The fourth level, which management most likely won't even consider - is an order from management, preferably the general director, stating that spam actions are unacceptable and detection of such actions will result in punishment. If you have managed to explain the consequences to management and management has agreed with you and, moreover, agreed to put it on paper - that's simply great.
Fifth point - allocate a separate IP address for the e-mail server after all (if there isn't one). The trick is that if the server sits on the same IP as the NAT for employees, the risk of ending up on spammer lists rises sharply and wildly. This happens because:
Comments