Fossil Forum

A test notification was sent to your address to check whether any mails are getting through. Please respond to the address in that mail if you get it. When we have had this problem in the past, it's been caused by the remote mail server rejecting mails from this domain, a problem we are unable to solve.

Thank you. Did not receive anything, I will ask my provider about it. Are these sent from @fossil-scm.org?

Are these sent from @fossil-scm.org?

Correct. From noreply(some-hex-value)@fossil-scm.org, where the some-hex-value part differs.

At the bottom of each message is an "Unsubscribe" link. If you click on that link, you are taken to a page that gives you the option to either unsubscribe, or manage your subscription. Click the "Manage Subscription Settings" option.

That takes you to another page that shows your subscription information. Your "Delivery:" option was set to "Daily Digest". I have just now changed it to "Individual Emails".

Thank you, but I think you misunderstood: I am not receiving any mails anymore, since multiple months. The daily digest was an active choice by me. For the testing purposes of seeing if my provider can make it work again, I will keep it with individual mails for now though.

I have heard back from my providers support and they require the actual address the mail came from to be able to properly trace it in their systems. Is there a way to aquire the address or force an email to be sent from a fixed address? In my address-book I seem to have [email protected], has that one been changed to the noreply address, or would I possibly receive a mail from that address if I re-subscribe to the forum posts?

The IPs are available using:

~~~ dig fossil-scm.org dig AAAA fossil-scm.org ~~~

Those numbers are (currently) 194.195.208.62 and 2600:3c02::f03c:95ff:fe07:695

Spamhaus blacklists 2600:3c02::/64, which corresponds to the entire Linode datacenter in Atlanta in which the fossil-scm.org VPS resides. Perhaps one of the millions of machines in that datacenter is sending out spam, and so Spamhaus decided to blacklist the entire facility. That might be your problem. The solution, of course, is to simply not believe Spamhaus.

[email protected] was the original email address used for the Forum, however, on September 30, 2025 it switched to using the [email protected] format.

Assuming that it isn't being blocked prior to SMTP communications with some kind of RBL, your provider should be able to track it down by looking for deliveries to your email address coming from one such email from fossil-scm.org. If you need an exact, or specific FROM address, then one of the Forum administrators will have to provide one to you somehow. The IP addresses of the mail server were already provided to you so that should also be helpful.

The IPs are available using:

For completeness, I would instead suggest using the domain's SPF records as the basis for whitelisting, since that will also allow other project-related emails to get through, too.

Perhaps one of the millions of machines in that datacenter is sending out spam

I don't use Spamhaus or other public blacklist, but I do aggressively ban hosts that attack my servers directly. A lot of them have come from Linode; it's far more than just one bad apple.

The solution, of course, is to simply not believe Spamhaus.

With respect: no. Turning a blind eye to abuse is never the right thing to do. It is far easier to believe that Linode uses prestige projects like Fossil and SQLite as cover for the abusive traffic that comes from their network neighborhood. It's not at all uncommon for cloud providers to do that, unfortunately (e.g, I ran into the same problem with Let's Encrypt's use of AWS). The solution, of course, is to switch to a provider that understands that any random scammer with a stolen credit card should not be mixed in with cornerstone sites like yours.

The solution, of course, is to simply not believe Spamhaus.

With respect: no.

With respect, I agree with Richard in this particular instance. By surrendering control to a 3rd party who can decide which senders are allowed to communicate, it basically boils down to a form censorship. While Spamhaus has had one of the better reputations in the RBL industry, it's still surrendering control of what YOU can receive to someone else. If Spamhaus allowed you to tailor your own RBL fashioned after what you deem worthy, then it would be less problematic.

Richard isn't saying to "turn a blind eye to abuse", in fact, he has made all kinds of modifications to Fossil in the effort to thwart abuse. He's merely pointing out that if the use of Spamhaus causes the blocking of legitimate email (due to a broad /64 level IPv6 block), then the use of it is suspect and not to be trusted.

With respect to email, it would be better for those who want to block "spam" to devise their own mechanisms appropriate for their own customers and even better if they arm their customers with their own tools for accomplishing the same.

You made the case yourself earlier when you stated:

I don't use Spamhaus or other public blacklist

Presumably this is because you don't want them censoring your emails in any way and want more control over it yourself.

While Spamhaus has had one of the better reputations in the RBL industry, it's still surrendering control of what YOU can receive to someone else.

Yet that is the common state of the Internet these days, especially email. Marvin has some unnamed provider, which may or may not even be using Spamhaus. If they're one of the big monopolistic players like Gmail or Outlook, they're more than happy to just use customer accounts as pawns so that they can throw their weight around by denying access for no sensible reason at all.

He's merely pointing out that if the use of Spamhaus causes the blocking of legitimate email (due to a broad /64 level IPv6 block), then the use of it is suspect and not to be trusted.

And I'm suggesting an alternative hypothesis: that some companies love having human shields inside their networks so that victims are forced to block legitimate traffic if they want to limit the abuse. Case in point: a /64 in IPv6 land is not "broad", but should rather be seen as a minimum. If Linode has different customers sharing a /64 (especially if mixing respectable and abusive ones), they are contributing to the problem.

Presumably this is because you don't want them censoring your emails in any way and want more control over it yourself.

My details are beyond the scope of this discussion, but it boils down to me having security practices that are more holistic than what the anti-spam industry provides. But I totally understand why admins do use externally compiled lists, and would likely use them myself if my job was just to limit the risk of users seeing spam in their inboxes.

My hope is that people take a step back and look at the bigger picture rather than spin narratives that unduly favors any party here. The real solution is to be more independent of all these organizations that seek only to turn control into profits. Everyone should be willing and able to switch to a different provider for their services if it's not actually, you know, providing that service.

https://www.impossiblystupid.com/cgi-bin/fossil/impossiblystupid/doc/trunk/www/node/1021/README.wiki

I'm unable to access this site because the connection times out. Perhaps the point is to show that access is denied for no sensible reason at all?

Perhaps. Perhaps it better shows exactly why I don't think lists like Spamhaus' are comprehensive enough, perhaps also demonstrating my "human shield" point, in which case you need to have a frank discussion with your ISP about the types of abusive traffic they allow on their network and what that means for your connectivity. You give no details that would allow me to look for the "sensible reason" from my end, but I'd say we're again getting beyond the scope of this discussion.

A good general rule is to check archive.org if a URL is giving you problems. Assuming things aren't so bad on your end that archive.org is refusing your connections, too! ;-)

Just for completeness, it's also down for me, for https://downforeveryoneorjustme.com/, and so perhaps you're just blocking a lot of the internet.

Oh, an archive.org works just fine, by the way.

So a bit off topic, but who knows...

Again, no actionable information in any of that. Neither you nor the site you link to discloses any IP address being used. They do barf up ads for VPNs and Wordpress hosting, which are often blocked on my end due to the abuse they generate, so I'm shedding no tears based on the company they keep. I aim to block only abusers; if that still ends up being "a lot of the internet" . . . shame on them.

Oh, an archive.org works just fine, by the way.

Because they haven't been abusive. Enjoy my dumb blog that way. :-)