Comcast email bounces

[jc at trillian.mit.edu (John Chambers)]

#To: <blu at vl.com> (Tom Metro)
| John Chambers wrote:
...
| There's no special DNS record type for outbound relays, but most ISPs
| use mail.example.com or smtp.example.com for that purpose. In this case
| Speakeasy appears to use mail.speakeasy.net. Unfortunately it appears to
| use some sort of load balancing scheme, as you noted above for the MX
| server, and thus always returns the same IP. However, connecting to it
| exposes some additional information:
|
| % telnet 69.17.117.59 25
| 220 mail2.sea5.speakeasy.net ESMTP  bWFpbC5zcGVha2Vhc3kubmV0
|
| That exposes the naming pattern they use for their individual servers,
| and those individual servers appear to have publicly routable IP addresses:

Indeed; I discovered that soon after sending my earlier question.   I
wrote  a little perl script that determined that mail2 thru mail40 in
sea5.speakeasy.net are defined. Changing the number in "sea5" doesn't
turn up any more.

I've been trying to think of a scheme to test all of these for active
smtp  servers,  and  seeing  which can get through to comcast.  But I
suppose it's just as fast to sit down and do it all by hand, since we
really  need  just  one  that  works.   Of course, there's always the
challenge of writing a little program that will find a good  one  the
next  time this happens.  The challenge in this case is doing it in a
manner that won't get you labelled as an abuser yourself when you  do
a scan of IP addresses in a domain. And you don't want to bother some
innocent comcast user with a flood of 38 test messages.

Maybe it's best to just do it by hand.