Yes we started seeing these maybe 6 weeks ago. They are very common, probably popping up on 3-5 IPs per day. We have to manually delist them which is a pain. Seems like a very silly system because there is no correlation between the block and troublesome senders that I can find.
What I am wondering is, if Microsoft merged Outlook an Office365 infra, what are we still seeing specific blocks specific to Office365? There is clearly a different Office365 anti-spam system running independently of Outlook to some extent. Thanks, Alex -- Alexander Burch ActiveCampaign / Deliverability Lead abu...@activecampaign.com 1 North Dearborn Street, Suite 500, Chicago, IL 60602 <https://www.facebook.com/activecampaign> <http://www.twitter.com/activecampaign> <https://www.linkedin.com/company/activecampaign-inc-> <https://www.activecampaign.com/sig/?u=aburch&c=1> On Tue, Jun 26, 2018 at 6:01 AM <mailop-requ...@mailop.org> wrote: > Send mailop mailing list submissions to > mailop@mailop.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop > or, via email, send a message with subject or body 'help' to > mailop-requ...@mailop.org > > You can reach the person managing the list at > mailop-ow...@mailop.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of mailop digest..." > > > Today's Topics: > > 1. Comcast contact? bounce.care.comcast.com (Carl Byington) > 2. Re: [EXTERNAL] Comcast contact? bounce.care.comcast.com > (Brotman, Alexander) > 3. Recent "banned sending IP" errors when sending to Microsoft > (Josh Campbell) > 4. Re: Comcast contact? bounce.care.comcast.com (Al Iverson) > 5. Re: Recent "banned sending IP" errors when sending to > Microsoft (John Possidente) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 25 Jun 2018 09:08:33 -0700 > From: Carl Byington <c...@five-ten-sg.com> > To: "mailop@mailop.org" <mailop@mailop.org> > Subject: [mailop] Comcast contact? bounce.care.comcast.com > Message-ID: <1529942913.14107.4.ca...@ns.five-ten-sg.com> > Content-Type: text/plain; charset="UTF-8" > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA512 > > bounce.care.comcast.com has > > "v=spf1 include:cust-spf.exacttarget.com ip4:76.96.68.101 > ip4:76.96.68.102 ip4:76.96.68.103 ip4:69.252.76.7 ip4:69.252.76.8 > ip4:69.252.76.9 -all" > > Note the -all, but at least some mail is arriving here via resqmta-po- > 04v.sys.comcast.net == 96.114.154.163 not listed in the above spf > record. You might want to fix that. > > Also, the DKIM signature from mdp.comcast.net is broken - > reason="signature verification failed". > > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v2.0.14 (GNU/Linux) > > iEYEAREKAAYFAlsxE2YACgkQL6j7milTFsHZlQCfQ7i8CCsnP+Jy5R1lrFjw7A// > VyQAn3yFmOu5o/0HTCDnMUWHyH78DS48 > =XKZW > -----END PGP SIGNATURE----- > > > > > > ------------------------------ > > Message: 2 > Date: Mon, 25 Jun 2018 16:27:38 +0000 > From: "Brotman, Alexander" <alexander_brot...@comcast.com> > To: Carl Byington <c...@five-ten-sg.com>, "mailop@mailop.org" > <mailop@mailop.org> > Subject: Re: [mailop] [EXTERNAL] Comcast contact? > bounce.care.comcast.com > Message-ID: > <fba479585e6a452cbef0e90285cce...@copdcex19.cable.comcast.com> > Content-Type: text/plain; charset="utf-8" > > Carl, > > You can contact me off-list with specific details if you have more > information. > > -- > Alex Brotman > Sr. Engineer, Anti-Abuse > Comcast > > > -----Original Message----- > From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Carl Byington > Sent: Monday, June 25, 2018 12:09 PM > To: mailop@mailop.org > Subject: [EXTERNAL] [mailop] Comcast contact? bounce.care.comcast.com > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA512 > > bounce.care.comcast.com has > > "v=spf1 include:cust-spf.exacttarget.com ip4:76.96.68.101 > ip4:76.96.68.102 ip4:76.96.68.103 ip4:69.252.76.7 ip4:69.252.76.8 > ip4:69.252.76.9 -all" > > Note the -all, but at least some mail is arriving here via resqmta-po- > 04v.sys.comcast.net == 96.114.154.163 not listed in the above spf record. > You might want to fix that. > > Also, the DKIM signature from mdp.comcast.net is broken - > reason="signature verification failed". > > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v2.0.14 (GNU/Linux) > > iEYEAREKAAYFAlsxE2YACgkQL6j7milTFsHZlQCfQ7i8CCsnP+Jy5R1lrFjw7A// > VyQAn3yFmOu5o/0HTCDnMUWHyH78DS48 > =XKZW > -----END PGP SIGNATURE----- > > > > _______________________________________________ > mailop mailing list > mailop@mailop.org > https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop > > ------------------------------ > > Message: 3 > Date: Mon, 25 Jun 2018 12:24:32 -0400 > From: Josh Campbell <joshgcampb...@gmail.com> > To: mailop@mailop.org > Subject: [mailop] Recent "banned sending IP" errors when sending to > Microsoft > Message-ID: > < > caauyzaznxzhuggh7b2kvf_nc2icp8day+ij-jawcv81s233...@mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Has anyone else noticed these errors? We hadn't really seen them > previously. They look like this: > > smtp;550 5.7.606 Access denied, banned sending IP [xxx.xxx.xxx.xxx]. To > request removal from this list please visit https://sender.office.com/ and > follow the directions. For more information please go to > http://go.microsoft.com/fwlink/?LinkID=526655 (AS16012609) [ > AM5EUR03FT031.eop-EUR03.prod.protection.outlook.com] > > We've only started seeing them in the past month and only a small amount of > IPs have been affected at any one time. > > The interesting thing is all of these IPs are in the same IP range (out of > the three major ranges we have). > > I'm wondering if this is a new phenomenon for anyone else and why it only > appears to affect one of my IP ranges. (Also, if anyone from Microsoft > cares to get in touch, I'd love to hear from you.) > > Josh Campbell, Deliverability Engineer > MailChimp > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: < > https://chilli.nosignal.org/cgi-bin/mailman/private/mailop/attachments/20180625/2bca05b2/attachment-0001.html > > > > ------------------------------ > > Message: 4 > Date: Mon, 25 Jun 2018 12:40:48 -0400 > From: Al Iverson <aliver...@aliverson.com> > To: Carl Byington <c...@five-ten-sg.com> > Cc: mailop <mailop@mailop.org> > Subject: Re: [mailop] Comcast contact? bounce.care.comcast.com > Message-ID: > < > caaqnkjaj0yyvfyqsjzc0rnwt9pxgv8zt6oaortu0urhiy1r...@mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Hey Carl, I think this refers to emails originating within the > Salesforce Marketing Cloud (ExactTarget) platform, but the SPF missing > IP and DKIM failure touch on something that I think is happening to > the mail after it leaves our system. I've spun up a support case to > reach out to the client and ask them if they'd like us to update the > SPF record as indicated and suggesting that they review the potential > DKIM configuration issue. > > If a Comcast person sees this and wants to coordinate, feel free to > reach out to me. > > Thanks for the heads up. > > Cheers, > Al Iverson > On Mon, Jun 25, 2018 at 12:12 PM Carl Byington <c...@five-ten-sg.com> > wrote: > > > > -----BEGIN PGP SIGNED MESSAGE----- > > Hash: SHA512 > > > > bounce.care.comcast.com has > > > > "v=spf1 include:cust-spf.exacttarget.com ip4:76.96.68.101 > > ip4:76.96.68.102 ip4:76.96.68.103 ip4:69.252.76.7 ip4:69.252.76.8 > > ip4:69.252.76.9 -all" > > > > Note the -all, but at least some mail is arriving here via resqmta-po- > > 04v.sys.comcast.net == 96.114.154.163 not listed in the above spf > > record. You might want to fix that. > > > > Also, the DKIM signature from mdp.comcast.net is broken - > > reason="signature verification failed". > > > > > > -----BEGIN PGP SIGNATURE----- > > Version: GnuPG v2.0.14 (GNU/Linux) > > > > iEYEAREKAAYFAlsxE2YACgkQL6j7milTFsHZlQCfQ7i8CCsnP+Jy5R1lrFjw7A// > > VyQAn3yFmOu5o/0HTCDnMUWHyH78DS48 > > =XKZW > > -----END PGP SIGNATURE----- > > > > > > > > _______________________________________________ > > mailop mailing list > > mailop@mailop.org > > https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop > > > > -- > al iverson // 312-725-0130 // miami > http://www.aliverson.com > http://www.spamresource.com > > > > ------------------------------ > > Message: 5 > Date: Mon, 25 Jun 2018 13:27:23 -0400 > From: John Possidente <possiden...@gmail.com> > To: Josh Campbell <joshgcampb...@gmail.com> > Cc: mailop <mailop@mailop.org> > Subject: Re: [mailop] Recent "banned sending IP" errors when sending > to Microsoft > Message-ID: > <CALeKJxfHRxen-wS4ybLm0jaZf3sOw3FM8YZY6Oj= > n9ebw7-...@mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > That looks like the standard Office365 "you got listed" message. Even > legitimate B2B bulk mail will now and then generate these. Just follow the > instructions; delisting is straightforward. If it recurs, of course, you > might have a troublesome mailer on your hands. > > John > > > On Mon, Jun 25, 2018 at 12:24 PM, Josh Campbell <joshgcampb...@gmail.com> > wrote: > > > Has anyone else noticed these errors? We hadn't really seen them > > previously. They look like this: > > > > smtp;550 5.7.606 Access denied, banned sending IP [xxx.xxx.xxx.xxx]. To > > request removal from this list please visit https://sender.office.com/ > > and follow the directions. For more information please go to > > http://go.microsoft.com/fwlink/?LinkID=526655 (AS16012609) [ > > AM5EUR03FT031.eop-EUR03.prod.protection.outlook.com] > > > > We've only started seeing them in the past month and only a small amount > > of IPs have been affected at any one time. > > > > The interesting thing is all of these IPs are in the same IP range (out > of > > the three major ranges we have). > > > > I'm wondering if this is a new phenomenon for anyone else and why it only > > appears to affect one of my IP ranges. (Also, if anyone from Microsoft > > cares to get in touch, I'd love to hear from you.) > > > > Josh Campbell, Deliverability Engineer > > MailChimp > > > > > > _______________________________________________ > > mailop mailing list > > mailop@mailop.org > > https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop > > > > > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: < > https://chilli.nosignal.org/cgi-bin/mailman/private/mailop/attachments/20180625/f609fcce/attachment-0001.html > > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > mailop mailing list > mailop@mailop.org > https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop > > > ------------------------------ > > End of mailop Digest, Vol 128, Issue 41 > *************************************** >
_______________________________________________ mailop mailing list mailop@mailop.org https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
