JMRP doesn't send every email reported as spam to the sender. Last I heard, it was 1 in 1,000 or some such. This is to prevent listwashing, as should be obvious.
And just ONE mail sent to the wrong address ... well ... that can get a whole lot of IPs blocked if it looks suspicious in the eyes of the investigator. Aloha, Michael. -- Michael J Wise Microsoft Corporation| Spam Analysis "Your Spam Specimen Has Been Processed." Open a ticket for Hotmail<http://go.microsoft.com/fwlink/?LinkID=614866> ? From: mailop <[email protected]> On Behalf Of André Peters via mailop Sent: Tuesday, May 11, 2021 5:38 AM To: mailop <[email protected]> Subject: [EXTERNAL] Re: [mailop] Registered @ Microsoft JMRP - blacklisted without feedback received IMO it's a totally useless system. We have had ASNs blocked without a single complaint prior to it. Not a single one. Once every 2-3 month we get a complaint and contact the complaining person. Out of ~10 times it was only ONCE a mail, that the rcpt did not want to receive. If you want to receive mail, don't register with MS. I cannot say this often enough. To add a small hint: Try to send ~the same mail volume and don't cause peaks. Do not send to too many recipients in one session. Funny enough we receive a lot of spam from MS at the moment... ------ Originalnachricht ------ Von: "Laura Atkins via mailop" <[email protected]<mailto:[email protected]>> An: "mailop" <[email protected]<mailto:[email protected]>> Gesendet: 11.05.2021 14:25:11 Betreff: Re: [mailop] Registered @ Microsoft JMRP - blacklisted without feedback received Given you are the service provider, the best place to look is in your abuse queue. Look for complaints about mail from that IP (and surrounding IPs) going back for a while. Typically, the consumer ISPs will put mail in the bulk folder for a while before escalating to a block. When the mail is going to bulk you will not see complaints as users cannot send FBL messages related to mail in the bulk folder. This means low complaint rates immediately before a block Do Not Mean that the mail is fine. In fact, it often means that the mail is already identified as spam. You need to go back further, to before MS was putting the messages in the bulk folder, in order to see complaints about it. Going back over time will give you some information about what customer and what mail streams were causing problems. That should give you some insight into which customers you need to address to get the block lifted. The other place to look is your outbound logs. What are your customers doing and what types of mail are they sending? Did any customer have an unexpected spike in volume? This can often indicate a system may have been compromised and being used to send spam / malware. Sometimes it just means someone got the idea that sending 'cold outreach mail' was a good idea. Those are the two places I'd start my investigation in your situation. laura On 11 May 2021, at 12:54, Benoit Panizzon via mailop <[email protected]<mailto:[email protected]>> wrote: Dear List One of our main smtp outbound ip addresses is blocked by microsoft. host outlook-com.olc.protection.outlook.com<https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Foutlook-com.olc.protection.outlook.com%2F&data=04%7C01%7Cmichael.wise%40microsoft.com%7Ce227ac275eee46e3750c08d9147b3783%7C72f988bf86f141af91ab2d7cd011db47%7C0%7C0%7C637563341727458285%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=T3kyL8zqeRWlnyExY9AN8jl0dCUwI8a7hUlvCWuU3g0%3D&reserved=0>[104.47.10.33] said: 550 5.7.1 Unfortunately, messages from [157.161.12.84] weren't sent. Please contact your Internet service provider since part of their network is on our block list (S3150). You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors<https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fmail.live.com%2Fmail%2Ftroubleshooting.aspx%23errors&data=04%7C01%7Cmichael.wise%40microsoft.com%7Ce227ac275eee46e3750c08d9147b3783%7C72f988bf86f141af91ab2d7cd011db47%7C0%7C0%7C637563341727468246%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=zwfCsr1Qy%2F6bP8IYB5llyLQ9YmG5q8l5KNd0yu%2BQavo%3D&reserved=0>. [DB5EUR03FT006.eop-EUR03.prod.protection.outlook.com<https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Feop-eur03.prod.protection.outlook.com%2F&data=04%7C01%7Cmichael.wise%40microsoft.com%7Ce227ac275eee46e3750c08d9147b3783%7C72f988bf86f141af91ab2d7cd011db47%7C0%7C0%7C637563341727468246%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=S2gfOqxJ2QDfCq8jCfVsCCsn9eqP3AHbYG722Z%2FbQLk%3D&reserved=0>] (in reply to MAIL FROM command) I checked our JMRP entries. This IP is listed as one of our mailservers. The complaint rate is < 0.1% but it had 2 'trap' hits and is in status red. Our abuse desk email address is registered for the ARF feedback loop for the ip range in question. We usually get a lot of feedback loop emails, mostly false positives of Mirosoft users mixing up 'junk' with their trash folder or similar, or moving all their old mail to 'junk' causing an avalanche of complaints being sent. I opened several cases with Microsoft about this, but never got any solution offered (as a sidenote rant) But no, there were no complaints about: 157.161.12.84 received. Does anyone know, how to get hold of the emails that caused this blocking? Mit freundlichen Grüssen -Benoît Panizzon- -- I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://www.imp.ch<https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.imp.ch%2F&data=04%7C01%7Cmichael.wise%40microsoft.com%7Ce227ac275eee46e3750c08d9147b3783%7C72f988bf86f141af91ab2d7cd011db47%7C0%7C0%7C637563341727478200%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=xU6D7x4Drl6QB1kaP7HYK2xFBNjQCm4poIObqt0%2BsBg%3D&reserved=0> ______________________________________________________ _______________________________________________ mailop mailing list [email protected]<mailto:[email protected]> https://list.mailop.org/listinfo/mailop<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flist.mailop.org%2Flistinfo%2Fmailop&data=04%7C01%7Cmichael.wise%40microsoft.com%7Ce227ac275eee46e3750c08d9147b3783%7C72f988bf86f141af91ab2d7cd011db47%7C0%7C0%7C637563341727478200%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=mZsHDzV%2FhJDEqqEjZQNV4Ml4t9XrfmKFLvBKq%2FNXc8Y%3D&reserved=0> -- Having an Email Crisis? We can help! 800 823-9674 Laura Atkins Word to the Wise [email protected]<mailto:[email protected]> (650) 437-0741 Email Delivery Blog: https://wordtothewise.com/blog<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwordtothewise.com%2Fblog&data=04%7C01%7Cmichael.wise%40microsoft.com%7Ce227ac275eee46e3750c08d9147b3783%7C72f988bf86f141af91ab2d7cd011db47%7C0%7C0%7C637563341727488162%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=MkkTAJdodsaWRL3WN5UFr8bjfU%2FXTXKNWaCuggfJUNU%3D&reserved=0>
_______________________________________________ mailop mailing list [email protected] https://list.mailop.org/listinfo/mailop
