Thank you for your questions, I felt the need to investigate and found that at 16:22:32 an email was sent to a @hotmail address. The MTA tried the first hotmail server 52.101.68.26 and it got the 451 S775 error. One second later my MTA tried the next MX record, 52.101.73.18, and the message was delivered. So the ban was active and spreading among servers - well, I don't know their internals, it may be spreading among the servers, or it was allowed by the rate limiter. The first message from the said surrender, with the title that will be recurrent, is at 16:22:36, just four seconds later. On the other my IP, the first message from the sender was about 2 hours later (17:25:44) than the first 451 error (16:38:48).
So he can't be the source of the problem. SNDS numbers are quite standard, in our range. The RCPT number for that day is big but it is normal since the message was refused after the RCPT. I can't find the origin of the ban. I will set the SIEM to alert if it will receive another 451 S775 log. Thank you On Wed, Aug 5, 2026 at 11:25 PM Randolf Richardson, Postmaster < [email protected]> wrote: > Any idea on the approximate size of the mailout (e.g., total > number > of recipients)? If it's a lot compared to the regular daily outbound > volume from your mail server(s) to HotMail.com's servers, then it's > reasonable to assume that it was a sudden major spike in traffic from > HotMail's perspective (this is where outbound rate limiting helps). > > > Just to add that the Ip were not listed in any rbl, and the message I > think > > was responsible was an invitation for an event in September. > > > > Traffic numbers were standard. > > > > Just this user that really messed up using a completely wrong mailing > > list.... > > > > > > Il Mer 5 Ago 2026, 20:29 hg user <[email protected]> ha scritto: > > > > > I have been blocked for about 26 hours with S775 error and the problem > I > > > identified was of a sender with too many wrong addressed. I'm not even > sure > > > about it, still put the events in order. > > > From that moment both IPs (working as MTA for one domain for more than > 15 > > > years, perhaps 20+) were "rate limited" but actually no message could > be > > > sent by any sender. > > > > > > I created a new mta with a brand new, cold ip, whose configuration was > > > also missing reverse ip, and tunnelled messages were delivered. Can't > say > > > if they went to inbox spam or junk... > > > > > > Support also replied, unexpectedly, but 2 hours after the ban was > lifted > > > so they found nothing wrong. > > > > > > > > > Il Mer 5 Ago 2026, 20:22 Randolf Richardson, Postmaster via mailop < > > > [email protected]> ha scritto: > > > > > >> You should look into the message content to make sure that it > > >> isn't > > >> including any links to phishing web sites, web sites that are known > > >> to distribute malicious software, MLM/pyramid-scheme affiliate links, > > >> etc. There are certain subject lines that can get people into > > >> trouble as well, and then there are compliance issues with sending > > >> out bulk messages that should to be included in the SMTP headers. > > >> > > >> Also, you should check all of your eMail server IP addresses > > >> (IPv4 > > >> and IPv6) for inclusion in blacklists: > > >> > > >> https://multirbl.valli.org/ > > >> > > >> In the meantime, rate-limiting outbound eMails for your > clients > > >> will > > >> also help. Do you have a rough estimate of the total number of > > >> recipients? Also, were the messages sent separate to each recipient, > > >> or were multiple recipients grouped together? > > >> > > >> > Hi, > > >> > yesterday due to a user sending a newsletter to a list recipients > full > > >> of > > >> > errors (I'm sure about this, I don't know what the message text was) > > >> > Microsoft started to "temporarily" rate limiting my 2 sending IPs. > > >> > > > >> > The messages are refused with the following log: > > >> > 451 4.7.650 The mail server [.....] has been temporarily rate > limited > > >> due > > >> > to IP reputation. For e-mail delivery information, see > > >> > https://aka.ms/postmaster (S775) [Name=Protocol Filter > Agent][AGT=PFA] > > >> > > > >> > I registered to SNDS and found that these IPs turned red yesterday. > I > > >> > opened a ticket and the first automatic reply was that the IPs "do > not > > >> > qualify for mitigation". > > >> > > > >> > As requested, I then replied with a detailed email trying to > explain the > > >> > situation but reading previous posts it seems that they won't > follow up. > > >> > > > >> > So I ask you: > > >> > - did you have a S775 block in the past and how long was it ? > > >> > - will I ever receive an answer from MS or my only possibility is > > >> checking > > >> > the logs ? > > >> > > > >> > I have a brand new server with another public IP that is part of > our AS > > >> and > > >> > listed in SPF. I may route traffic to hotmail via this server but > the > > >> IP is > > >> > "cold". I read that someone solved this way but it was not clear if > the > > >> new > > >> > Ip was already warmed. > > >> > > > >> > Thank you > > >> > > > >> > > >> > > >> -- > > >> Postmaster - [email protected] > > >> Randolf Richardson, CNA - [email protected] > > >> Inter-Corporate Computer & Network Services, Inc. > > >> Vancouver, Beautiful British Columbia, Canada > > >> https://www.inter-corporate.com/ > > >> > > >> > > >> _______________________________________________ > > >> mailop mailing list > > >> [email protected] > > >> https://list.mailop.org/listinfo/mailop > > >> > > > > > > > > -- > Postmaster - [email protected] > Randolf Richardson, CNA - [email protected] > Inter-Corporate Computer & Network Services, Inc. > Vancouver, Beautiful British Columbia, Canada > https://www.inter-corporate.com/ > > >
_______________________________________________ mailop mailing list [email protected] https://list.mailop.org/listinfo/mailop
