Hi Patrick > - Filing form (1 or 2 IP addresses only)
I usually submitted our full /24 range from which various ip addresses are use for our own ISP email services and for customers with dedicated domains. I was hoping this would have them look at the reputation and email volume of the complete range and realize something is of with the single ip address from the range which repeatedly gets hit. It's one of our ISP customer's domains - so large number of customers - but not the largest one. I start to suspect we hit some 'magical' volume, large enough to trigger S3150 by some little unwanted traffic or false positive junk report, but not large enough so this little unwanted traffic in proportion to the good traffic still does not trigger S3150. Maybe it's better to only submit the affected ip and not the whole range. > - Autoreply saying Not qualified for mitigation. Same. > - Reply to have it delisted. Same. > - Actual response from a human Same. > In that last case they used to say the block has been lifted yadayada but now > they came back to me in all cases saying the throttling limitation has been > set to a more appropriate level based on the reputation. This is where I usually got a different reply on the lines 'we can't find any issue with the ip range submitted - if you still see and issue, please re-submit the range via our web-form'. Interestingly in one of the last replies of today the 'human' sent the range but excluded the one ip address which is affected - yes I submitted the logs showing the exact affected ip in the range and it was in the subject of the ticket - so microsoft can not tell it was not clear what IP this was all about. So I replied once more to their reply with 'there is no issue' and from which they excluded the ip with the issue and asked again to please check on that very one IP address they excluded. I included all 4 ticket ID's from the same issue and ip my team submitted each day in the last four days as requested by that human. Now (5 minutes ago) finally they 'mitigated' the issue and asked me to re-check after 48 hours. > So maybe try and submit 1 or 2 IPs (I used 2 max) and see what they > do. I also got some reply with best practices and such. I guess I'll got for that next time, only opening a case for the one /32 ipv4 which is affected. > Overall it is just a pain to get some answers from MS. They won't > share detailed information about the listings. Hell, in some cases > they just kept ignoring my responses. Exactly, this is the issue. I believe we do a lot to prevent abuse on our side. I am sure we get far more unwanted email from abused microsoft email accounts than we sent to them. I have started blocking each of our customer which sent an email to a microsoft customer and that microsoft customer reported that email as 'junk' even if it is clearly by mistake by the microsoft customer - have our customer solve this with the microsoft customer who reported him as 'spamer' - it first looked like this caused S3150 not to appear that often, but it looks like we are back where this happens 2 to 3 times per month and then stays for about 5 days until it is solved - causing a lot of complaints from our customers to being able to send email to microsoft to our customer service. Yes, of course we have our share of customers falling for phishing emails and handing their email credentials to fraudsters - so does Microsoft obviously. I guess we mostly find them rather quickly. Mit freundlichen Grüssen -Benoît Panizzon- -- I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://www.imp.ch ______________________________________________________ _______________________________________________ mailop mailing list [email protected] https://list.mailop.org/listinfo/mailop
