We took a closer look at the situation today.
We had signed up for Yahoo's FBL a long time ago, but the messages were
likely being sent to an address that is no longer monitored; we have
since opened a new account on their Senders portal and implemented new
DKIM settings.
We identified a few compromised email accounts (fewer than 10) that had
slipped under our radar, they had been sending spam for a few months,
not a huge amount (all accounts on our platform have a daily sending
limit of between 1,000 and 2,000 messages), but evidently enough to
cause issues.
While we do operate an SMTP relay service (smtpfy.com), its sending
volumes are currently negligible compared to our email hosting service:
we are talking about roughly 1.000.000 emails per day from authenticated
SMTP accounts versus 100.000 from the SMTP relay service (which, in any
case, we provide only to existing hosting clients or to third parties we
manually vet before activation).
We certainly need to improve our IP allocation by separating Email
Hosting from SMTP Relay traffic and update our DKIM keys.
There is a lot to be done, at Qboxmail, we manage our physical
infrastructure (firewall, switch, storage, servers, ...) and develop our
own software (Webmail, Control Panel, APIs) in-house. While this offers
an advantage (we aren't entirely dependent on third parties) it also
entails a significant maintenance burden.
Thank you all for the suggestions you sent; I will let you know how
things turn out.
Il 21/09/2026 10:04, Defaults Mailbox ha scritto:
Looked into the public side of this since it's an interesting case. A
few things that might help narrow it down.
The basics check out, so this doesn't look like an authentication or
rDNS problem:
*
.40/.41/.42/.43 all have matching forward and reverse DNS
(smtp01-04.cbsolt.net), so FCrDNS is fine.
*
SPF on both qboxmail.com and qboxmail.it hard fails (-all), and
DMARC is p=quarantine with rua reporting on both.
*
None of the four IPs are listed on Spamhaus ZEN, Barracuda,
SpamCop, SORBS, UCEPROTECT level 1, or PSBL. Matches what you're
seeing elsewhere.
Worth noting: the bounce fires at MAIL FROM, before DATA. That's a
*connection-level reputation gate*, not a per-message content or DKIM
verdict.
What stood out was the /24 itself. RIPE has 185.97.217.0/24 registered
to you as Qboxmail-Email-Hosting-2, but your mailbox relay isn't the
only thing in there. A few other PTRs in the same block:
185.97.217.150 -> lvs-delivery01.smtpfy.com
185.97.217.200 -> smtp-dl01-trs01.smtpfy.com
185.97.217.230 -> smtp-dl03-mrk01.smtpfy.com
Smtpfy's own site describes it as a Qboxmail product for transactional
and marketing sending, with*no daily or hourly limit*. Your SPF on
qboxmail.com/.it also authorizes the whole /22 (185.97.216.0/22)
through the spf.qboxmail.com include, so at the DNS level the mailbox
relay and the bulk sending platform aren't really separated.
If Smtpfy picked up a complaint spike or a trap hit around the 17th,
that would explain clean, individually unlisted IPs like .40-.43
getting caught. My read: Yahoo and AOL often escalate from one bad IP
to the surrounding range once they attribute a pattern to an operator,
which tracks with spammers historically rotating through a block to
dodge single-IP blocks. Worth pulling Smtpfy's send volume and
complaint/FBL data for the few days before the block, if you haven't
already. That would answer this faster than the support form will.
Yahoo doesn't publish specifics on TSS09 itself, but the general
TS-code family is documented as complaint and reputation driven rather
than authentication driven, which lines up with everything above.
If the shared /24 turns out to be the cause, the durable fix is
separating IP space by traffic type: a dedicated range for the mailbox
relay that doesn't overlap the bulk platform, ideally not sharing a
/22 either. Domain-level isolation (separate DKIM per sending domain,
which Smtpfy already does) doesn't protect IP-level reputation, and
Yahoo in particular seems to be acting on the IP/network signal here,
not the domain.
Two smaller things, unlikely to be the trigger but worth fixing
regardless: DKIM on both domains is still a roughly 1024-bit RSA key
at selector k1, and DMARC is p=quarantine rather than p=reject on both.
On Yahoo support: for a permanent-deferral code like this, they
generally want evidence the root cause was found and stopped. A
delisting request alone usually won't move it, and even then it can
take a while. Sender Hub (senders.yahooinc.com) might move faster than
the generic form, if that's not already the channel you're using.
You've clearly been through some Yahoo verification before, given the
yahoo-verification-key TXT records on qboxmail.it and cbsolt.net.
Hope this helps in some way..
------------------------------------------------------------------------
*From:* mailop <[email protected]> on behalf of Alessio Cecchi
via mailop <[email protected]>
*Sent:* 21 September 2026 08:21
*To:* [email protected] <[email protected]>
*Subject:* [mailop] Yahoo has blocked all our IPs
Hi,
We are Qboxmail, an Italian mailbox hosting provider. We provide only
B2B mailboxes exclusively to companies and do not offer free email
accounts.
I am writing here because I need your help with a deliverability issue
affecting Yahoo mailboxes. Starting from September 17th all our SMTPs
were blocked by Yahoo:
status=bounced (host mx-eu.mail.am0.yahoodns.net[188.125.72.73] said:
553 5.7.2 [TSS09] All messages from 185.97.217.40 will be permanently
deferred; Retrying will NOT succeed. See
https://postmaster.yahooinc.com/error-codes (in reply to MAIL FROM
command))
dsn=5.7.2, status=bounced (host mta7.am0.yahoodns.net[67.195.204.74]
said: 553 5.7.2 [TSS09] All messages from 185.97.217.41 will be
permanently deferred; Retrying will NOT succeed. See
https://postmaster.yahooinc.com/error-codes (in reply to MAIL FROM
command))
dsn=5.7.2, status=bounced (host mta6.am0.yahoodns.net[98.136.96.74]
said: 553 5.7.2 [TSS09] All messages from 185.97.217.43 will be
permanently deferred; Retrying will NOT succeed. See
https://postmaster.yahooinc.com/error-codes (in reply to MAIL FROM
command))
All our IPs 185.97.217.0/24 seems blocked by Yahoo.
I filled out the support form on their website, but nothing has changed.
It’s very strange because we’re only having this problem with Yahoo; our
IPs aren't on any other major blocklists.
We’re facing serious issues because of this block.
What can we do?
Thanks
--
Alessio Cecchi
postmaster AT qboxmail
https://it.linkedin.com/in/alessice
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
--
Alessio Cecchi
postmaster AT qboxmail
https://it.linkedin.com/in/alessice
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
