Re: [mailop] Microsoft Block list (S3150)

[Scott Mutter via mailop]

That's true - I'm not a customer.  But who is a customer?  What is defined
as a customer?  Is a hotmail.com/live.com/outlook.com email user a
"customer"?  And if so... how do they contact a real live human being at
Microsoft to voice their concerns about Microsoft's unilateral IP blocking
of other mail servers?  The form referenced above is geared more towards
the administrators of those blocked servers who have to beg, plead, and
grovel for someone to remove their IP from being blocked by Microsoft.  Or
maybe you get the - "As previously stated, your IP(s) do not qualify for
mitigation at this time.  I do apologize, but I am unable to provide any
details about this situation since we do not have the liberty to discuss
the nature of the block." response even though the IP is not blocked any
where else (it has a 99 Sender Score) and wait out your time in SOL land.

Or is "customer" someone that pays for this service?

The joke has always been that hotmail.com/live.com/outlook.com/msn.com etc.
email addresses are the bottom feeders.  Because they either get inundated
with spam or Microsoft blocks the wrong IPs, holding them hostage
indefinitely and legitimate mail is not able to get sent through to these
email addresses.  When was the last time you got any correspondence from
an @hotmail.com address and thought "hey! that guy means business!"?

Just once, I'd love to get a response from Microsoft that explains why
they're the only ones blocking an IP address.  I mean, I've dealt with spam
incidents - probably much like the OP - for the past 20+ years and every
time, those spam messages go out to other mail servers, Yahoo, Gmail, any
of the ReturnPath users, Proofpoint, CBL - every where.  If a spam incident
is so unbelievably bad that it can never, ever be mitigated... it stands to
reason that the IP would show up in one of these other systems.  But if it
doesn't, and Microsoft is the only one blocking it... what does that tell
you?


On Wed, Jun 24, 2020 at 8:50 PM John Levine via mailop 
wrote:

> In article  glr4dc1zxleb6z6b+j2tjg+qzqpfmtcgji...@mail.gmail.com> you write:
> >
> >You would think a company like Microsoft would have a better solution to
> >all of this.
>
> To point out the obvious, you're not their customer. Why should they
> care unless an actual customer complains?
>
> R's,
> John
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft Block list (S3150)

[Michael Rathbun via mailop]

On 24 Jun 2020 21:50:13 -0400, John Levine via mailop 
wrote:

>To point out the obvious, you're not their customer. Why should they
>care unless an actual customer complains?

And the actual customers are the advertisers, not the persons using "free"
email services, and certainly not any entity sending email to those persons.

Perceived excess spam drives out the eyes for the adverts, and abandoned
accounts that still receive spam (accounting for perhaps 80% of the total
infrastructure cost) will be put to use to reduce the total theft-of-service
load the system endures...

Everyone concerned is getting close to the best that can be expected.

mdr (who has been there and seen that)
-- 
 "There are no laws here, only agreements."  
-- Masahiko


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft Block list (S3150)

[John Levine via mailop]

In article  
you write:
>
>You would think a company like Microsoft would have a better solution to
>all of this.

To point out the obvious, you're not their customer. Why should they
care unless an actual customer complains?

R's,
John

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft Block list (S3150)

[Scott Mutter via mailop]

You would think a company like Microsoft would have a better solution to
all of this.

Once you get blocked by Microsoft it's a 6 week race (because they'll only
reply about once a week) to plow through all of the crud replies they send
you, to actually getting something accomplished.  Except, after 6 weeks all
of your clients have left you, so it's kind of pointless.

Factor in also that they tend to block IPs for no apparent reason.  I'd be
curious to know if your IP address is listed with any other major
blacklisting services, SpamHaus, Spamcop, etc.  Or did your abuse incident
only send spam out to Microsoft controlled email servers?

On Wed, Jun 24, 2020 at 5:03 PM Al Iverson via mailop 
wrote:

> Yep, fill out this form: http://go.microsoft.com/fwlink/?LinkID=614866
> Wait a few days for a reply.
> First reply might just be a "we're routing your ticket" response.
> Second reply might be useful, or it might be completely bonkers.
> You might have to calmly state your case repeatedly.
> They might say they see nothing wrong. Stick to your guns and show
> them the data.
> Eventually, after a number of replies, they'll say that the IP
> qualifies for mitigation and that the block will be rescinded within
> 48-72 hours.
> And that might even be true!
>
> Good luck.
>
> Cheers,
> Al Iverson
>
> On Wed, Jun 24, 2020 at 4:28 PM Adam Moffett via mailop
>  wrote:
> >
> > Does anyone have any insight into how we get onto (or off) a Microsoft
> block list?
> >
> > I started seeing these bounces around midnight on Tuesday:
> >
> > "550 5.7.1 Unfortunately, messages from [204.80.232.21] weren't sent.
> Please contact your Internet service provider since part of their network
> is on our block list (S3150). You can also refer your provider to
> http://mail.live.com/mail/troubleshooting.aspx#errors. "
> >
> > We don't have any current issues, but on Monday morning we did have a
> compromised customer account send 200 spam emails. 200 triggered a limit
> and they couldn't send any more.  Later in the morning we disabled the
> compromised account.  This would have been about 18 hours before we started
> seeing the bounces shown above.  I'm assuming this is related, but I don't
> know how I could have addressed the issue any faster, and I don't know why
> there would be such a delayed reaction from Microsoft's system.
> >
> > Does anyone know anything of interest about this?
> >
> >
> > -- Adam Moffett, Network Engineer
> > Plexicomm - Internet Solutions | www.plexicomm.net
> > Office: 1.866.759.4678 x104
> >
> > ___
> > mailop mailing list
> > mailop@mailop.org
> > https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
>
>
> --
> Al Iverson // Wombatmail // Chicago
> Song a day! https://www.wombatmail.com
> Deliverability! https://spamresource.com
> And DNS Tools too! https://xnnd.com
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft Block list (S3150)

[Al Iverson via mailop]

Yep, fill out this form: http://go.microsoft.com/fwlink/?LinkID=614866
Wait a few days for a reply.
First reply might just be a "we're routing your ticket" response.
Second reply might be useful, or it might be completely bonkers.
You might have to calmly state your case repeatedly.
They might say they see nothing wrong. Stick to your guns and show
them the data.
Eventually, after a number of replies, they'll say that the IP
qualifies for mitigation and that the block will be rescinded within
48-72 hours.
And that might even be true!

Good luck.

Cheers,
Al Iverson

On Wed, Jun 24, 2020 at 4:28 PM Adam Moffett via mailop
 wrote:
>
> Does anyone have any insight into how we get onto (or off) a Microsoft block 
> list?
>
> I started seeing these bounces around midnight on Tuesday:
>
> "550 5.7.1 Unfortunately, messages from [204.80.232.21] weren't sent. Please 
> contact your Internet service provider since part of their network is on our 
> block list (S3150). You can also refer your provider to 
> http://mail.live.com/mail/troubleshooting.aspx#errors. "
>
> We don't have any current issues, but on Monday morning we did have a 
> compromised customer account send 200 spam emails. 200 triggered a limit and 
> they couldn't send any more.  Later in the morning we disabled the 
> compromised account.  This would have been about 18 hours before we started 
> seeing the bounces shown above.  I'm assuming this is related, but I don't 
> know how I could have addressed the issue any faster, and I don't know why 
> there would be such a delayed reaction from Microsoft's system.
>
> Does anyone know anything of interest about this?
>
>
> -- Adam Moffett, Network Engineer
> Plexicomm - Internet Solutions | www.plexicomm.net
> Office: 1.866.759.4678 x104
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop



-- 
Al Iverson // Wombatmail // Chicago
Song a day! https://www.wombatmail.com
Deliverability! https://spamresource.com
And DNS Tools too! https://xnnd.com

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

[mailop] Microsoft Block list (S3150)

[Adam Moffett via mailop]

Does anyone have any insight into how we get onto (or off) a Microsoft 
block list?


I started seeing these bounces around midnight on Tuesday:

"550 5.7.1 Unfortunately, messages from [204.80.232.21] weren't sent. 
Please contact your Internet service provider since part of their 
network is on our block list (S3150). You can also refer your provider 
to http://mail.live.com/mail/troubleshooting.aspx#errors. "


We don't have any current issues, but on Monday morning we did have a 
compromised customer account send 200 spam emails. 200 triggered a limit 
and they couldn't send any more.  Later in the morning we disabled the 
compromised account.  This would have been about 18 hours before we 
started seeing the bounces shown above.  I'm assuming this is related, 
but I don't know how I could have addressed the issue any faster, and I 
don't know why there would be such a delayed reaction from Microsoft's 
system.


Does anyone know anything of interest about this?


-- Adam Moffett, Network Engineer
Plexicomm - Internet Solutions | www.plexicomm.net
Office: 1.866.759.4678 x104
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Report as spam and mail forwarders: best practices?

[Leo Gaspard via mailop]

Atro Tossavainen via mailop  writes:
>> We handle an email forwarder. Recently, we have been having more and
>> more issues with people reporting forwarded emails as spam, that end up
>> (probably) deteriorating the reputation of our email servers.
>
> You could ask the good folks at iki.fi for tips. They've only been doing
> this for 25 years.

Will do, thank you!

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Report as spam and mail forwarders: best practices?

[Leo Gaspard via mailop]

We have, and also sometimes click on “unsubscribe” on emails people mark
as spam that get forwarded to us. This being said, maybe we missed a
feedback loop? I have just checked and found [1]; we'll subscribe to the
ones we missed that are listed there.

[1] 
https://help.returnpath.com/hc/en-us/articles/220221448-List-of-all-available-complaint-feedback-loops-FBLs-

Maybe one thing we should do, would be to automatically send an email to
people who click the spam button (as defined by reception on abuse@) to
tell them to instead forward the mail to spam@? but then it would come
at the risk of actually generating emails that people would see as spam,
so it doesn't sound that great…

Russell Clemings via mailop  writes:

> Have you at least signed up for all the feedback loops you can find? That
> seems to help with reputation and it also helps you track down and counsel
> users who think the spam button is the same thing as the delete button.
>
>
>
> On Fri, Jun 19, 2020 at 9:16 AM Leo Gaspard via mailop 
> wrote:
>
>> Michael Peddemors via mailop  writes:
>> > Since every email client in the world can check multiple mailboxes, ISPs
>> > and Telco's are starting to simply turn off 'remote forwarding', it is
>> > an option for you of course.
>>
>> Unfortunately, this is not really a reasonable course of action for us:
>> most people still just use their ISP's webmail, which rarely supports
>> checking multiple mailboxes and even if it did would require a
>> significant amount of configuration by the end-user… we already have
>> issues keeping up-to-date email addresses for all the users, as they
>> often forget to notify us changes, so getting them all to regularly
>> fetch emails from IMAP servers we'd setup sounds pretty much impossible.
>>
>> > Which is why you should consider the spam protection as an integral part
>> > of the email service, and not simply a 'pre-filtering' system, as this
>> > way cases of "one man's spam is another man's reading material"..
>> >
>> > Let the customer make the final choice.. eg 'Click Allow/Block Sender'.
>>
>> This sounds like a neat idea! however, there is an issue with it: adding
>> these links would break DKIM, and so we would have to rewrite the From
>> header for all emails… which sounds like a pretty bad UX downside. If
>> only there were a way to add a DKIM-unsigned mime block to the email,
>> that the UI would display as being obviously not-from-the-sender… it
>> could solve this issue maybe.
>>
>> >> Do you know of additional best practices we could do, to better help
>> >> training our antispam as well as hopefully redirect at least some of the
>> >> reputation loss to the actual sender of the email?
>> >
>> > Never forward known spam ;)
>>
>> Well… if only it were that easy :p
>>
>> ___
>> mailop mailing list
>> mailop@mailop.org
>> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>>
>
>
> -- 
> ===
> Russell Clemings
> 
> ===
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Anyone from Cox around?

[Jill Newman via mailop]

Also looking for someone at Cox - we continue to get a small percentage of 
bounces with this message indicating that there is a violation of SMTP protocol 
-  https://www.cox.com/residential/support/email-error-codes.html for more 
information. AUP#CXSMTP

If that was the case, why wouldn't all of the mail to Cox receive that same 
bounce status?



[Omeda logo]

Jill Slattery Newman
Director, Email Success
w | 312.312.2024
c | 847.209.1121
jnew...@omeda.com

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Fake documents from Microsoft and fake voice mail from Exacttarget

[Mickey Chandler via mailop]

There's not much that I can say about this issue other than this:

1) Your second Pardot sample link gives an access denied error.
2) As in all such instances, appropriate measures have been and will be
taken with regard to relevant Pardot & Salesforce policies. As much as I
would love to pull an Afterburner and go into detail about what happened
and what we've done, wiser heads than mine say that this is as much as I'm
allowed to say on the issue and its resolution.
3) And, well, heh, I was also a recipient and got to send in my own report.

Mickey

On Tue, Jun 23, 2020 at 6:30 PM John Levine via mailop 
wrote:

> Dunno if other people are seeing this, but I got a bunch of spam from
> Sharepoint, which is
> Microsoft, inviting me to look at more or less pornographic Sharepoint
> documnents.
>
> Here's a couple of them:
>
> http://spample.iecc.com/sdq/23641583
> http://spample.iecc.com/ung/23641588
>
> I'm also getting mail from Pardot which is part of Salesforce, sent
> through Exacttarget,
> which is also Salesforce, telling me that I have voicemail.
>
> Here's a couple of those:
>
> http://spample.iecc.com/ulx/23641587
> http://spample.iecc.com/tjc/23641568
>
> These really are from Microsoft and Salesforce, who apparently do no
> vetting of their users at all.
>
> Pardot sends from 13.111.68.0/24 and since it is 100% spam, that's easy
> to block.  Looking at the
> logs, I don't think I see any real mailfrom Sharepoint either in 52.100/16.
>
> I think I know people I can poke, but if anyone here knows people at
> Pardot or Sharepoint, they're burning through their little remaining
> goodwill at an impressive rate.
>
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Proofpoint

[Faisal Misle via mailop]

Have you tried ipcheck.proofpoint.com?

Best,
Faisal

PGP Key: [C8FD029B](https://pgp.faisal.ec/)

On Wed, Jun 24, 2020 at 9:36 AM, Kris von Mach via mailop  
wrote:

> Hi,
>
> Could someone please contact me from Proofpoint off-list.
>
> It's about a block on one of our IPs.
>
> I've tried postmaster@ but had no responses.
>
> --
> Kris von Mach
> Swishmail
> m...@swishmail.com
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Proofpoint

[Jaren Angerbauer via mailop]

Replied off list.

--Jaren




On Wed, Jun 24, 2020 at 8:49 AM Kris von Mach via mailop 
wrote:

> Hi,
>
> Could someone please contact me from Proofpoint off-list.
>
> It's about a block on one of our IPs.
>
> I've tried postmaster@ but had no responses.
>
> --
> Kris von Mach
> Swishmail
> m...@swishmail.com
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Proofpoint

[Al Iverson via mailop]

Did you try https://ipcheck.proofpoint.com/ ?

Cheers,
Al Iverson

On Wed, Jun 24, 2020 at 9:38 AM Kris von Mach via mailop
 wrote:
>
> Hi,
>
> Could someone please contact me from Proofpoint off-list.
>
> It's about a block on one of our IPs.
>
> I've tried postmaster@ but had no responses.
>
> --
> Kris von Mach
> Swishmail
> m...@swishmail.com
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop



-- 
Al Iverson // Wombatmail // Chicago
Song a day! https://www.wombatmail.com
Deliverability! https://spamresource.com
And DNS Tools too! https://xnnd.com

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

[mailop] Proofpoint

[Kris von Mach via mailop]

Hi,

Could someone please contact me from Proofpoint off-list.

It's about a block on one of our IPs.

I've tried postmaster@ but had no responses.

--
Kris von Mach
Swishmail
m...@swishmail.com

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop