Re: [mailop] open RBL and RHSBL lists these days?

[Hans-Martin Mosner via mailop]

Am 14.12.20 um 23:28 schrieb Mary via mailop:
> So what is trix.bounces.google after all? google offers a spam service these 
> days?
>
They probably wouldn't call it that, but it essentially is.

It's the Google Forms feedback request mechanism, where users can send requests 
to fill out forms to arbitrary lists of
recipients. Presumably intended for small polls, I've seen it used for that in 
a legitimate way.

However, since Google does not seem to properly act on abuse reports about 
their easily abused service, we reject all
mails from @trix with a message stating that senders should please use regular 
e-mail.

BTW, Microsoft had a very similar flaw which resulted in Sharepoint based spam, 
most likely having been exploited by the
same group of spammers. That seems to have been curbed in the meantime, maybe 
the Google folks should have a talk with
the Microsoft folks on how to get rid of this pest.

Cheers,
Hans-Martin

___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] GMail 550 5.1.1?

[Tara Natanson via mailop]

Looking at logs it seems this is clearing up.

Now to cleanup all the false positive non-existent bounces!!

Cheers,

Tara Natanson
Constant Contact


On Mon, Dec 14, 2020 at 7:52 PM Thomas Walter via mailop 
wrote:

> Hey,
>
> On 15.12.20 01:13, Jay Hennigan via mailop wrote:
> > Many Google services including Gmail, Google Drive, and YouTube have
> > been having issues today according to Outages mailing list. Though some
> > are reporting restoration this could be lingering problems.
>
> https://www.google.com/appsstatus#hl=en=status
>
> GMail is still listed as having issues: "We're investigating reports of
> an issue with Gmail. We will provide more information shortly."
>
> Regards,
> Thomas Walter
>
> --
> Thomas Walter
> Datenverarbeitungszentrale
>
> FH Münster
> - University of Applied Sciences -
> Corrensstr. 25, Raum B 112
> 48149 Münster
>
> Tel: +49 251 83 64 908
> Fax: +49 251 83 64 910
> www.fh-muenster.de/dvz/
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://list.mailop.org/listinfo/mailop
>
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] GMail 550 5.1.1?

[Brett Schenker via mailop]

I had it for one on one email to addresses I know are good.

On Mon, Dec 14, 2020 at 7:19 PM Tara Natanson via mailop 
wrote:

> Sorry that sent before I finished typing.
>
> We are seeing huge spikes in those codes as well.  Some testing shows that
> valid addresses are getting that response intermittently as well.
>
> Tara Natanson
> Constant Contact
>
> On Mon, Dec 14, 2020 at 7:00 PM Tara Natanson 
> wrote:
>
>> Heh, I  just sent the same thing.   We starte seeing it at 15:30 Eastern
>> US time.
>>
>> Tara
>>
>> On Mon, Dec 14, 2020 at 6:58 PM Bez Thomas via mailop 
>> wrote:
>>
>>> Anyone else seeing repeated, but intermittent, 550-5.1.1s from Gmail for
>>> valid addresses?
>>>
>>> Diagnostic-Code: smtp; 550-5.1.1 The email account that you tried to
>>> reach does not exist. Please try
>>> 550-5.1.1 double-checking the recipient's email address for typos or
>>> 550-5.1.1 unnecessary spaces. Learn more at
>>> 550 5.1.1  https://support.google.com/mail/?p=NoSuchUser
>>> --
>>> Bez Thomas
>>>
>>>
>>>
>>> ___
>>> mailop mailing list
>>> mailop@mailop.org
>>> https://list.mailop.org/listinfo/mailop
>>>
>> ___
> mailop mailing list
> mailop@mailop.org
> https://list.mailop.org/listinfo/mailop
>
-- 
Brett Schenker
Man of Many Things, Including
5B Consulting - http://www.5bconsulting.com
Graphic Policy - http://www.graphicpolicy.com

Twitter - http://twitter.com/bhschenker
LinkedIn - http://www.linkedin.com/in/brettschenker
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] open RBL and RHSBL lists these days?

[Michael Peddemors via mailop]

On 2020-12-14 2:45 p.m., Stuart Henderson via mailop wrote:

On 2020/12/15 00:28, Mary via mailop wrote:


Indeed, I am not blocking it for two reasons:

1) I was never sure why 50% of all gmail spam seem to originate from 
trix.bounces.google.

2) The other 50% has regular gmail received headers.


For example, trix.bounces.google spam contains:

Return-Path: 
<3sczsxwkjcfci8xprvytq5bz7a.1db27b7ig7hb7163a7cz97h...@trix.bounces.google.com>
(envelope-from 
<3sczsxwkjcfci8xprvytq5bz7a.1db27b7ig7hb7163a7cz97h...@trix.bounces.google.com>)
smtp.mailfrom=3sczsxwkjcfci8xprvytq5bz7a.1db27b7ig7hb7163a7cz97h...@trix.bounces.google.com


AFAIK it's connected to google forms and *sometimes* has legit mail.


AFAIK, haven't seen a complaint to our teams yet from the hundreds of 
ISP's and Telco's where that was activated at .. ;)


Be nice to see a false positive..

Or even better, to have Google fix the problem..


--
"Catch the Magic of Linux..."

Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic
A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd.

604-682-0300 Beautiful British Columbia, Canada

This email and any electronic data contained are confidential and intended
solely for the use of the individual or entity to which they are addressed.
Please note that any views or opinions presented in this email are solely
those of the author and are not intended to represent those of the company.
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] GMail 550 5.1.1?

[Thomas Walter via mailop]

Hey,

On 15.12.20 01:13, Jay Hennigan via mailop wrote:
> Many Google services including Gmail, Google Drive, and YouTube have
> been having issues today according to Outages mailing list. Though some
> are reporting restoration this could be lingering problems.

https://www.google.com/appsstatus#hl=en=status

GMail is still listed as having issues: "We're investigating reports of
an issue with Gmail. We will provide more information shortly."

Regards,
Thomas Walter

-- 
Thomas Walter
Datenverarbeitungszentrale

FH Münster
- University of Applied Sciences -
Corrensstr. 25, Raum B 112
48149 Münster

Tel: +49 251 83 64 908
Fax: +49 251 83 64 910
www.fh-muenster.de/dvz/



smime.p7s
Description: S/MIME Cryptographic Signature
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] GMail 550 5.1.1?

[Chris Kolbenschlag via mailop]

We are seeing it also.

On Dec 14, 2020, at 5:12 PM, David Landers via mailop  wrote:


Yes, it started about an hour or so ago for us.  Accounts that had delivered 
yesterday or even earlier today in some cases are now seeing that error.

On Mon, Dec 14, 2020 at 7:00 PM Bez Thomas via mailop 
mailto:mailop@mailop.org>> wrote:
Anyone else seeing repeated, but intermittent, 550-5.1.1s from Gmail for valid 
addresses?

Diagnostic-Code: smtp; 550-5.1.1 The email account that you tried to reach does 
not exist. Please try
550-5.1.1 double-checking the recipient's email address for typos or
550-5.1.1 unnecessary spaces. Learn more at
550 5.1.1  https://support.google.com/mail/?p=NoSuchUser
--
Bez Thomas



___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop


--
David Landers
Deliverability Operations Specialist | GROUPON
dland...@groupon.com
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] GMail 550 5.1.1?

[Jay Hennigan via mailop]

On 12/14/20 16:00, Tara Natanson via mailop wrote:
Heh, I  just sent the same thing.   We starte seeing it at 15:30 Eastern 
US time.


Many Google services including Gmail, Google Drive, and YouTube have 
been having issues today according to Outages mailing list. Though some 
are reporting restoration this could be lingering problems.


On Mon, Dec 14, 2020 at 6:58 PM Bez Thomas via mailop > wrote:


Anyone else seeing repeated, but intermittent, 550-5.1.1s from Gmail
for valid addresses?

Diagnostic-Code: smtp; 550-5.1.1 The email account that you tried to
reach does not exist. Please try
550-5.1.1 double-checking the recipient's email address for typos or
550-5.1.1 unnecessary spaces. Learn more at
550 5.1.1 https://support.google.com/mail/?p=NoSuchUser




--
Jay Hennigan - j...@west.net
Network Engineering - CCIE #7880
503 897-8550 - WB6RDV
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] GMail 550 5.1.1?

[Tara Natanson via mailop]

Sorry that sent before I finished typing.

We are seeing huge spikes in those codes as well.  Some testing shows that
valid addresses are getting that response intermittently as well.

Tara Natanson
Constant Contact

On Mon, Dec 14, 2020 at 7:00 PM Tara Natanson 
wrote:

> Heh, I  just sent the same thing.   We starte seeing it at 15:30 Eastern
> US time.
>
> Tara
>
> On Mon, Dec 14, 2020 at 6:58 PM Bez Thomas via mailop 
> wrote:
>
>> Anyone else seeing repeated, but intermittent, 550-5.1.1s from Gmail for
>> valid addresses?
>>
>> Diagnostic-Code: smtp; 550-5.1.1 The email account that you tried to
>> reach does not exist. Please try
>> 550-5.1.1 double-checking the recipient's email address for typos or
>> 550-5.1.1 unnecessary spaces. Learn more at
>> 550 5.1.1  https://support.google.com/mail/?p=NoSuchUser
>> --
>> Bez Thomas
>>
>>
>>
>> ___
>> mailop mailing list
>> mailop@mailop.org
>> https://list.mailop.org/listinfo/mailop
>>
>
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] GMail 550 5.1.1?

[David Landers via mailop]

Yes, it started about an hour or so ago for us.  Accounts that had
delivered yesterday or even earlier today in some cases are now seeing that
error.

On Mon, Dec 14, 2020 at 7:00 PM Bez Thomas via mailop 
wrote:

> Anyone else seeing repeated, but intermittent, 550-5.1.1s from Gmail for
> valid addresses?
>
> Diagnostic-Code: smtp; 550-5.1.1 The email account that you tried to reach
> does not exist. Please try
> 550-5.1.1 double-checking the recipient's email address for typos or
> 550-5.1.1 unnecessary spaces. Learn more at
> 550 5.1.1  https://support.google.com/mail/?p=NoSuchUser
> --
> Bez Thomas
>
>
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://list.mailop.org/listinfo/mailop
>


-- 
David Landers
Deliverability Operations Specialist | GROUPON
dland...@groupon.com
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] GMail 550 5.1.1?

[Tara Natanson via mailop]

Heh, I  just sent the same thing.   We starte seeing it at 15:30 Eastern US
time.

Tara

On Mon, Dec 14, 2020 at 6:58 PM Bez Thomas via mailop 
wrote:

> Anyone else seeing repeated, but intermittent, 550-5.1.1s from Gmail for
> valid addresses?
>
> Diagnostic-Code: smtp; 550-5.1.1 The email account that you tried to reach
> does not exist. Please try
> 550-5.1.1 double-checking the recipient's email address for typos or
> 550-5.1.1 unnecessary spaces. Learn more at
> 550 5.1.1  https://support.google.com/mail/?p=NoSuchUser
> --
> Bez Thomas
>
>
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://list.mailop.org/listinfo/mailop
>
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

[mailop] GMail 550 5.1.1?

[Bez Thomas via mailop]

Anyone else seeing repeated, but intermittent, 550-5.1.1s from Gmail for valid 
addresses? 

Diagnostic-Code: smtp; 550-5.1.1 The email account that you tried to reach does 
not exist. Please try
550-5.1.1 double-checking the recipient's email address for typos or
550-5.1.1 unnecessary spaces. Learn more at
550 5.1.1  https://support.google.com/mail/?p=NoSuchUser 
-- 
Bez Thomas

 

___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] open RBL and RHSBL lists these days?

[Stuart Henderson via mailop]

On 2020/12/15 00:28, Mary via mailop wrote:
> 
> Indeed, I am not blocking it for two reasons:
> 
> 1) I was never sure why 50% of all gmail spam seem to originate from 
> trix.bounces.google.
> 
> 2) The other 50% has regular gmail received headers.
> 
> 
> For example, trix.bounces.google spam contains:
> 
> Return-Path: 
> <3sczsxwkjcfci8xprvytq5bz7a.1db27b7ig7hb7163a7cz97h...@trix.bounces.google.com>
> (envelope-from 
> <3sczsxwkjcfci8xprvytq5bz7a.1db27b7ig7hb7163a7cz97h...@trix.bounces.google.com>)
> smtp.mailfrom=3sczsxwkjcfci8xprvytq5bz7a.1db27b7ig7hb7163a7cz97h...@trix.bounces.google.com

AFAIK it's connected to google forms and *sometimes* has legit mail.

___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] open RBL and RHSBL lists these days?

[Mary via mailop]

Indeed, I am not blocking it for two reasons:

1) I was never sure why 50% of all gmail spam seem to originate from 
trix.bounces.google.

2) The other 50% has regular gmail received headers.


For example, trix.bounces.google spam contains:

Return-Path: 
<3sczsxwkjcfci8xprvytq5bz7a.1db27b7ig7hb7163a7cz97h...@trix.bounces.google.com>
(envelope-from 
<3sczsxwkjcfci8xprvytq5bz7a.1db27b7ig7hb7163a7cz97h...@trix.bounces.google.com>)
smtp.mailfrom=3sczsxwkjcfci8xprvytq5bz7a.1db27b7ig7hb7163a7cz97h...@trix.bounces.google.com

while regular gmail spam contains:

Return-Path: 
(envelope-from )
smtp.mailfrom=ctina...@gmail.com


So what is trix.bounces.google after all? google offers a spam service these 
days?




On Mon, 14 Dec 2020 12:31:07 -0800 Michael Peddemors via mailop 
 wrote:

> On 2020-12-14 11:48 a.m., Mary via mailop wrote:
> > Looking at 1st of December till today, every single spam that passed all 
> > filters came from gmail.  
> 
> I assume you are not yet blocking @trix... ;)
> 
> 
> -- 
> "Catch the Magic of Linux..."
> 
> Michael Peddemors, President/CEO LinuxMagic Inc.
> Visit us at http://www.linuxmagic.com @linuxmagic
> A Wizard IT Company - For More Info http://www.wizard.ca
> "LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd.
> 
> 604-682-0300 Beautiful British Columbia, Canada
> 
> This email and any electronic data contained are confidential and intended
> solely for the use of the individual or entity to which they are addressed.
> Please note that any views or opinions presented in this email are solely
> those of the author and are not intended to represent those of the company.
> ___
> mailop mailing list
> mailop@mailop.org
> https://list.mailop.org/listinfo/mailop
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] open RBL and RHSBL lists these days?

[John Levine via mailop]

In article  you write:
>which ones are open or offer rsync or zone transfer ability if they want
>to reduce load, and which ones are effective on general spam and malware
>blocking with the fewer false positives.

I'd definitely start with Spamhaus Zen. They're freemium, you can sign
up for a free account with limited query volume or pay if you need
more.

I find that they block the vast majority of spam with very few false positives
using the IP lists against connecting IPs and the domain BL against HELO and
envelope MAIL FROM. 

I'd also try Invaluement https://www.invaluement.com/ who are not free
but are good value for the modest price they charge.

R's,
John
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] open RBL and RHSBL lists these days?

[Michael Peddemors via mailop]

On 2020-12-14 11:48 a.m., Mary via mailop wrote:

Looking at 1st of December till today, every single spam that passed all 
filters came from gmail.


I assume you are not yet blocking @trix... ;)


--
"Catch the Magic of Linux..."

Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic
A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd.

604-682-0300 Beautiful British Columbia, Canada

This email and any electronic data contained are confidential and intended
solely for the use of the individual or entity to which they are addressed.
Please note that any views or opinions presented in this email are solely
those of the author and are not intended to represent those of the company.
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] open RBL and RHSBL lists these days?

[Mary via mailop]

From 100+ mail servers, I've got the following results from my weekly statistics

best (blocking the most spam, no false positives):

- spamhaus.org
- junkemailfilter.com
- uceprotect.net

worst (fail to block spam)

- spamcop.net
- dronebl.org
- surriel.com
- sorbs.net


The numbers clearly show that the "best" 3 block lists, are blocking 95% of all 
spam at the SMTP level, 5% make it to the milters, 1% fails due to SPF/DKIM, 
the rest is blocked by spamassassin and custom regex rules.

Overall, the worst offender for me, is gmail. Looking at 1st of December till 
today, every single spam that passed all filters came from gmail.



On Mon, 14 Dec 2020 12:04:37 -0700 Dave Warren via mailop  
wrote:

> On Mon, Dec 14, 2020, at 11:32, Mark E. Jeftovic via mailop wrote:
> > Hey all, we're looking to deploy some user-configurable options in our mail 
> > filtering such as being able to select which RBLs and RHSBLs they want to 
> > apply to their inbound messages.
> 
> > We already subscribe to some on a system wide level (Abusix) but I'm 
> > wondering which ones over and above are still a thing, ie. spamcop? etc?
> 
> > which ones are open or offer rsync or zone transfer ability if they want to 
> > reduce load, and which ones are effective on general spam and malware 
> > blocking with the fewer false positives.
> 
> 
> I'm running a few... The ones I believe are defaulted enabled:
> 
> bl.spamcop.net, ix.dnsbl.manitu.net, bl.mailspike.net, z.mailspike.net, 
> bl.spameatingmonkey.net, and noserver.dnsbl.sorbs.net.
> 
> However, none of these are outright blocking, all are feeding input into a 
> scoring system which can result in the message being accepted, greylisted 
> (mostly to wait and see if there are more DNSBL hits by the next attempt), or 
> treated as spam.
> 
> In some cases a hit (spameatingmonkey.com's "Fresh" 0-15 lists) virtually 
> guarantees a greylist while 15-30 puts them on a hair-trigger for greylisting.
> 
> I have a handful of others, some of the other sorbs.net, and a few smaller 
> ones have a small impact. Make sure these are active before using them, and 
> measure the results. My scoring is not necessarily well tuned at this point 
> as I have been fairly hands-off, and I have a couple things that will turn a 
> list off for me (like if they list a couple test addresses, including 
> myself). 
> 
> 
> 
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] open RBL and RHSBL lists these days?

[Dave Warren via mailop]

On Mon, Dec 14, 2020, at 11:32, Mark E. Jeftovic via mailop wrote:
> Hey all, we're looking to deploy some user-configurable options in our mail 
> filtering such as being able to select which RBLs and RHSBLs they want to 
> apply to their inbound messages.

> We already subscribe to some on a system wide level (Abusix) but I'm 
> wondering which ones over and above are still a thing, ie. spamcop? etc?

> which ones are open or offer rsync or zone transfer ability if they want to 
> reduce load, and which ones are effective on general spam and malware 
> blocking with the fewer false positives.


I'm running a few... The ones I believe are defaulted enabled:

bl.spamcop.net, ix.dnsbl.manitu.net, bl.mailspike.net, z.mailspike.net, 
bl.spameatingmonkey.net, and noserver.dnsbl.sorbs.net.

However, none of these are outright blocking, all are feeding input into a 
scoring system which can result in the message being accepted, greylisted 
(mostly to wait and see if there are more DNSBL hits by the next attempt), or 
treated as spam.

In some cases a hit (spameatingmonkey.com's "Fresh" 0-15 lists) virtually 
guarantees a greylist while 15-30 puts them on a hair-trigger for greylisting.

I have a handful of others, some of the other sorbs.net, and a few smaller ones 
have a small impact. Make sure these are active before using them, and measure 
the results. My scoring is not necessarily well tuned at this point as I have 
been fairly hands-off, and I have a couple things that will turn a list off for 
me (like if they list a couple test addresses, including myself). 



___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

[mailop] open RBL and RHSBL lists these days?

[Mark E. Jeftovic via mailop]

Hey all, we're looking to deploy some user-configurable options in our
mail filtering such as being able to select which RBLs and RHSBLs they
want to apply to their inbound messages.

We already subscribe to some on a system wide level (Abusix) but I'm
wondering which ones over and above are still a thing, ie. spamcop? etc?

which ones are open or offer rsync or zone transfer ability if they want
to reduce load, and which ones are effective on general spam and malware
blocking with the fewer false positives.

thx

- mark

-- 
Mark E. Jeftovic 
Co-founder & CEO, easyDNS Technologies Inc.
AxisOfEasy.com  - /For full coverage of a world
gone full cyberpunk.../
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop