Re: [mailop] Abuse Contacts hosted @ gmail and Google's Spam filter

[Joel Beckham]

I can't speak for anyone other than ourselves, but we've been using Google
Apps successfully to host our abuse@ address. We've disabled spam filtering
on that mailbox and have automations in place to process incoming messages.

On Tue, Jun 28, 2016 at 11:13 AM, Steve Atkins <st...@blighty.com> wrote:

>
> > On Jun 28, 2016, at 8:10 AM, Benoit Panizzon <benoit.paniz...@imp.ch>
> wrote:
> >
> > Hello
> >
> > Operating the experimental future SWINOG Spamtrap development and Spam
> > Reporting infrastructure I often come across the problem, that many
> > abuse desks have their abuse contact address hosted by Google.
>
> > Unfortunately Google does not know about ARF Reports and very quickly
>
> Someone hosting on Google Apps probably has no way to read ARF reports,
> let alone handle them with the automation needed to make sense of bulk
> ARF feeds.
>
> > considers an email spam, if it contains parts (headers) of an actual
> > spam mail.
> >
> > I have been trying to contact ab...@google.com on several times about
> > this exact issue, but never got any reaction.
>
> Anyone hosting their email on google apps isn't particularly interested in
> abuse reports at all, let alone unsolicited bulk reports of the type I
> presume
> you're sending.
>
> Stop sending reports to anyone hosted by google. Possibly offer a way for
> those users to register an alternate reporting address. Move on.
>
> Spending effort to send abuse reports to recipients who aren't going to
> do anything with them is effort you could more usefully spend elsewhere.
>
> Cheers,
>   Steve
>
>
> _______
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>



-- 
JOEL BECKHAM
Scalability Architect
[image: BombBomb | Face to Face with more people, more often]
W: BombBomb.com <http://www.bombbomb.com/>
[image: BombBomb | Face to Face with more people, more often]
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Excluding Message-ID from DKIM Signature

[Joel Beckham]

Thanks, Vick. I'm curious, what initially lead you to exclude the
message-id from your signature?

On Fri, May 27, 2016 at 5:55 AM, Vick Khera <vi...@khera.org> wrote:

> Hi Joel,
>
> I don't sign my message-id. In fact, I let my MTA create the Message-ID
> header and I sign before that in my application. Never been an issue.
>
>
> On Thu, May 26, 2016 at 4:25 PM, Joel Beckham <j...@bombbomb.com> wrote:
>
>> Are there any negative consequences to consider before excluding
>> message-id from our signature?
>>
>> I'm working towards p=reject on bombbomb.com and found that Securence /
>> usinternet.com (A forwarder) gets a measurable percentage of our mail
>> and modifies the message-id in the process. This breaks our DKIM signature
>> and causes DMARC to fail at the destination. Working directly with them,
>> I've learned that they're unable to preserve the signed message-id.
>>
>> RFC4871 says it "SHOULD be included", but not required. RFC6376 adds,
>> which is the part that has me concerned, that:
>>
>> Verifiers may treat unsigned header fields with extreme
>> skepticism, including refusing to display them to the end user or
>> even ignoring the signature if it does not cover certain header
>> fields.
>>
>> Thanks!
>>
>> _______
>> mailop mailing list
>> mailop@mailop.org
>> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>>
>>
>


-- 
JOEL BECKHAM
Scalability Architect
[image: BombBomb | Face to Face with more people, more often]
W: BombBomb.com <http://www.bombbomb.com/>
[image: BombBomb | Face to Face with more people, more often]
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Excluding Message-ID from DKIM Signature

[Joel Beckham]

Thanks for the input!

Steve -- I've been on a couple calls with Securence and they're not willing
to stop the message-id modification. They did offer to tack on .invalid to
the FROM address to bypass our DMARC, but I'm not a big fan of that idea.
They said they're handling each p=reject on a case-by-case basis, so I'm
pretty sure it's breaking for a lot of their other customers. I'm not
really sure how to convince them DMARC is a real thing they need to deal
with.

Kurt -- From all the samples I've seen, message-id is the only thing
getting changed. I'll ask if I can provide you with their contact info and
follow up with you.



On Thu, May 26, 2016 at 3:36 PM, Kurt Andersen (b) <kb...@drkurt.com> wrote:

> On Thu, May 26, 2016 at 1:25 PM, Joel Beckham <j...@bombbomb.com> wrote:
>
>> Are there any negative consequences to consider before excluding
>> message-id from our signature?
>>
>> ...found that Securence / usinternet.com (A forwarder) gets a measurable
>> percentage of our mail and modifies the message-id in the process. This
>> breaks our DKIM signature and causes DMARC to fail at the destination.
>> Working directly with them, I've learned that they're unable to preserve
>> the signed message-id.
>
>
> This seems like an odd thing to change. Are you sure that there is nothing
> else that they are doing to your messages which will break the signature?
>
> Having worked on the DMARC interoperability catalog (for the IETF DMARC
> WG), I'd be interested in talking a bit more with Securence if you can
> provide contact info off-list so that I can find out if we have captured
> their issue(s) in the catalog.
>
> --Kurt Andersen
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Webmail

[Joel Beckham]

We use google apps.

On Sun, Apr 3, 2016 at 1:18 PM, Doug Barton <dougb@dougbarton.email> wrote:

> Sorry if this is off topic, but I'm just curious what folks are using for
> webmail nowadays.
>
> Doug
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>



-- 
JOEL BECKHAM
Scalability Architect
[image: BombBomb | Face to Face with more people, more often]
W: BombBomb.com <http://www.bombbomb.com/>
[image: BombBomb | Face to Face with more people, more often]
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Still seeing Microsoft 5.4.0 issues?

[Joel Beckham]

Not seeing any here.

On Wed, Mar 30, 2016 at 7:01 AM, Josh Nason <jna...@dyn.com> wrote:

> Hi all -- we continue to see Action: failed/Status: 5.4.0 bounces for
> emails sent to Hotmail, Outlook, and Microsoft domains. I assume others are
> seeing the same?
>
> Microsoft friends, any idea on a resolution time? This feels like it's
> taking a while to be resolved.
>
> --
>
> [image: Dyn logo, Dyn.com] <http://dyn.com/>
> <http://twitter.com/dyn><http://twitter.com/dyninc>[image: Dyn
> facebook account] <http://facebook.com/dyn>
> <http://twitter.com/dyninc>[image:
> Dyn LinkedIn account] <http://linkedin.com/company/dyn>
>
> Josh Nason / Email Reputation Manager
>  +1 603-289-1244 | @JoshNason <http://www.twitter.com/joshnason>
>
> Email is hot! This is why
> <https://www.linkedin.com/pulse/why-email-marketing-original-form-social-media-josh-nason?trk=prof-post>
> it's the original form of social media.
>
> _______
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
>


-- 
JOEL BECKHAM
Scalability Architect
[image: BombBomb | Face to Face with more people, more often]
W: BombBomb.com <http://www.bombbomb.com/>
[image: BombBomb | Face to Face with more people, more often]
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] iCloud dropping all of our mail

[Joel Beckham]

On Thu, Mar 24, 2016 at 10:16 PM, 
> wrote:

> Thanks for sharing.
>
>
>
> Now that you know about the problem, was there anything else you could
> have done that would identified the issue, and that can you can share with
> the group?
>
>
>
> Frank
>


So far, I've found 2 things that I could have done (and am implementing
today) to identify this issue:

   - Watch for large volume increases coming from accounts. This account
   had a 5x increase.
   - Watch for accounts cycling through lists. We hadn't built this before
   because it's a time consuming process for a user to remove and then
   re-upload a list and the lists are small. This user was cycling through
   many lists of 800 recipients.

I can see why our existing systems didn't catch this one though -- open
rates were good (20-36%), complaints weren't too high (.1% - .19%), bounces
were minimal, domain distribution was normal with a large portion of it on
domains with feedbackloops.
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] iCloud dropping all of our mail

[Joel Beckham]

Ok, I think I'm all set. I've had a number of folks reach out and we've
identified a problem account which I've suspended. Thanks everyone for your
help!

On Thu, Mar 24, 2016 at 2:51 PM, Joel Beckham <j...@bombbomb.com
<https://bb.bixel.io/v1/track/click/5b03ad2e-fba5-0317-3bbe-4f961d5f5cc0/gm%3A1458855713183/mailop%40mailop.org/?mailto%3Ajoel%40bombbomb.com=>
> wrote:

> I did and didn't get a response, so that's why I started expanding my
> search for help. Thanks.
>
> On Thu, Mar 24, 2016 at 2:48 PM, Suresh Ramasubramanian <
> ops.li...@gmail.com
> <https://bb.bixel.io/v1/track/click/5b03ad2e-fba5-0317-3bbe-4f961d5f5cc0/gm%3A1458855713183/mailop%40mailop.org/?mailto%3Aops.lists%40gmail.com=>
> > wrote:
>
>> Use this link -
>> https://support.apple.com/en-in/HT204137
>> <https://bb.bixel.io/v1/track/click/5b03ad2e-fba5-0317-3bbe-4f961d5f5cc0/gm%3A1458855713183/mailop%40mailop.org/?https%3A%2F%2Fsupport.apple.com%2Fen-in%2FHT204137=>
>>
>> Scroll down to the last section "contact us"
>>
>> --srs
>>
>> On 25-Mar-2016, at 2:15 AM, Joel Beckham <j...@bombbomb.com
>> <https://bb.bixel.io/v1/track/click/5b03ad2e-fba5-0317-3bbe-4f961d5f5cc0/gm%3A1458855713183/mailop%40mailop.org/?mailto%3Ajoel%40bombbomb.com=>>
>> wrote:
>>
>>
>> On Thu, Mar 24, 2016 at 2:40 PM, Suresh Ramasubramanian <
>> ops.li...@gmail.com
>> <https://bb.bixel.io/v1/track/click/5b03ad2e-fba5-0317-3bbe-4f961d5f5cc0/gm%3A1458855713183/mailop%40mailop.org/?mailto%3Aops.lists%40gmail.com=>
>> > wrote:
>>
>>> It would help if you posted the IPs as well
>>>
>>> --srs
>>
>>
>>
>> These are the IPs affected:
>> 173.213.231.164
>> 173.213.231.165
>> 173.213.231.166
>> 173.213.231.167
>> 173.213.231.168
>> 173.213.231.169
>> 173.213.231.170
>> 173.213.231.171
>> 104.193.74.128
>> 104.193.74.129
>> 104.193.74.130
>> 104.193.74.131
>> 104.193.74.132
>> 104.193.74.133
>> 104.193.74.134
>> 104.193.74.135
>>
>>
>> --
>> JOEL BECKHAM
>> Scalability Architect
>> [image: BombBomb | Face to Face with more people, more often]
>> W: BombBomb.com
>> <https://bb.bixel.io/v1/track/click/5b03ad2e-fba5-0317-3bbe-4f961d5f5cc0/gm%3A1458855713183/mailop%40mailop.org/?http%3A%2F%2Fwww.bombbomb.com=>
>> [image: BombBomb | Face to Face with more people, more often]
>>
>>
>
>
> --
> JOEL BECKHAM
> Scalability Architect
> [image: BombBomb | Face to Face with more people, more often]
> W: BombBomb.com
> <https://bb.bixel.io/v1/track/click/5b03ad2e-fba5-0317-3bbe-4f961d5f5cc0/gm%3A1458855713183/mailop%40mailop.org/?http%3A%2F%2Fwww.bombbomb.com=>
> [image: BombBomb | Face to Face with more people, more often]
>



-- 
JOEL BECKHAM
Scalability Architect
[image: BombBomb | Face to Face with more people, more often]
W: BombBomb.com
<https://bb.bixel.io/v1/track/click/5b03ad2e-fba5-0317-3bbe-4f961d5f5cc0/gm%3A1458855713183/mailop%40mailop.org/?http%3A%2F%2Fwww.bombbomb.com=>
[image: BombBomb | Face to Face with more people, more often]
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] iCloud dropping all of our mail

[Joel Beckham]

I did and didn't get a response, so that's why I started expanding my
search for help. Thanks.

On Thu, Mar 24, 2016 at 2:48 PM, Suresh Ramasubramanian <ops.li...@gmail.com
<https://bb.bixel.io/v1/track/click/5b03ad2e-fba5-0317-3bbe-4f961d5f5cc0/gm%3A1458852608924/ops.lists%40gmail.com/?mailto%3Aops.lists%40gmail.com=>
> wrote:

> Use this link -
> https://support.apple.com/en-in/HT204137
> <https://bb.bixel.io/v1/track/click/5b03ad2e-fba5-0317-3bbe-4f961d5f5cc0/gm%3A1458852608924/ops.lists%40gmail.com/?https%3A%2F%2Fsupport.apple.com%2Fen-in%2FHT204137=>
>
> Scroll down to the last section "contact us"
>
> --srs
>
> On 25-Mar-2016, at 2:15 AM, Joel Beckham <j...@bombbomb.com
> <https://bb.bixel.io/v1/track/click/5b03ad2e-fba5-0317-3bbe-4f961d5f5cc0/gm%3A1458852608924/ops.lists%40gmail.com/?mailto%3Ajoel%40bombbomb.com=>>
> wrote:
>
>
> On Thu, Mar 24, 2016 at 2:40 PM, Suresh Ramasubramanian <
> ops.li...@gmail.com
> <https://bb.bixel.io/v1/track/click/5b03ad2e-fba5-0317-3bbe-4f961d5f5cc0/gm%3A1458852608924/ops.lists%40gmail.com/?mailto%3Aops.lists%40gmail.com=>
> > wrote:
>
>> It would help if you posted the IPs as well
>>
>> --srs
>
>
>
> These are the IPs affected:
> 173.213.231.164
> 173.213.231.165
> 173.213.231.166
> 173.213.231.167
> 173.213.231.168
> 173.213.231.169
> 173.213.231.170
> 173.213.231.171
> 104.193.74.128
> 104.193.74.129
> 104.193.74.130
> 104.193.74.131
> 104.193.74.132
> 104.193.74.133
> 104.193.74.134
> 104.193.74.135
>
>
> --
> JOEL BECKHAM
> Scalability Architect
> [image: BombBomb | Face to Face with more people, more often]
> W: BombBomb.com
> <https://bb.bixel.io/v1/track/click/5b03ad2e-fba5-0317-3bbe-4f961d5f5cc0/gm%3A1458852608924/ops.lists%40gmail.com/?http%3A%2F%2Fwww.bombbomb.com=>
> [image: BombBomb | Face to Face with more people, more often]
>
>


-- 
JOEL BECKHAM
Scalability Architect
[image: BombBomb | Face to Face with more people, more often]
W: BombBomb.com
<https://bb.bixel.io/v1/track/click/5b03ad2e-fba5-0317-3bbe-4f961d5f5cc0/gm%3A1458852608924/ops.lists%40gmail.com/?http%3A%2F%2Fwww.bombbomb.com=>
[image: BombBomb | Face to Face with more people, more often]
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] iCloud dropping all of our mail

[Joel Beckham]

I replied to Michelle directly.

Udeme -- I did take a look at that postmaster page and nothing really stood
out. We follow the best practices outlined there and I contacted the
support address listed there and didn't get a response.

On Thu, Mar 24, 2016 at 1:48 PM, Michelle Sullivan <miche...@sorbs.net>
wrote:

> Joel Beckham wrote:
>
>> Does anyone have any advice for troubleshooting what we're doing to upset
>> icloud domains so that they're dropping our mail? All our normal signals
>> (feedbackloops, bounces, etc) we use to suspend and terminate users sending
>> unwanted mail aren't showing anything unusual as well as all the reputation
>> signals we use are all showing that we're good.
>>
>> We are getting some intermittent bounces pointing to a Proofpoint block
>> (which seems to be coming and going), but the majority of the mail is being
>> accepted and then appears to be getting discarded (based upon open rates
>> and our own testing).
>>
>
> Did you get URLs pointing to the block? (You should have)
>
> If you have some message IDs I could get them looked up to see if/why they
> were dropped.
>
> Regards,
>
> --
> Michelle Sullivan
> http://www.mhix.org/
>
>


-- 
JOEL BECKHAM
Scalability Architect
[image: BombBomb | Face to Face with more people, more often]
W: BombBomb.com <http://www.bombbomb.com/>
[image: BombBomb | Face to Face with more people, more often]
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

[mailop] iCloud dropping all of our mail

[Joel Beckham]

Does anyone have any advice for troubleshooting what we're doing to upset
icloud domains so that they're dropping our mail? All our normal signals
(feedbackloops, bounces, etc) we use to suspend and terminate users sending
unwanted mail aren't showing anything unusual as well as all the reputation
signals we use are all showing that we're good.

We are getting some intermittent bounces pointing to a Proofpoint block
(which seems to be coming and going), but the majority of the mail is being
accepted and then appears to be getting discarded (based upon open rates
and our own testing).

Thanks!

-- 
JOEL BECKHAM

[image: BombBomb | Face to Face with more people, more often]
W: BombBomb.com
<https://bb.bixel.io/v1/track/click/5b03ad2e-fba5-0317-3bbe-4f961d5f5cc0/gm%3A1458844542276/mailop%40mailop.org/?http%3A%2F%2Fwww.bombbomb.com=>
[image: BombBomb | Face to Face with more people, more often]
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Yahoo DMARC changes

[Joel Beckham]

>
> It's likely that ARC will become the new - much better - workaround
> eventually, modulo the inevitable deployment issues. http://arc-spec.org
> 
>

I thought that ARC doesn't help with the ESP use case, or am I missing
something there?
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop