Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Bill Campbell]

On Wed, Mar 30, 2016, Michael Rathbun wrote:
...
>An elephant superficially resembles a mouse.  There are enormous structural
>differences.

An elephant is a mil-spec mouse.

Bill
-- 
INTERNET:   b...@celestial.com  Bill Campbell; Celestial Software LLC
URL: http://www.celestial.com/  PO Box 820; 6641 E. Mercer Way
Voice:  (206) 236-1676  Mercer Island, WA 98040-0820
Fax:(206) 232-9186  Skype: jwccsllc (206) 855-5792

But how is this legal plunder to be identified? Quite simply. See if the
law takes from some persons what belongs to them, and gives it to other
persons to whom it does not belong. See if the law benefits one citizen at
the expense of another by doing what the citizen himself cannot do without
committing a crime. -- Frederic Bastiat, The Law

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Michael Wise]

1) We require each FD server to accept around a thousand connections a second. 
:(
2) AV is not in our team's scope, but... yeah.
3) Hehehe... I <3 RegEx. I'd say more, but ... We're Being Watched. And not by 
Yoda.
And then there's fingerprinting, clustering, campaign ... I'm repeating 
myself.
4) We have issues with the CPU overhead required.
5) oh yes... and user management for ... millions (?) of 
corporations/domains/tenants.

And we need to write our own rules in very short order.
And $DIETY help you if you forget a . and don't notice.

Aloha,
Michael.
-- 
Michael J Wise | Microsoft | Spam Analysis | "Your Spam Specimen Has Been 
Processed." | Got the Junk Mail Reporting Tool ?

-Original Message-
From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Eric Henson
Sent: Wednesday, March 30, 2016 12:03 PM
To: mailop@mailop.org
Subject: Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

For my org, I have all my filtering on a single server (well, a pair in 
parallel, but you get my meaning). But that's not going to work for Hotmail.

Hotmail undoubtedly has multiple levels of filtering. Each check they do with 
the SMTP connection open increases the connection time and decreases the number 
of connections the server can handle, making more servers a requirement.

1. MX server: accept thousands of connections a minute. They might have time to 
check those connections for RBL, might not. They probably also check for valid 
recipient addresses and recipient limits. Maybe mailbox space. 
2. Antivirus filtering: Emails with HTML and attachments, get sent to the 
antivirus scanners. Plain text emails might bypass this step and go to the next 
step.
3. Text filtering: Text is analyzed for spam words.
4. Image filtering: Emails with inline images, get sent to the inline image 
spam detection servers. Other emails bypass this step.
5. Routing: Emails get routed to mailbox servers.

I'm just guessing at all that, but you'll agree that doing all that with an 
option connection is going to dramatically increase the number of servers 
needed. 

-Original Message-
From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Rich Kulawiec
Sent: Wednesday, March 30, 2016 1:42 PM
To: mailop@mailop.org
Subject: Re: [mailop] Mail accepted by 
https://na01.safelinks.protection.outlook.com/?url=outlook.com%2fhotmail.com=01%7c01%7cmichael.wise%40microsoft.com%7c8e4e54d3e4ed454f83b708d358ced692%7c72f988bf86f141af91ab2d7cd011db47%7c1=89jBpdKfzw%2bKbC3MNPim9fR%2friyJCbP3KnhsrIAEBj0%3d
 disappears.

On Wed, Mar 30, 2016 at 05:37:09PM +, Rodgers, Anthony (DTMB) wrote:
> Which is exactly what framed the tenor of my question when I 
> originally asked it. Very Large Providers operate at a scale and under 
> commercial pressures that most of us (including me) cannot even imagine.

Yes, but...

If you can run a mail system *properly* for 50,000 people, then you can run it 
properly for 500 million.  It's not really all that different or difficult.  
The trick is in the word "properly": if you make poor architectural, design, 
implementation, and procedural decisions, then oh my goodness yes, your life is 
going to be very tough indeed.

I don't want to get into the (many) (many!) arguments over those decisions
here, because we've kinda already had them.   I'll just say that I see
(here and elsewhere) mail system operators encountering problems that they 
never needed to have.  They could have rendered them moot at the whiteboard 
stage, but either they didn't know, or it looked like a good idea at the time, 
or management forced it on them, or something else happened, and well...now 
they're stuck.

In some cases, there are interactions between those problems that exacerbate 
things.  Worse, sometimes those interactions cause performance, scalability, or 
predictability problems.  (And anyone who's ever debugged software knows that 
things that stay broken are easier to diagnose and fix than things that are 
only broken some of the time.)

So that's why a lot of my answers to "how do I fix X?" are of the form "Don't 
do X, then you don't have to fix it".  Well, and because over many decades, 
I've had ample opportunity to do X, feel the ensuing pain, and realize that it 
was not a smart move. ;)

---rsk

___
mailop mailing list
mailop@mailop.org
https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fchilli.nosignal.org%2fcgi-bin%2fmailman%2flistinfo%2fmailop=01%7c01%7cmichael.wise%40microsoft.com%7c8e4e54d3e4ed454f83b708d358ced692%7c72f988bf86f141af91ab2d7cd011db47%7c1=Kkmf9SThAYewP8aRI2cKmNHYCNZb%2bl4kxsefWQrebpI%3d
___
mailop mailing list
mailop@mailop.org
https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fchilli.nosignal.org%2fcgi-bin%2fmailman%2flistinfo%2fmailop=01%7c01%7cmichael.wis

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Michael Rathbun]

On Wed, 30 Mar 2016 14:41:44 -0400, Rich Kulawiec  wrote:

>Yes, but...
>
>If you can run a mail system *properly* for 50,000 people, then you can
>run it properly for 500 million.  It's not really all that different
>or difficult.  

You apparently have yet to run up against the version of the square/cube law
as it applies to systems of this sort.

An elephant superficially resembles a mouse.  There are enormous structural
differences.

mdr
-- 
   The System tends to oppose its own proper function.
-- Systemantics


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Michael Wise]

The shape of the systems are quite different. For instance, DNSBLs. If we 
queried SpamHaus, or any other DNSBL provider directly, they would instantly 
fall over. How long it takes to process each email becomes hyper critical...

But you know, these Disk Size Wars are pointless. We're hiring! And if you get 
the job, you can have the privilege of showing us exactly where we're wrong, 
driving the corrections thru to Deployment, and reap rich rewards!

C# and Exchange experience are ... A Plus.

https://careers.microsoft.com/jobdetails.aspx?jid=220173

Aloha,
Michael.
--
Sent from my Windows Phone

From: Rich Kulawiec<mailto:r...@gsp.org>
Sent: ‎3/‎30/‎2016 11:48 AM
To: mailop@mailop.org<mailto:mailop@mailop.org>
Subject: Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

On Wed, Mar 30, 2016 at 05:37:09PM +, Rodgers, Anthony (DTMB) wrote:
> Which is exactly what framed the tenor of my question when I originally
> asked it. Very Large Providers operate at a scale and under commercial
> pressures that most of us (including me) cannot even imagine.

Yes, but...

If you can run a mail system *properly* for 50,000 people, then you can
run it properly for 500 million.  It's not really all that different
or difficult.  The trick is in the word "properly": if you make poor
architectural, design, implementation, and procedural decisions, then
oh my goodness yes, your life is going to be very tough indeed.

I don't want to get into the (many) (many!) arguments over those decisions
here, because we've kinda already had them.   I'll just say that I see
(here and elsewhere) mail system operators encountering problems that
they never needed to have.  They could have rendered them moot at
the whiteboard stage, but either they didn't know, or it looked like
a good idea at the time, or management forced it on them, or something
else happened, and well...now they're stuck.

In some cases, there are interactions between those problems that
exacerbate things.  Worse, sometimes those interactions cause performance,
scalability, or predictability problems.  (And anyone who's ever
debugged software knows that things that stay broken are easier to
diagnose and fix than things that are only broken some of the time.)

So that's why a lot of my answers to "how do I fix X?" are of the
form "Don't do X, then you don't have to fix it".  Well, and because
over many decades, I've had ample opportunity to do X, feel the
ensuing pain, and realize that it was not a smart move. ;)

---rsk

___
mailop mailing list
mailop@mailop.org
https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fchilli.nosignal.org%2fcgi-bin%2fmailman%2flistinfo%2fmailop=01%7c01%7cmichael.wise%40microsoft.com%7cb520e5e9388e431ff62c08d358cbde70%7c72f988bf86f141af91ab2d7cd011db47%7c1=9blq0UpTAjZ%2f9%2flqdWWjKhSqQ%2bdlSUy2GCzFR4Hv9vw%3d
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Eric Henson]

For my org, I have all my filtering on a single server (well, a pair in 
parallel, but you get my meaning). But that's not going to work for Hotmail.

Hotmail undoubtedly has multiple levels of filtering. Each check they do with 
the SMTP connection open increases the connection time and decreases the number 
of connections the server can handle, making more servers a requirement.

1. MX server: accept thousands of connections a minute. They might have time to 
check those connections for RBL, might not. They probably also check for valid 
recipient addresses and recipient limits. Maybe mailbox space. 
2. Antivirus filtering: Emails with HTML and attachments, get sent to the 
antivirus scanners. Plain text emails might bypass this step and go to the next 
step.
3. Text filtering: Text is analyzed for spam words.
4. Image filtering: Emails with inline images, get sent to the inline image 
spam detection servers. Other emails bypass this step.
5. Routing: Emails get routed to mailbox servers.

I'm just guessing at all that, but you'll agree that doing all that with an 
option connection is going to dramatically increase the number of servers 
needed. 

-Original Message-
From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Rich Kulawiec
Sent: Wednesday, March 30, 2016 1:42 PM
To: mailop@mailop.org
Subject: Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

On Wed, Mar 30, 2016 at 05:37:09PM +, Rodgers, Anthony (DTMB) wrote:
> Which is exactly what framed the tenor of my question when I 
> originally asked it. Very Large Providers operate at a scale and under 
> commercial pressures that most of us (including me) cannot even imagine.

Yes, but...

If you can run a mail system *properly* for 50,000 people, then you can run it 
properly for 500 million.  It's not really all that different or difficult.  
The trick is in the word "properly": if you make poor architectural, design, 
implementation, and procedural decisions, then oh my goodness yes, your life is 
going to be very tough indeed.

I don't want to get into the (many) (many!) arguments over those decisions
here, because we've kinda already had them.   I'll just say that I see
(here and elsewhere) mail system operators encountering problems that they 
never needed to have.  They could have rendered them moot at the whiteboard 
stage, but either they didn't know, or it looked like a good idea at the time, 
or management forced it on them, or something else happened, and well...now 
they're stuck.

In some cases, there are interactions between those problems that exacerbate 
things.  Worse, sometimes those interactions cause performance, scalability, or 
predictability problems.  (And anyone who's ever debugged software knows that 
things that stay broken are easier to diagnose and fix than things that are 
only broken some of the time.)

So that's why a lot of my answers to "how do I fix X?" are of the form "Don't 
do X, then you don't have to fix it".  Well, and because over many decades, 
I've had ample opportunity to do X, feel the ensuing pain, and realize that it 
was not a smart move. ;)

---rsk

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Rodgers, Anthony (DTMB)]

Which is exactly what framed the tenor of my question when I originally asked 
it. Very Large Providers operate at a scale and under commercial pressures that 
most of us (including me) cannot even imagine.

--
Anthony Rodgers
Security Analyst
Michigan Security Operations Center (MiSOC)
DTMB, Michigan Cyber Security

-Original Message-
From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Michael Wise
Sent: Tuesday, March 29, 2016 21:21
To: Rich Kulawiec <r...@gsp.org>; mailop@mailop.org
Subject: Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

OF COURSE!
THAT'S THE SOLU...
Oh wait, that means we have to get 10x the number of servers ... and data 
centers.

Management won't like that.

So many people think that the things that work just spiffily when everything 
you do fits on a single mail server, will scale across a cluster that has tens 
if not hundreds of thousands of machines. In dozens of data centers. 
Geographically dispersed around the planet.

They don't.

Aloha,
Michael.
--
Michael J Wise | Microsoft | Spam Analysis | "Your Spam Specimen Has Been 
Processed." | Got the Junk Mail Reporting Tool ?

-Original Message-
From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Rich Kulawiec
Sent: Tuesday, March 29, 2016 6:06 PM
To: mailop@mailop.org
Subject: Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

On Wed, Mar 23, 2016 at 10:16:11AM -0700, Michael Peddemors wrote:
> For instance, if it believes
> the message is spam, and the recipient has requested that 'all'
> email be forwarded to a remote account, forwarding that email could 
> make it appear that the forwarder is the source of spam.

Solution: reject it (as spam) during the SMTP connection.  Don't
(knowingly) forward spam to anyone, anywhere, anytime.  (If someone is doing 
research and wants you to deliver it locally: fine.)

> Should you deliver malicious or harmful vectors to a person's email 
> box?  (Eg, a Virus laden attachment?)

Solution: scan it and reject it during the SMTP connection.  There's no point 
in delivering such traffic to anybody, even to those who are smart enough not 
to use highly vulnerable mail clients and operating systems.
(Same comment as above in re research.)

> What if you are in jurisdiction where delivering emails of a specific 
> content is illegal?

Solution: scan it and reject it during the SMTP connection.  If it's illegal to 
deliver, it's probably illegal to possess: so arrange matters so that you don't.

> What if the recipient has indicated that he wants it dropped, rather 
> than be delivered?

Solution: do not offer this option.


Yes, there are *still* edge cases where mail gets dropped: the one that occurs 
to me is spam addressed to a mailing list which makes it by all perimeter 
defenses and arrives in the list's queue. (Where it may be held for moderation; 
any well-run list does so with messages that don't
originate from subscribed addresses.)   Obviously it can't be
rejected any more, because the SMTP connection is closed.  And it sure 
shouldn't be distributed to everyone on the list.  So the only viable
option here is to drop it.   But the cases above are better handled
either by policies that avoid them or by the scanning that's done while the 
original SMTP connection is open.

---rsk

___
mailop mailing list
mailop@mailop.org
https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fchilli.nosignal.org%2fcgi-bin%2fmailman%2flistinfo%2fmailop=01%7c01%7cmichael.wise%40microsoft.com%7c5ea9534123d1437e25d608d35838cebb%7c72f988bf86f141af91ab2d7cd011db47%7c1=5ERMlSm8JTfM8HAOEpHuW7QRRF%2fD7RIfnkeeW%2bEIdV4%3d
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Rich Kulawiec]

On Tue, Mar 29, 2016 at 07:37:11PM -0700, Aaron C. de Bruyn wrote:
> Ok, I'll jump on that grenade.  Have the engineers heard of Linux or BSD? ;)

Thank you for taking one for the team.  It is indeed hard to say that
one's seriously competing in the Indy 500 when one shows up at the
starting line with a Yugo.

Less snarkily, one of the ways that people often get themselves into
trouble -- in terms of requiring excessive resources -- is that they
create complex architectures and feature sets that are neither necessary
nor desirable.  I've "fixed", for a loose value of that term, a lot
of mail systems not by addition, but by subtraction.  Reducing complexity,
removing code, minimizing the work done on a per-message (and per-byte)
basis yields architectures which behave more predictably, require
less human attention, scale MUCH better, and function tolerably well
under duress.

---rsk

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Aaron C. de Bruyn]

Interesting stats.  So in roughly 1 second you process more mail than I do
in about 3 months.

-A

On Tue, Mar 29, 2016 at 8:25 PM, Michael Wise <michael.w...@microsoft.com>
wrote:

> No worries.
> One can only imagine.
>
> What is now Office365, when it was acquired, was also running on
> RH/Postfix way back in the day, whereas HotMail started out on FreeBSD, if
> memory serves.
>
> Volume has grown from tens of millions of emails daily to tens of
> Billions, again IIRC.
>
> Aloha,
> Michael.
> --
> Sent from my Windows Phone
> --
> From: Aaron C. de Bruyn <aa...@heyaaron.com>
> Sent: ‎3/‎29/‎2016 7:45 PM
> To: Michael Wise <michael.w...@microsoft.com>
> Cc: Rich Kulawiec <r...@gsp.org>; mailop@mailop.org
> Subject: Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.
>
> On Tue, Mar 29, 2016 at 7:39 PM, Michael Wise <michael.w...@microsoft.com>
> wrote:
>
>> Yes.
>> A decade ago our service ran on it.
>>
>
> Yeah--that was my attempt at a bad joke.
>
> I would have paid good money to be a fly on the wall during the Hotmail
> conversion.
>
> -A
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Michael Wise]

No worries.
One can only imagine.

What is now Office365, when it was acquired, was also running on RH/Postfix way 
back in the day, whereas HotMail started out on FreeBSD, if memory serves.

Volume has grown from tens of millions of emails daily to tens of Billions, 
again IIRC.

Aloha,
Michael.
--
Sent from my Windows Phone

From: Aaron C. de Bruyn<mailto:aa...@heyaaron.com>
Sent: ‎3/‎29/‎2016 7:45 PM
To: Michael Wise<mailto:michael.w...@microsoft.com>
Cc: Rich Kulawiec<mailto:r...@gsp.org>; 
mailop@mailop.org<mailto:mailop@mailop.org>
Subject: Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

On Tue, Mar 29, 2016 at 7:39 PM, Michael Wise 
<michael.w...@microsoft.com<mailto:michael.w...@microsoft.com>> wrote:
Yes.
A decade ago our service ran on it.

Yeah--that was my attempt at a bad joke.

I would have paid good money to be a fly on the wall during the Hotmail 
conversion.

-A
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Aaron C. de Bruyn]

On Tue, Mar 29, 2016 at 7:39 PM, Michael Wise 
wrote:

> Yes.
> A decade ago our service ran on it.
>

Yeah--that was my attempt at a bad joke.

I would have paid good money to be a fly on the wall during the Hotmail
conversion.

-A
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Michael Wise]

Yes.
A decade ago our service ran on it.

Aloha,
Michael.
--
Sent from my Windows Phone

From: Aaron C. de Bruyn<mailto:aa...@heyaaron.com>
Sent: ‎3/‎29/‎2016 7:37 PM
To: Michael Wise<mailto:michael.w...@microsoft.com>
Cc: Rich Kulawiec<mailto:r...@gsp.org>; 
mailop@mailop.org<mailto:mailop@mailop.org>
Subject: Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

On Tue, Mar 29, 2016 at 6:53 PM, Michael Wise 
<michael.w...@microsoft.com<mailto:michael.w...@microsoft.com>> wrote:
Oh wait, that means we have to get 10x the number of servers ... and data 
centers.

Actually, the measures I outlined require *fewer* servers, less storage,
and (in most cases) less network bandwidth.

Our engineers tell management otherwise.

Ok, I'll jump on that grenade.  Have the engineers heard of Linux or BSD? ;)

-A

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Aaron C. de Bruyn]

On Tue, Mar 29, 2016 at 6:53 PM, Michael Wise 
wrote:

> Oh wait, that means we have to get 10x the number of servers ... and data
> centers.
>


> Actually, the measures I outlined require *fewer* servers, less storage,
> and (in most cases) less network bandwidth.
>


> Our engineers tell management otherwise.
>

Ok, I'll jump on that grenade.  Have the engineers heard of Linux or BSD? ;)

-A
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Michael Wise]

Our engineers tell management otherwise.

Aloha,
Michael.
--
Sent from my Windows Phone

From: Rich Kulawiec<mailto:r...@gsp.org>
Sent: ‎3/‎29/‎2016 6:46 PM
To: mailop@mailop.org<mailto:mailop@mailop.org>
Subject: Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

On Wed, Mar 30, 2016 at 01:21:17AM +, Michael Wise wrote:
> Oh wait, that means we have to get 10x the number of servers ... and data 
> centers.

Actually, the measures I outlined require *fewer* servers, less storage,
and (in most cases) less network bandwidth.  That's one of the reasons
I mentioned them.

---rsk

___
mailop mailing list
mailop@mailop.org
https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fchilli.nosignal.org%2fcgi-bin%2fmailman%2flistinfo%2fmailop=01%7c01%7cmichael.wise%40microsoft.com%7c2e2754afc6244e8df34608d3583d0c5b%7c72f988bf86f141af91ab2d7cd011db47%7c1=pr9uUOmUeSTjRkw92FUqxgKRIz5cig8uBOBGhAhSe4g%3d
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Rich Kulawiec]

On Wed, Mar 30, 2016 at 01:21:17AM +, Michael Wise wrote:
> Oh wait, that means we have to get 10x the number of servers ... and data 
> centers.

Actually, the measures I outlined require *fewer* servers, less storage,
and (in most cases) less network bandwidth.  That's one of the reasons
I mentioned them.

---rsk

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Michael Wise]

OF COURSE!
THAT'S THE SOLU...
Oh wait, that means we have to get 10x the number of servers ... and data 
centers.

Management won't like that.

So many people think that the things that work just spiffily when everything 
you do fits on a single mail server, will scale across a cluster that has tens 
if not hundreds of thousands of machines. In dozens of data centers. 
Geographically dispersed around the planet.

They don't.

Aloha,
Michael.
-- 
Michael J Wise | Microsoft | Spam Analysis | "Your Spam Specimen Has Been 
Processed." | Got the Junk Mail Reporting Tool ?

-Original Message-
From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Rich Kulawiec
Sent: Tuesday, March 29, 2016 6:06 PM
To: mailop@mailop.org
Subject: Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

On Wed, Mar 23, 2016 at 10:16:11AM -0700, Michael Peddemors wrote:
> For instance, if it believes
> the message is spam, and the recipient has requested that 'all'
> email be forwarded to a remote account, forwarding that email could
> make it appear that the forwarder is the source of spam.

Solution: reject it (as spam) during the SMTP connection.  Don't
(knowingly) forward spam to anyone, anywhere, anytime.  (If someone
is doing research and wants you to deliver it locally: fine.)

> Should you deliver malicious or harmful vectors to a person's email
> box?  (Eg, a Virus laden attachment?)

Solution: scan it and reject it during the SMTP connection.  There's no
point in delivering such traffic to anybody, even to those who are smart
enough not to use highly vulnerable mail clients and operating systems.
(Same comment as above in re research.)

> What if you are in jurisdiction where delivering emails of a
> specific content is illegal?

Solution: scan it and reject it during the SMTP connection.  If it's
illegal to deliver, it's probably illegal to possess: so arrange matters
so that you don't.

> What if the recipient has indicated that he wants it dropped, rather
> than be delivered?

Solution: do not offer this option.


Yes, there are *still* edge cases where mail gets dropped: the one that
occurs to me is spam addressed to a mailing list which makes it by all
perimeter defenses and arrives in the list's queue. (Where it may be
held for moderation; any well-run list does so with messages that don't
originate from subscribed addresses.)   Obviously it can't be
rejected any more, because the SMTP connection is closed.  And it sure
shouldn't be distributed to everyone on the list.  So the only viable
option here is to drop it.   But the cases above are better handled
either by policies that avoid them or by the scanning that's done
while the original SMTP connection is open.

---rsk

___
mailop mailing list
mailop@mailop.org
https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fchilli.nosignal.org%2fcgi-bin%2fmailman%2flistinfo%2fmailop=01%7c01%7cmichael.wise%40microsoft.com%7c5ea9534123d1437e25d608d35838cebb%7c72f988bf86f141af91ab2d7cd011db47%7c1=5ERMlSm8JTfM8HAOEpHuW7QRRF%2fD7RIfnkeeW%2bEIdV4%3d
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Rich Kulawiec]

On Wed, Mar 23, 2016 at 10:16:11AM -0700, Michael Peddemors wrote:
> For instance, if it believes
> the message is spam, and the recipient has requested that 'all'
> email be forwarded to a remote account, forwarding that email could
> make it appear that the forwarder is the source of spam.

Solution: reject it (as spam) during the SMTP connection.  Don't
(knowingly) forward spam to anyone, anywhere, anytime.  (If someone
is doing research and wants you to deliver it locally: fine.)

> Should you deliver malicious or harmful vectors to a person's email
> box?  (Eg, a Virus laden attachment?)

Solution: scan it and reject it during the SMTP connection.  There's no
point in delivering such traffic to anybody, even to those who are smart
enough not to use highly vulnerable mail clients and operating systems.
(Same comment as above in re research.)

> What if you are in jurisdiction where delivering emails of a
> specific content is illegal?

Solution: scan it and reject it during the SMTP connection.  If it's
illegal to deliver, it's probably illegal to possess: so arrange matters
so that you don't.

> What if the recipient has indicated that he wants it dropped, rather
> than be delivered?

Solution: do not offer this option.


Yes, there are *still* edge cases where mail gets dropped: the one that
occurs to me is spam addressed to a mailing list which makes it by all
perimeter defenses and arrives in the list's queue. (Where it may be
held for moderation; any well-run list does so with messages that don't
originate from subscribed addresses.)   Obviously it can't be
rejected any more, because the SMTP connection is closed.  And it sure
shouldn't be distributed to everyone on the list.  So the only viable
option here is to drop it.   But the cases above are better handled
either by policies that avoid them or by the scanning that's done
while the original SMTP connection is open.

---rsk

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Rodgers, Anthony (DTMB)]

Props, Michael.

Thanks!
--
Anthony Rodgers
Security Analyst
Michigan Security Operations Center (MiSOC)
DTMB, Michigan Cyber Security

-Original Message-
From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Michael Wise
Sent: Tuesday, March 22, 2016 13:40
To: Noel Butler <noel.but...@ausics.net>; mailop@mailop.org
Subject: Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

We have convinced some of the Powers That Be that we should find another 
solution, and there is an open-ness to change on this behavior. Not gonna be 
this week or this month ... who can say for sure. But noise is being made about 
it.

Aloha,
Michael.
--
Michael J Wise | Microsoft | Spam Analysis | "Your Spam Specimen Has Been 
Processed." | Got the Junk Mail Reporting Tool ?

-Original Message-
From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Noel Butler
Sent: Saturday, March 19, 2016 3:54 AM
To: mailop@mailop.org
Subject: Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

On 19/03/2016 09:11, Renaud Allard via mailop wrote:
> On 18/03/16 01:38, Michael Wise wrote:
>> And yes, under certain circumstances, Hotmail/Outlook will 250 the 
>> mail, and may then if it considers the IP sufficiently toxic, delete 
>> it without delivering it to the intended recipient’s INBOX or Junk 
>> folder with no NDR.
> 
> May I suppose that you agree this is something that should never 
> happen? Even if you do not have the power yourself to stop this 
> behaviour.
> 
> 
> 

They cant stop it.
This has been going on since like early 2000's, they couldnt fix cleanfeed 
then, so why you think or expect they can now is beyond me :)


-- 
If you have the urge to reply to all rather than reply to list, you best
first read  
https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fmembers.ausics.net%2fqwerty%2f=01%7c01%7cmichael.wise%40microsoft.com%7c35fe0c8a021849ee49b908d34fe6121b%7c72f988bf86f141af91ab2d7cd011db47%7c1=uoHJkueVwKBCr2Hz6O5CP6udx0gXKrwdymbizKpa9Uk%3d

___
mailop mailing list
mailop@mailop.org
https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fchilli.nosignal.org%2fcgi-bin%2fmailman%2flistinfo%2fmailop=01%7c01%7cmichael.wise%40microsoft.com%7c35fe0c8a021849ee49b908d34fe6121b%7c72f988bf86f141af91ab2d7cd011db47%7c1=%2fvIQjV5PowhdwK7SeJbUlK06RrPjSsscRMnQHyH88PE%3d
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Michelle Sullivan]

Brandon Long via mailop wrote:

I think it's a numbers problem.

If you handle a high enough volume of mail, if you sometimes drop 
mail, and sometimes have false positives that you drop... you will 
eventually reach a volume of dropped false positives that will have 
visible affects.


Ie, if you reach a point of dropping 100k or 1M good messages, you're 
going to have a bad time.


And, dropping mail that the user tells you to drop is fine, obviously.



As court documents can be delivered by email in some jurisdictions it'll 
be interesting the first time something that affects judgement is dropped.


.. I have recently been on the receiving end and it cost me just under 
€5000 ... The damages are currently in debate with the company concerned 
and they are looking at whether the provider is responsible (actually 
they're trying to blame the provider, however they mis-typed an email 
... 'gmail.com.mt' != 'gmail.com' and they're just trying to find a 
reason why it's not their fault.)


Regards,

Michelle

--
Michelle Sullivan
http://www.mhix.org/


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Gilles Chehade]

On Tue, Mar 22, 2016 at 05:39:43PM +, Michael Wise wrote:
> We have convinced some of the Powers That Be that we should find another 
> solution, and there is an open-ness to change on this behavior. Not gonna be 
> this week or this month ... who can say for sure. But noise is being made 
> about it.
> 

very very cool, this mail dropping thing is absurd and pretty much any
other option as harsh as it can be is going to be a better response :)

let us know if you need a megaphone to amplify your noise !

-- 
Gilles Chehade

https://www.poolp.org  @poolpOrg

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Luke Martinez via mailop]

Michael,

Could you elaborate on:

"The issue will be highlighted in the SNDS report, however."

Luke


On Thu, Mar 17, 2016 at 6:38 PM, Michael Wise 
wrote:

> Has the customer signed up for JMRP or SNDS?
>
> Because if not, that would be step #0; see below.
>
>
>
> And yes, under certain circumstances, Hotmail/Outlook will 250 the mail,
> and may then if it considers the IP sufficiently toxic, delete it without
> delivering it to the intended recipient’s INBOX or Junk folder with no NDR.
> The issue will be highlighted in the SNDS report, however.
>
>
>
> And there is **NO-ONE** at Microsoft who is a contact who can get things
> running smoothly again.
>
> The policy is cast in ferro-cement, no exceptions:
>
>
>
> 1)  Open a ticket and request mitigation for the IP(s) here:
> http://go.microsoft.com/fwlink/?LinkID=614866
>
> 2)  Wait and see what the machine thinks…
>
> 3)  If the IPs are not mitigated, reply to the email and request it,
> and provide as much detail as possible about:
>
> A)  what happened,
>
> B)  what you did to fix it,
>
> C)  and why it Won’t Happen Again.
>
>
>
> As to the programs that Senders should join, they are:
>
>
>
>
> *Join the Junk Mail Reporting Program (JMRP) *We believe that your
> recipients are the best indicator that the email you are sending is
> wanted.  The JMRP program allows you to see which of your emails
> Outlook.com users have marked as junk or unwanted mail.  Reviewing the
> results in JMRP will provide to the most direct information on what
> characteristics of your email, customers, and ultimately SmartScreen®,
> consider to be unwanted. This helpful feedback mechanism allows you to
> ensure that mails being sent from your IP are not resulting in negative
> feedback that could impact your sending reputation. Being vigilant about
> users who mark your e-mail as unwanted or the types of messages that are
> being marked as unwanted can help you keep mailing lists updated with only
> interested users and modify future campaigns. In addition, monitoring user
> complaints can help you identify unintended mail traffic or detect a
> potentially compromised account sending unwanted mail to your customers.
> Enroll at https://postmaster.live.com/snds/JMRP.aspx?wa=wsignin1.0.
>
>
>
> *Join the Smart Network Data Services program (SNDS)*
>
> The SNDS program provides data about traffic seen originating from your
> registered IP, such as mail volume and complaint rates. The data is built
> from the log files of the inbound mail machines and other servers at
> Outlook.com and Microsoft and represents factual information about the
> traffic from your mail servers to Outlook.com users. For more information
> about this free program refer to https://postmaster.live.com/snds/FAQ.aspx.
> To register, please go to http://postmaster.msn.com/snds/*.* (Tip: As
> part of the enrollment process, you are asked to sign the JMRP program
> agreement and then send a response to Support indicating that it has been
> signed.  It’s not uncommon for that step in the enrollment process to be
> missed.)
>
>
>
> Aloha,
>
> Michael.
>
> --
>
> *Michael J Wise* | Microsoft | Spam Analysis | "Your Spam Specimen Has
> Been Processed." | Got the Junk Mail Reporting Tool
>  ?
>
>
>
> *From:* mailop [mailto:mailop-boun...@mailop.org] *On Behalf Of *Aaron C.
> de Bruyn
> *Sent:* Thursday, March 17, 2016 5:12 PM
> *To:* mailop@mailop.org
> *Subject:* [mailop] Mail accepted by outlook.com/hotmail.com disappears.
>
>
>
> A customer complained to me they haven't been able to e-mail
> outlook/hotmail users for "a while".
>
>
>
> I talked with their IT department and they said "A few weeks ago we had a
> virus that spammed a bunch of people.  We cleaned it up and got de-listed
> everywhere, but outlook.com
> 
> is still broken".
>
>
>
> They gave up and turfed the issue to me (an outside consulting company).
>
>
>
> I set up a test account on outlook.com
> 
> and tried sending several messages.  After 30 minutes the messages aren't
> in my outlook.com
> 
> inbox or spam folder.
>
>
>
> I manually dug through the (password protected) archives 

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Aaron C. de Bruyn]

On Fri, Mar 18, 2016 at 11:22 AM, Hugo Slabbert 
wrote:
>
> They're welcome to run their own server at near-zero maintenance cost.
> But, if that mode of operating the mail server results in other mail
> systems being negatively impacted and the admins of those mail systems then
> taking corrective action that causes delivery issues for the customer,
> that's one of the consequences/implications of running your mail system on
> the cheap (read "poorly/not managed").
>

I totally get that.  When they got a virus, they ended up on every
blacklist known to man.
Here we are over a week later and they aren't on *any* blacklists and mail
delivery is working properly.

Except for Microsoft properties... :)


> Please know that I'm not trying to pin this on you or say that you're
> managing the system poorly; this is a consequence of the customer's choice
> of how much (little) they want to spend on managing that system/service.


I totally agree.

-A
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Luke Martinez via mailop]

That's interesting.

I find their ticketing system to be much more reliable and effective than
any other deliverability mitigation channel out there (aside from calling
in a favor with a friend.)

On Thu, Mar 17, 2016 at 7:38 PM, Marc Perkel 
wrote:

> I've had nothing but trouble with MS. Lots of messages delayed for hours.
> No one to contact and complain to. I think their system is broken and they
> don't know how to fix it.
>
>
> On 03/17/16 17:12, Aaron C. de Bruyn wrote:
>
> A customer complained to me they haven't been able to e-mail
> outlook/hotmail users for "a while".
>
> I talked with their IT department and they said "A few weeks ago we had a
> virus that spammed a bunch of people.  We cleaned it up and got de-listed
> everywhere, but outlook.com is still broken".
>
> They gave up and turfed the issue to me (an outside consulting company).
>
> I set up a test account on outlook.com and tried sending several
> messages.  After 30 minutes the messages aren't in my outlook.com inbox
> or spam folder.
>
> I manually dug through the (password protected) archives (which don't have
> a search feature) and gave up after hitting mid 2015.  I only found:
>
> http://windows.microsoft.com/en-us/outlook/not-receiving-email
>
> ...which is totally useless and ends up leading me to a generic support
> page.  (Strangely enough, I can search for "outlook.com unable to
> receive" and I can keep going in a loop forever.)
>
> Is there a better way of contacting Microsoft?
>
> Debug info:
>
> Mar 17 16:30:31 squid postfix/smtp[26744]: EB6401C4127: to=<
> darkpixe...@outlook.com>, relay=mx4.hotmail.com[65.55.92.184]:25,
> delay=0.87, delays=0.02/0/0.45/0.39, dsn=2.0.0, status=sent (250  <
> 20160317233030.eb6401c4...@mail.hamer-electric.com> Queued mail for
> delivery)
>
> Thanks,
>
> -A
>
>
>
> ___
> mailop mailing 
> listmailop@mailop.orghttps://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
>
> --
> Marc Perkel - 
> Sales/Supportsupport@junkemailfilter.comhttp://www.junkemailfilter.com
> Junk Email Filter dot com415-992-3400
>
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
>


-- 

Luke Martinez
SendGrid Deliverability Consultant
520.400.5693
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Hal Murray]

> * They like having a mail server that costs them $0/year for the last 8
> years, so they don't want to pay $200/mo to switch to Exchange online.

How much is their non-delivery problem costing them?  Be sure to include
lost-time as well as charges that show up on a bill

> I guess one of those things is going to have to 'give'.  I'd like it to be
> "Microsoft making it extremely difficult to get delisted once a virus has
> been cleaned up", but that's a pipe dream. 

An alternative thing to "give" would be getting infected and sending out spam.

Is the spam going direct or through their mail server.  If direct, some 
firewall rules might block that.  If through the mail server, some volume 
limits might catch it sooner.

In a way, I'm thankful that Microsoft is making it difficult to get delisted. 
 It makes people think about the cost-shifting they are doing.  They probably 
aren't thinking of it as cost-shifting, but at least they are becoming more 
aware of the problem.




-- 
These are my opinions.  I hate spam.




___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Rodgers, Anthony (DTMB)]

“…delete it without delivering it to the intended recipient’s INBOX or Junk 
folder with no NDR…”

When did dropping mail on the floor become acceptable? Or am I just grumpy?

Nobody wants backscatter, but that’s what SMTP-time DSNs are for, no?

I realize that organizations like Outlook/Hotmail operate at a scale that I 
can’t even imagine, so I am ready and willing to be educated...

--
Anthony Rodgers
Security Analyst
Michigan Security Operations Center (MiSOC)
DTMB, Michigan Cyber Security

From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Michael Wise
Sent: Thursday, March 17, 2016 20:39
To: Aaron C. de Bruyn <aa...@heyaaron.com>; mailop@mailop.org
Subject: Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

Has the customer signed up for JMRP or SNDS?
Because if not, that would be step #0; see below.

And yes, under certain circumstances, Hotmail/Outlook will 250 the mail, and 
may then if it considers the IP sufficiently toxic, delete it without 
delivering it to the intended recipient’s INBOX or Junk folder with no NDR. The 
issue will be highlighted in the SNDS report, however.

And there is *NO-ONE* at Microsoft who is a contact who can get things running 
smoothly again.
The policy is cast in ferro-cement, no exceptions:


1)  Open a ticket and request mitigation for the IP(s) here: 
http://go.microsoft.com/fwlink/?LinkID=614866

2)  Wait and see what the machine thinks…

3)  If the IPs are not mitigated, reply to the email and request it, and 
provide as much detail as possible about:

A) what happened,

B)  what you did to fix it,

C)  and why it Won’t Happen Again.

As to the programs that Senders should join, they are:

Join the Junk Mail Reporting Program (JMRP)
We believe that your recipients are the best indicator that the email you are 
sending is wanted.  The JMRP program allows you to see which of your emails 
Outlook.com users have marked as junk or unwanted mail.  Reviewing the results 
in JMRP will provide to the most direct information on what characteristics of 
your email, customers, and ultimately SmartScreen®, consider to be unwanted. 
This helpful feedback mechanism allows you to ensure that mails being sent from 
your IP are not resulting in negative feedback that could impact your sending 
reputation. Being vigilant about users who mark your e-mail as unwanted or the 
types of messages that are being marked as unwanted can help you keep mailing 
lists updated with only interested users and modify future campaigns. In 
addition, monitoring user complaints can help you identify unintended mail 
traffic or detect a potentially compromised account sending unwanted mail to 
your customers. Enroll at 
https://postmaster.live.com/snds/JMRP.aspx?wa=wsignin1.0.

Join the Smart Network Data Services program (SNDS)
The SNDS program provides data about traffic seen originating from your 
registered IP, such as mail volume and complaint rates. The data is built from 
the log files of the inbound mail machines and other servers at Outlook.com and 
Microsoft and represents factual information about the traffic from your mail 
servers to Outlook.com users. For more information about this free program 
refer to https://postmaster.live.com/snds/FAQ.aspx. To register, please go to 
http://postmaster.msn.com/snds/. (Tip: As part of the enrollment process, you 
are asked to sign the JMRP program agreement and then send a response to 
Support indicating that it has been signed.  It’s not uncommon for that step in 
the enrollment process to be missed.)

Aloha,
Michael.
--
Michael J Wise | Microsoft | Spam Analysis | "Your Spam Specimen Has Been 
Processed." | Got the Junk Mail Reporting 
Tool<http://www.microsoft.com/en-us/download/details.aspx?id=18275> ?

From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Aaron C. de Bruyn
Sent: Thursday, March 17, 2016 5:12 PM
To: mailop@mailop.org<mailto:mailop@mailop.org>
Subject: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

A customer complained to me they haven't been able to e-mail outlook/hotmail 
users for "a while".

I talked with their IT department and they said "A few weeks ago we had a virus 
that spammed a bunch of people.  We cleaned it up and got de-listed everywhere, 
but 
outlook.com<https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2foutlook.com=01%7c01%7cmichael.wise%40microsoft.com%7c1ad1c59689ad4329debe08d34ec39d82%7c72f988bf86f141af91ab2d7cd011db47%7c1=iDL%2b4ApS%2bv7Sg7TUAxIB4vohq5kzvJw51vTkSDs5Vyo%3d>
 is still broken".

They gave up and turfed the issue to me (an outside consulting company).

I set up a test account on 
outlook.com<https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2foutlook.com=01%7c01%7cmichael.wise%40microsoft.com%7c1ad1c59689ad4329debe08d34ec39d82%7c72f988bf86f141af91ab2d7cd011db47%7c1=iDL%2b4ApS%2bv7Sg7TUAxIB4vohq5kzvJw51v

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Marc Perkel]

I've had nothing but trouble with MS. Lots of messages delayed for 
hours. No one to contact and complain to. I think their system is broken 
and they don't know how to fix it.


On 03/17/16 17:12, Aaron C. de Bruyn wrote:
A customer complained to me they haven't been able to e-mail 
outlook/hotmail users for "a while".


I talked with their IT department and they said "A few weeks ago we 
had a virus that spammed a bunch of people.  We cleaned it up and got 
de-listed everywhere, but outlook.com  is still 
broken".


They gave up and turfed the issue to me (an outside consulting company).

I set up a test account on outlook.com  and tried 
sending several messages.  After 30 minutes the messages aren't in my 
outlook.com  inbox or spam folder.


I manually dug through the (password protected) archives (which don't 
have a search feature) and gave up after hitting mid 2015.  I only found:


http://windows.microsoft.com/en-us/outlook/not-receiving-email

...which is totally useless and ends up leading me to a generic 
support page.  (Strangely enough, I can search for "outlook.com 
 unable to receive" and I can keep going in a loop 
forever.)


Is there a better way of contacting Microsoft?

Debug info:

Mar 17 16:30:31 squid postfix/smtp[26744]: EB6401C4127: 
to=>, 
relay=mx4.hotmail.com [65.55.92.184]:25, 
delay=0.87, delays=0.02/0/0.45/0.39, dsn=2.0.0, status=sent (250 
 <20160317233030.eb6401c4...@mail.hamer-electric.com 
> Queued 
mail for delivery)


Thanks,

-A



___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop


--
Marc Perkel - Sales/Support
supp...@junkemailfilter.com
http://www.junkemailfilter.com
Junk Email Filter dot com
415-992-3400

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Aaron C. de Bruyn]

On Thu, Mar 17, 2016 at 10:04 PM, Jay Hennigan 
wrote:
>
> Am I just grumpy this week?
>>
>
> Kinda.


The desire to move to a small cabin in the woods and never hear the words
'e-mail' or 'Microsoft' ever again sounds perfect right about now--so I
guess I am grumpy.  ;)


> Is e-mail no longer a cooperative system?
>>
>
> It is. Please be at least as aggressive with stopping spam leaving your
> network as you are with that entering it.
>

I guess that's the crux of the problem.

* It's not my mail server.
* The customer can't afford full-time IT staff to manage and monitor their
infrastructure.  They don't want to pay us to manage their mail server
until it has problems.
* Microsoft makes it extremely difficult to get delisted once there are
problems (like a virus that blasts out spam)
* They like having a mail server that costs them $0/year for the last 8
years, so they don't want to pay $200/mo to switch to Exchange online.

I guess one of those things is going to have to 'give'.  I'd like it to be
"Microsoft making it extremely difficult to get delisted once a virus has
been cleaned up", but that's a pipe dream.

*sigh*

Thanks for the input Jay.

-A
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Suresh Ramasubramanian]

You sign up for your /24 on which you have a couple of hundred such customers, 
and receive those snds stats

If you see an IP going red you can hand this off to your customer for them to 
fix their hacked exchange, postfix with a test/test user or whatever it is that 
caused the issue.

> On 18-Mar-2016, at 7:29 AM, Aaron C. de Bruyn  wrote:
> 
> This is going to cause heartache for lots of small business that have their 
> own private mail server (Exchange, postfix, etc...) sitting on a static IP in 
> their office.
> Most of them don't have (and can't afford) a full-time IT person which is why 
> they call a company like mine from time to time.
> 
> If I'm going to have to spend 10 minutes signing up Microsoft's pet reporting 
> system for all of my customers it's going to take me somewhere around 3 weeks 
> of pounding away at the keyboard.

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Jay Hennigan]

On 3/17/16 6:59 PM, Aaron C. de Bruyn wrote:

On Thu, Mar 17, 2016 at 5:38 PM, Michael Wise
> wrote:

Has the customer signed up for JMRP or SNDS?
Because if not, that would be step #0; see below.

Nope.

This seems especially bad to me.
Is every mail provider out there going to create their own pet reporting
system that requires an account and approval before e-mail is accepted?


That isn't what it is for. The account and approval isn't before email 
is accepted (but it could be - their server, their rules).


The public is under the impression that email has at least a minimal 
expectation of privacy. The account and approval is so that Microsoft 
can share its customers' email that has been marked as abusive with a 
third party. The contract holds you accountable to use that email solely 
to deal with abuse. As one who receives feedback loop messages, I can 
assure you that people sometimes accidentally mark personal and 
sensitive email as junk that they wouldn't want being shared around the 
office by an admin geek at the sender's company or ISP. Microsoft wants 
assurance that forwarded messages will be treated as confidential, used 
to mitigate abuse, not be used to listwash for deliberate spam 
operations, etc.



This is going to cause heartache for lots of small business that have
their own private mail server (Exchange, postfix, etc...) sitting on a
static IP in their office.
Most of them don't have (and can't afford) a full-time IT person which
is why they call a company like mine from time to time.


As long as your customers don't send a very large volume of mail that 
recipient networks' customers flag as unwanted, it likely isn't going to 
be an issue. If they send such quantities of abusive mail deliberately, 
there isn't much you can do about it, and you may not want them as 
customers. If they do so accidentally, then fixing the problem should be 
priority one, then clean up the damage. Cleaning it up is likely to 
involve jumping through hoops at multiple recipients and may not be 
immediate or 100% effective. Some recipients may choose to leave the IPs 
in the discard pile because the risks outweigh the benefits. Their 
server, their rules.



If I'm going to have to spend 10 minutes signing up Microsoft's pet
reporting system for all of my customers it's going to take me somewhere
around 3 weeks of pounding away at the keyboard.


Don't do that then. The reporting system is early warning that your 
customer has a spam problem. You could make it a value-add if it's too 
much of a hassle. "For [some amount of] dollars per month, I'll monitor 
feedback loops and work with you early to mitigate any spam problems."



Maybe I'll set up my own pet reporting system.  If you want to reach me,
please set aside 10 minutes of your time and contact me at my 1-900
number.  It's $4.95 for the first 30 seconds, and I'll ask questions to
verify you aren't a spammer, then set you up for an account and finally
I will stop silently dropping your e-mail.


If the spam problem has been egregious enough that the recipient's ISP 
has felt enough pain to block the sender, then jumping through a few 
hoops to convince the receiving system ops that the abuse has stopped 
isn't that unreasonable.


If you do set up such a system and silently discard non-spam mail at 
random, you run a significant risk of losing customers. Feel free to try 
it if you want. Your server, your rules.



Seems like the whole point of this is to drive small businesses away
from paying a few hundred bucks for the setup of a Linux mail server (or
a few thousand for an Exchange server) and straight into the arms of
hundreds-of-dollars-per-month in recurring revenue for large providers
like Microsoft and Exchange Online.


As long as the small businesses don't send such volumes of abuse as to 
get blocked, this isn't a problem.



Am I just grumpy this week?


Kinda.


Is e-mail no longer a cooperative system?


It is. Please be at least as aggressive with stopping spam leaving your 
network as you are with that entering it.


--
Jay Hennigan - CCIE #7880 - Network Engineering - j...@impulse.net
Impulse Internet Service  -  http://www.impulse.net/
Your local telephone and internet company - 805 884-6323 - WB6RDV

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Mark Milhollan]

On Fri, 18 Mar 2016, Michael Wise wrote:

>And yes, under certain circumstances, Hotmail/Outlook will [...] delete 
>[...] with no NDR. The issue will be highlighted in the SNDS report, 
>however.

Any idea what that looks like?  Are those the ones to be found in the 
blocked table on the ipStatus.aspx page, when present?  If you mean it 
is indicated on the data.aspx or dataIP.aspx pages then I don't think 
I've ever seen it or if I have it has not managed to stand out in my 
memory.  Pointers, pictures, etc., appreciated.


>Join the Smart Network Data Services program (SNDS)

>The SNDS program provides data about traffic seen originating from your 
>registered IP, such as mail volume and complaint rates.

The amount of info can be variable, but on the plus side it is very easy 
to handle after you setup automated access.

Usually samples of HELO/EHLO and MAIL FROM are provided, but sometimes 
they are omitted, e.g., 33 report periods across as many days for an IP 
address but only 31 have samples.  Not a terrible ratio, but the lack is 
like running across a pothole, yet they seldom relate to problems, at 
least not that we've found.

Much less often a message sample is provided, e.g., of those same 33 
report periods only 1 sample message link is present though there were 
22 yellow and only 11 green periods and in particular the link is for 
one of the green.  Alas the link provided no content, which is not 
unusual either (older links often don't provide content, newest usually 
do, sure caching ... but another pothole).  Way too often samples for 
red periods aren't provided but there'll be one for a non-red period, 
which isn't useless but isn't generally as useful.


/mark

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Aaron C. de Bruyn]

On Thu, Mar 17, 2016 at 5:38 PM, Michael Wise 
wrote:

> Has the customer signed up for JMRP or SNDS?
>
> Because if not, that would be step #0; see below.
>

Nope.

This seems especially bad to me.
Is every mail provider out there going to create their own pet reporting
system that requires an account and approval before e-mail is accepted?

This is going to cause heartache for lots of small business that have their
own private mail server (Exchange, postfix, etc...) sitting on a static IP
in their office.
Most of them don't have (and can't afford) a full-time IT person which is
why they call a company like mine from time to time.

If I'm going to have to spend 10 minutes signing up Microsoft's pet
reporting system for all of my customers it's going to take me somewhere
around 3 weeks of pounding away at the keyboard.

Maybe I'll set up my own pet reporting system.  If you want to reach me,
please set aside 10 minutes of your time and contact me at my 1-900
number.  It's $4.95 for the first 30 seconds, and I'll ask questions to
verify you aren't a spammer, then set you up for an account and finally I
will stop silently dropping your e-mail.

Seems like the whole point of this is to drive small businesses away from
paying a few hundred bucks for the setup of a Linux mail server (or a few
thousand for an Exchange server) and straight into the arms of
hundreds-of-dollars-per-month in recurring revenue for large providers like
Microsoft and Exchange Online.

Am I just grumpy this week?  Is e-mail no longer a cooperative system?

Anyways, enough ranting.  I appreciate the information Michael.  I'll
present them with the options of signing a contract for my company to deal
with SNDS and JMRP, a quotes for Exchange Online, and Google Apps so
someone else can deal with it.

-A

And there is **NO-ONE** at Microsoft who is a contact who can get things
> running smoothly again.
>

I've had exactly the same experience using Microsoft products and support.
 ;)
Ok--*now* it's enough ranting.

>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Alarig Le Lay]

On Fri Mar 18 00:38:36 2016, Michael Wise wrote:
> Has the customer signed up for JMRP or SNDS?
> Because if not, that would be step #0; see below.
> 
> And yes, under certain circumstances, Hotmail/Outlook will 250 the mail, and 
> may then if it considers the IP sufficiently toxic, delete it without 
> delivering it to the intended recipient’s INBOX or Junk folder with no NDR. 
> The issue will be highlighted in the SNDS report, however.
> 
> And there is *NO-ONE* at Microsoft who is a contact who can get things 
> running smoothly again.
> The policy is cast in ferro-cement, no exceptions:
> 
> 
> 1)  Open a ticket and request mitigation for the IP(s) here: 
> http://go.microsoft.com/fwlink/?LinkID=614866
> 
> 2)  Wait and see what the machine thinks…

Hi,

I did this for on of my IP, but the machine thinks it should be kept
blocked.
But, the /24 just appears on the Internet (was not even routed some
moths ago) and the mails are delivered if we use an IP from another
range.

What should we do in that case?

-- 
alarig


signature.asc
Description: Digital signature
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Michael Wise]

☺

You’re most welcome, Sir!

Aloha,
Michael.
--
Michael J Wise | Microsoft | Spam Analysis | "Your Spam Specimen Has Been 
Processed." | Got the Junk Mail Reporting 
Tool<http://www.microsoft.com/en-us/download/details.aspx?id=18275> ?

From: Rodgers, Anthony (DTMB) [mailto:rodger...@michigan.gov]
Sent: Friday, March 18, 2016 11:49 AM
To: Michael Wise <michael.w...@microsoft.com>; Aaron C. de Bruyn 
<aa...@heyaaron.com>; mailop@mailop.org
Subject: RE: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

“HotMail has been doing it for some time.”

Oh, I know ☺

“It’s another policy we’re trying to change.”

I appreciate that.

“And from time to time, throwing away stuff you find in the pipeline that “The 
Machine” says is toxic … has a certain appeal.”

I appreciate that also.

Thanks for the reply, and all your contributions to the list.
--
Anthony Rodgers
Security Analyst
Michigan Security Operations Center (MiSOC)
DTMB, Michigan Cyber Security

From: Michael Wise [mailto:michael.w...@microsoft.com]
Sent: Friday, March 18, 2016 14:34
To: Rodgers, Anthony (DTMB) 
<rodger...@michigan.gov<mailto:rodger...@michigan.gov>>; Aaron C. de Bruyn 
<aa...@heyaaron.com<mailto:aa...@heyaaron.com>>; 
mailop@mailop.org<mailto:mailop@mailop.org>
Subject: RE: [mailop] Mail accepted by outlook.com/hotmail.com disappears.


Acceptable by whom?
HotMail has been doing it for some time.
Many people external to Microsoft have noted this for some time…

It’s another policy we’re trying to change.

400+ Million customers online, tens of thousands of servers in many datacenters 
across the planet, all acting more or less as one.
And from time to time, throwing away stuff you find in the pipeline that “The 
Machine” says is toxic … has a certain appeal.

Aloha,
Michael.
--
Michael J Wise | Microsoft | Spam Analysis | "Your Spam Specimen Has Been 
Processed." | Got the Junk Mail Reporting 
Tool<https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fwww.microsoft.com%2fen-us%2fdownload%2fdetails.aspx%3fid%3d18275=01%7c01%7cMichael.Wise%40microsoft.com%7c5897517be69941435b1e08d34f5e03b1%7c72f988bf86f141af91ab2d7cd011db47%7c1=1Om89P0P9V1An7Unu3%2bOfvXhdBiImYaKpzXhoBhwoEg%3d>
 ?

From: Rodgers, Anthony (DTMB) [mailto:rodger...@michigan.gov]
Sent: Friday, March 18, 2016 11:29 AM
To: Michael Wise 
<michael.w...@microsoft.com<mailto:michael.w...@microsoft.com>>; Aaron C. de 
Bruyn <aa...@heyaaron.com<mailto:aa...@heyaaron.com>>; 
mailop@mailop.org<mailto:mailop@mailop.org>
Subject: RE: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

“…delete it without delivering it to the intended recipient’s INBOX or Junk 
folder with no NDR…”

When did dropping mail on the floor become acceptable? Or am I just grumpy?

Nobody wants backscatter, but that’s what SMTP-time DSNs are for, no?

I realize that organizations like Outlook/Hotmail operate at a scale that I 
can’t even imagine, so I am ready and willing to be educated...

--
Anthony Rodgers
Security Analyst
Michigan Security Operations Center (MiSOC)
DTMB, Michigan Cyber Security

From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Michael Wise
Sent: Thursday, March 17, 2016 20:39
To: Aaron C. de Bruyn <aa...@heyaaron.com<mailto:aa...@heyaaron.com>>; 
mailop@mailop.org<mailto:mailop@mailop.org>
Subject: Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

Has the customer signed up for JMRP or SNDS?
Because if not, that would be step #0; see below.

And yes, under certain circumstances, Hotmail/Outlook will 250 the mail, and 
may then if it considers the IP sufficiently toxic, delete it without 
delivering it to the intended recipient’s INBOX or Junk folder with no NDR. The 
issue will be highlighted in the SNDS report, however.

And there is *NO-ONE* at Microsoft who is a contact who can get things running 
smoothly again.
The policy is cast in ferro-cement, no exceptions:


1)  Open a ticket and request mitigation for the IP(s) here: 
http://go.microsoft.com/fwlink/?LinkID=614866<https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fgo.microsoft.com%2ffwlink%2f%3fLinkID%3d614866%26clcid=01%7c01%7cMichael.Wise%40microsoft.com%7cfbc0a6844b6546a5faec08d34f5b29da%7c72f988bf86f141af91ab2d7cd011db47%7c1=sfFU93k1bRXnl3nvM53LGzrMFaF%2fYOyKtX68RcXUaHo%3d>

2)  Wait and see what the machine thinks…

3)  If the IPs are not mitigated, reply to the email and request it, and 
provide as much detail as possible about:

A)  what happened,

B)  what you did to fix it,

C)  and why it Won’t Happen Again.

As to the programs that Senders should join, they are:

Join the Junk Mail Reporting Program (JMRP)
We believe that your recipients are the best indicator that the email you are 
sending is wanted.  The JMRP program allows you to see which of your emails 
Out

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Rodgers, Anthony (DTMB)]

“HotMail has been doing it for some time.”

Oh, I know ☺

“It’s another policy we’re trying to change.”

I appreciate that.

“And from time to time, throwing away stuff you find in the pipeline that “The 
Machine” says is toxic … has a certain appeal.”

I appreciate that also.

Thanks for the reply, and all your contributions to the list.
--
Anthony Rodgers
Security Analyst
Michigan Security Operations Center (MiSOC)
DTMB, Michigan Cyber Security

From: Michael Wise [mailto:michael.w...@microsoft.com]
Sent: Friday, March 18, 2016 14:34
To: Rodgers, Anthony (DTMB) <rodger...@michigan.gov>; Aaron C. de Bruyn 
<aa...@heyaaron.com>; mailop@mailop.org
Subject: RE: [mailop] Mail accepted by outlook.com/hotmail.com disappears.


Acceptable by whom?
HotMail has been doing it for some time.
Many people external to Microsoft have noted this for some time…

It’s another policy we’re trying to change.

400+ Million customers online, tens of thousands of servers in many datacenters 
across the planet, all acting more or less as one.
And from time to time, throwing away stuff you find in the pipeline that “The 
Machine” says is toxic … has a certain appeal.

Aloha,
Michael.
--
Michael J Wise | Microsoft | Spam Analysis | "Your Spam Specimen Has Been 
Processed." | Got the Junk Mail Reporting 
Tool<http://www.microsoft.com/en-us/download/details.aspx?id=18275> ?

From: Rodgers, Anthony (DTMB) [mailto:rodger...@michigan.gov]
Sent: Friday, March 18, 2016 11:29 AM
To: Michael Wise 
<michael.w...@microsoft.com<mailto:michael.w...@microsoft.com>>; Aaron C. de 
Bruyn <aa...@heyaaron.com<mailto:aa...@heyaaron.com>>; 
mailop@mailop.org<mailto:mailop@mailop.org>
Subject: RE: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

“…delete it without delivering it to the intended recipient’s INBOX or Junk 
folder with no NDR…”

When did dropping mail on the floor become acceptable? Or am I just grumpy?

Nobody wants backscatter, but that’s what SMTP-time DSNs are for, no?

I realize that organizations like Outlook/Hotmail operate at a scale that I 
can’t even imagine, so I am ready and willing to be educated...

--
Anthony Rodgers
Security Analyst
Michigan Security Operations Center (MiSOC)
DTMB, Michigan Cyber Security

From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Michael Wise
Sent: Thursday, March 17, 2016 20:39
To: Aaron C. de Bruyn <aa...@heyaaron.com<mailto:aa...@heyaaron.com>>; 
mailop@mailop.org<mailto:mailop@mailop.org>
Subject: Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

Has the customer signed up for JMRP or SNDS?
Because if not, that would be step #0; see below.

And yes, under certain circumstances, Hotmail/Outlook will 250 the mail, and 
may then if it considers the IP sufficiently toxic, delete it without 
delivering it to the intended recipient’s INBOX or Junk folder with no NDR. The 
issue will be highlighted in the SNDS report, however.

And there is *NO-ONE* at Microsoft who is a contact who can get things running 
smoothly again.
The policy is cast in ferro-cement, no exceptions:


1)  Open a ticket and request mitigation for the IP(s) here: 
http://go.microsoft.com/fwlink/?LinkID=614866<https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fgo.microsoft.com%2ffwlink%2f%3fLinkID%3d614866%26clcid=01%7c01%7cMichael.Wise%40microsoft.com%7cfbc0a6844b6546a5faec08d34f5b29da%7c72f988bf86f141af91ab2d7cd011db47%7c1=sfFU93k1bRXnl3nvM53LGzrMFaF%2fYOyKtX68RcXUaHo%3d>

2)  Wait and see what the machine thinks…

3)  If the IPs are not mitigated, reply to the email and request it, and 
provide as much detail as possible about:

A) what happened,

B)  what you did to fix it,

C)  and why it Won’t Happen Again.

As to the programs that Senders should join, they are:

Join the Junk Mail Reporting Program (JMRP)
We believe that your recipients are the best indicator that the email you are 
sending is wanted.  The JMRP program allows you to see which of your emails 
Outlook.com users have marked as junk or unwanted mail.  Reviewing the results 
in JMRP will provide to the most direct information on what characteristics of 
your email, customers, and ultimately SmartScreen®, consider to be unwanted. 
This helpful feedback mechanism allows you to ensure that mails being sent from 
your IP are not resulting in negative feedback that could impact your sending 
reputation. Being vigilant about users who mark your e-mail as unwanted or the 
types of messages that are being marked as unwanted can help you keep mailing 
lists updated with only interested users and modify future campaigns. In 
addition, monitoring user complaints can help you identify unintended mail 
traffic or detect a potentially compromised account sending unwanted mail to 
your customers. Enroll at 
https://postmaster.live.com/snds/JMRP.aspx?wa=wsignin1.0<https:

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Renaud Allard via mailop]

On 18/03/16 01:38, Michael Wise wrote:

And yes, under certain circumstances, Hotmail/Outlook will 250 the mail,
and may then if it considers the IP sufficiently toxic, delete it
without delivering it to the intended recipient’s INBOX or Junk folder
with no NDR.


May I suppose that you agree this is something that should never happen? 
Even if you do not have the power yourself to stop this behaviour.




smime.p7s
Description: S/MIME Cryptographic Signature
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Michael Wise]

We *ARE* working on making it easier…

Witness this (granted, if’s for Exchange Online, but):

https://sender.office.com

Some of it is taking longer than everyone would prefer, but.
Is that shack for rent on weekends?

Aloha,
Michael.
--
Michael J Wise | Microsoft | Spam Analysis | "Your Spam Specimen Has Been 
Processed." | Got the Junk Mail Reporting 
Tool<http://www.microsoft.com/en-us/download/details.aspx?id=18275> ?

From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Aaron C. de Bruyn
Sent: Friday, March 18, 2016 11:06 AM
To: Jay Hennigan <mailop-l...@keycodes.com>
Cc: mailop@mailop.org
Subject: Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

On Thu, Mar 17, 2016 at 10:04 PM, Jay Hennigan 
<mailop-l...@keycodes.com<mailto:mailop-l...@keycodes.com>> wrote:
Am I just grumpy this week?

Kinda.

The desire to move to a small cabin in the woods and never hear the words 
'e-mail' or 'Microsoft' ever again sounds perfect right about now--so I guess I 
am grumpy.  ;)

Is e-mail no longer a cooperative system?

It is. Please be at least as aggressive with stopping spam leaving your network 
as you are with that entering it.

I guess that's the crux of the problem.

* It's not my mail server.
* The customer can't afford full-time IT staff to manage and monitor their 
infrastructure.  They don't want to pay us to manage their mail server until it 
has problems.
* Microsoft makes it extremely difficult to get delisted once there are 
problems (like a virus that blasts out spam)
* They like having a mail server that costs them $0/year for the last 8 years, 
so they don't want to pay $200/mo to switch to Exchange online.

I guess one of those things is going to have to 'give'.  I'd like it to be 
"Microsoft making it extremely difficult to get delisted once a virus has been 
cleaned up", but that's a pipe dream.

*sigh*

Thanks for the input Jay.

-A
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Michael Wise]

Has the customer signed up for JMRP or SNDS?
Because if not, that would be step #0; see below.

And yes, under certain circumstances, Hotmail/Outlook will 250 the mail, and 
may then if it considers the IP sufficiently toxic, delete it without 
delivering it to the intended recipient’s INBOX or Junk folder with no NDR. The 
issue will be highlighted in the SNDS report, however.

And there is *NO-ONE* at Microsoft who is a contact who can get things running 
smoothly again.
The policy is cast in ferro-cement, no exceptions:


1)  Open a ticket and request mitigation for the IP(s) here: 
http://go.microsoft.com/fwlink/?LinkID=614866

2)  Wait and see what the machine thinks…

3)  If the IPs are not mitigated, reply to the email and request it, and 
provide as much detail as possible about:

A)  what happened,

B)  what you did to fix it,

C)  and why it Won’t Happen Again.

As to the programs that Senders should join, they are:

Join the Junk Mail Reporting Program (JMRP)
We believe that your recipients are the best indicator that the email you are 
sending is wanted.  The JMRP program allows you to see which of your emails 
Outlook.com users have marked as junk or unwanted mail.  Reviewing the results 
in JMRP will provide to the most direct information on what characteristics of 
your email, customers, and ultimately SmartScreen®, consider to be unwanted. 
This helpful feedback mechanism allows you to ensure that mails being sent from 
your IP are not resulting in negative feedback that could impact your sending 
reputation. Being vigilant about users who mark your e-mail as unwanted or the 
types of messages that are being marked as unwanted can help you keep mailing 
lists updated with only interested users and modify future campaigns. In 
addition, monitoring user complaints can help you identify unintended mail 
traffic or detect a potentially compromised account sending unwanted mail to 
your customers. Enroll at 
https://postmaster.live.com/snds/JMRP.aspx?wa=wsignin1.0.

Join the Smart Network Data Services program (SNDS)
The SNDS program provides data about traffic seen originating from your 
registered IP, such as mail volume and complaint rates. The data is built from 
the log files of the inbound mail machines and other servers at Outlook.com and 
Microsoft and represents factual information about the traffic from your mail 
servers to Outlook.com users. For more information about this free program 
refer to https://postmaster.live.com/snds/FAQ.aspx. To register, please go to 
http://postmaster.msn.com/snds/. (Tip: As part of the enrollment process, you 
are asked to sign the JMRP program agreement and then send a response to 
Support indicating that it has been signed.  It’s not uncommon for that step in 
the enrollment process to be missed.)

Aloha,
Michael.
--
Michael J Wise | Microsoft | Spam Analysis | "Your Spam Specimen Has Been 
Processed." | Got the Junk Mail Reporting 
Tool ?

From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Aaron C. de Bruyn
Sent: Thursday, March 17, 2016 5:12 PM
To: mailop@mailop.org
Subject: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

A customer complained to me they haven't been able to e-mail outlook/hotmail 
users for "a while".

I talked with their IT department and they said "A few weeks ago we had a virus 
that spammed a bunch of people.  We cleaned it up and got de-listed everywhere, 
but 
outlook.com
 is still broken".

They gave up and turfed the issue to me (an outside consulting company).

I set up a test account on 
outlook.com
 and tried sending several messages.  After 30 minutes the messages aren't in 
my 
outlook.com
 inbox or spam folder.

I manually dug through the (password protected) archives (which don't have a 
search feature) and gave up after hitting mid 2015.  I only found:

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Michael Wise]

Acceptable by whom?
HotMail has been doing it for some time.
Many people external to Microsoft have noted this for some time…

It’s another policy we’re trying to change.

400+ Million customers online, tens of thousands of servers in many datacenters 
across the planet, all acting more or less as one.
And from time to time, throwing away stuff you find in the pipeline that “The 
Machine” says is toxic … has a certain appeal.

Aloha,
Michael.
--
Michael J Wise | Microsoft | Spam Analysis | "Your Spam Specimen Has Been 
Processed." | Got the Junk Mail Reporting 
Tool<http://www.microsoft.com/en-us/download/details.aspx?id=18275> ?

From: Rodgers, Anthony (DTMB) [mailto:rodger...@michigan.gov]
Sent: Friday, March 18, 2016 11:29 AM
To: Michael Wise <michael.w...@microsoft.com>; Aaron C. de Bruyn 
<aa...@heyaaron.com>; mailop@mailop.org
Subject: RE: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

“…delete it without delivering it to the intended recipient’s INBOX or Junk 
folder with no NDR…”

When did dropping mail on the floor become acceptable? Or am I just grumpy?

Nobody wants backscatter, but that’s what SMTP-time DSNs are for, no?

I realize that organizations like Outlook/Hotmail operate at a scale that I 
can’t even imagine, so I am ready and willing to be educated...

--
Anthony Rodgers
Security Analyst
Michigan Security Operations Center (MiSOC)
DTMB, Michigan Cyber Security

From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Michael Wise
Sent: Thursday, March 17, 2016 20:39
To: Aaron C. de Bruyn <aa...@heyaaron.com<mailto:aa...@heyaaron.com>>; 
mailop@mailop.org<mailto:mailop@mailop.org>
Subject: Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

Has the customer signed up for JMRP or SNDS?
Because if not, that would be step #0; see below.

And yes, under certain circumstances, Hotmail/Outlook will 250 the mail, and 
may then if it considers the IP sufficiently toxic, delete it without 
delivering it to the intended recipient’s INBOX or Junk folder with no NDR. The 
issue will be highlighted in the SNDS report, however.

And there is *NO-ONE* at Microsoft who is a contact who can get things running 
smoothly again.
The policy is cast in ferro-cement, no exceptions:


1)  Open a ticket and request mitigation for the IP(s) here: 
http://go.microsoft.com/fwlink/?LinkID=614866<https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fgo.microsoft.com%2ffwlink%2f%3fLinkID%3d614866%26clcid=01%7c01%7cMichael.Wise%40microsoft.com%7cfbc0a6844b6546a5faec08d34f5b29da%7c72f988bf86f141af91ab2d7cd011db47%7c1=sfFU93k1bRXnl3nvM53LGzrMFaF%2fYOyKtX68RcXUaHo%3d>

2)  Wait and see what the machine thinks…

3)  If the IPs are not mitigated, reply to the email and request it, and 
provide as much detail as possible about:

A)  what happened,

B)  what you did to fix it,

C)  and why it Won’t Happen Again.

As to the programs that Senders should join, they are:

Join the Junk Mail Reporting Program (JMRP)
We believe that your recipients are the best indicator that the email you are 
sending is wanted.  The JMRP program allows you to see which of your emails 
Outlook.com users have marked as junk or unwanted mail.  Reviewing the results 
in JMRP will provide to the most direct information on what characteristics of 
your email, customers, and ultimately SmartScreen®, consider to be unwanted. 
This helpful feedback mechanism allows you to ensure that mails being sent from 
your IP are not resulting in negative feedback that could impact your sending 
reputation. Being vigilant about users who mark your e-mail as unwanted or the 
types of messages that are being marked as unwanted can help you keep mailing 
lists updated with only interested users and modify future campaigns. In 
addition, monitoring user complaints can help you identify unintended mail 
traffic or detect a potentially compromised account sending unwanted mail to 
your customers. Enroll at 
https://postmaster.live.com/snds/JMRP.aspx?wa=wsignin1.0<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fpostmaster.live.com%2fsnds%2fJMRP.aspx%3fwa%3dwsignin1.0=01%7c01%7cMichael.Wise%40microsoft.com%7cfbc0a6844b6546a5faec08d34f5b29da%7c72f988bf86f141af91ab2d7cd011db47%7c1=X9LxDPj1nu%2fkS0WUGZWdDNuz2dh4wnWZgELtWepTjfA%3d>.

Join the Smart Network Data Services program (SNDS)
The SNDS program provides data about traffic seen originating from your 
registered IP, such as mail volume and complaint rates. The data is built from 
the log files of the inbound mail machines and other servers at Outlook.com and 
Microsoft and represents factual information about the traffic from your mail 
servers to Outlook.com users. For more information about this free program 
refer to 
https://postmaster.live.com/snds/FAQ.aspx<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fpostmaster.live

Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

[Michael Wise]

☺
Heh…
Dunno if I could tolerate that many farm animals, as I really need to sleep in 
on the weekends.

But I will keep it in mind. ☺
Although I’d prefer cider or, “Not Your Father’s Rootbeer” (that stuff goes 
down wickedfast)

Aloha,
Michael.
--
Michael J Wise | Microsoft | Spam Analysis | "Your Spam Specimen Has Been 
Processed." | Got the Junk Mail Reporting 
Tool<http://www.microsoft.com/en-us/download/details.aspx?id=18275> ?

From: Aaron C. de Bruyn [mailto:aa...@heyaaron.com]
Sent: Friday, March 18, 2016 11:40 AM
To: Michael Wise <michael.w...@microsoft.com>
Cc: Jay Hennigan <mailop-l...@keycodes.com>; mailop@mailop.org
Subject: Re: [mailop] Mail accepted by outlook.com/hotmail.com disappears.

On Fri, Mar 18, 2016 at 11:25 AM, Michael Wise 
<michael.w...@microsoft.com<mailto:michael.w...@microsoft.com>> wrote:
We *ARE* working on making it easier…

Witness this (granted, if’s for Exchange Online, but):


https://sender.office.com<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fsender.office.com=01%7c01%7cMichael.Wise%40microsoft.com%7c838777d8c6504c05e6e308d34f5cb54c%7c72f988bf86f141af91ab2d7cd011db47%7c1=yJ7yf%2fFeWInDa8jJhpAiFJC86rZkAxUON0QtX4TPFF8%3d>

Handy.  I'm stashing that link away.

Is that shack for rent on weekends?

Yes.  You just have to put up with 10 ducks, 8 geese, 150 turkeys, 90 chickens, 
and 8 overly-friendly emu.  As a bonus, it's about 120 minutes south of 
Redmond.  Let me know when you're coming and I'll have the fridge stocked with 
beer.  ;)

Once again, I appreciate the help Michael.

-A
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop