Re: [mailop] Microsoft/Hotmail discards mails

[Michael Wise via mailop]

We call that feature, DBEB, we call the Proxy servers the, "Front Door", and we 
call the Tenant servers the, "Hub"s.
But yes.

If you want edge block/reject data, you should bring that up as a feature 
request with your Customer Support contacts.
And while I have opinions on this feature, I will keep them to myself.

Aloha,
Michael.
-- 
Michael J Wise | Microsoft | Spam Analysis | "Your Spam Specimen Has Been 
Processed." | Got the Junk Mail Reporting Tool ?

-Original Message-
From: Chad M Stewart [mailto:c...@balius.com] 
Sent: Monday, June 13, 2016 12:43 PM
To: Michael Wise <michael.w...@microsoft.com>
Cc: Suresh Ramasubramanian <ops.li...@gmail.com>; Brandon Long 
<bl...@google.com>; mailop <mailop@mailop.org>; Hugo Slabbert 
<hslabb...@stargate.ca>
Subject: Re: [mailop] Microsoft/Hotmail discards mails

As someone who administers an O365 tenant for ~ 500 mailboxes I just learned 
that if you enable 
https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftechnet.microsoft.com%2fen-us%2flibrary%2fdn600322(v%3dexchg.150).aspx=01%7c01%7cMichael.Wise%40microsoft.com%7c2ec3322daa1949c3bb2108d393c2e6f0%7c72f988bf86f141af91ab2d7cd011db47%7c1=iveJkFT3ixoQgSzPsq9ZkvGdEklcOjjBS8v2t6cGIzw%3d
 (which I suspect most tenants do) then the O365 tools provided do NOT provide 
log data from the proxy server tier, at least that was what the support 
representative called it.

My understanding is that the flow looks something like Internet -> O365 Proxy 
servers -> O365 Tenant servers.  The proxy tier information is not included in 
the O365 Message Trace results.  Only log data from the tenant servers is 
included.

Which to me means that something other than O365 should always be responsible 
for the MX record.  Otherwise events happen and yet as an administrator I’m not 
privy to what, why, when, etc..  Using another service/MTA that I do have 
complete log data for allows me to know what is happening.

I found out about this lack of log data as I was testing something, it got 
rejected at the edge (i.e. proxy tier) and yet Message Trace didn’t show it.  
Thankfully we do have another SP for our MX and their logs clearly showed the 
rejection.

Now if I could just combine the SP and O365 logs into Splunk (or similar) I’d 
be very happy and could find things much faster.  :-)


-Chad



> On Jun 13, 2016, at 12:32 PM, Michael Wise via mailop <mailop@mailop.org> 
> wrote:
> 
> 
> Just to chime in for Office365, we either reject at the edge, or deliver to 
> Junk/Quarantine.
> 
> If there is an attack on our infrastructure in progress, and we can 
> specifically identify distinctives of the attack, we may craft a DROP rule 
> for that traffic, once we're certain of the bogus nature of it, but that 
> happens on the order of maybe once every two or three months, and the rule is 
> torn out as soon as the attack has subsided.
> 
> Otherwise, Office365 never drops mail, unless the user specifically chooses 
> an option (delete high confidence spam) to do so, which we don't recommend.
> 
> Aloha,
> Michael.
> --
> Michael J Wise | Microsoft | Spam Analysis | "Your Spam Specimen Has Been 
> Processed." | Got the Junk Mail Reporting Tool ?
> 
> -Original Message-
> From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Suresh 
> Ramasubramanian
> Sent: Monday, June 13, 2016 10:15 AM
> To: Brandon Long <bl...@google.com>
> Cc: mailop <mailop@mailop.org>; Hugo Slabbert <hslabb...@stargate.ca>
> Subject: Re: [mailop] Microsoft/Hotmail discards mails
> 
> That's where a human postmaster team comes in handy along with sufficient 
> automation (self removals, automated relists, automated upgrades to covering 
> cidr blocks, a template driven ticketing system that lets you handle multiple 
> tickets with a single set of actions for reply / closure ..
> 
> Give the automation you actually won't need as many people as you 
> think (two full time people for 40++ million users was fun till about 
> eight years back)
> 
> --srs
> 
>> On 13-Jun-2016, at 9:36 PM, Brandon Long via mailop <mailop@mailop.org> 
>> wrote:
>> 
>> OTOH, our SMTP time rejections have their own issues, false positives are a 
>> lot more visible and harder to deal with (user's can't mark an smtp time 
>> rejection as "not spam").  Most of the questions/complaints on mailop about 
>> Gmail are due to our SMTP time rejections.
> 
> ___
> mailop mailing list
> mailop@mailop.org
> https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fchill
> i.nosignal.org%2fcgi-bin%2fmailman%2flistinfo%2fmailop=01%7c01%7c
> michael.wise%40microsoft.com%7cb38463fb725c450836c808d393aed6d5%7c72f9
> 88bf

Re: [mailop] Microsoft/Hotmail discards mails

[Chad M Stewart]

As someone who administers an O365 tenant for ~ 500 mailboxes I just learned 
that if you enable 
https://technet.microsoft.com/en-us/library/dn600322(v=exchg.150).aspx (which I 
suspect most tenants do) then the O365 tools provided do NOT provide log data 
from the proxy server tier, at least that was what the support representative 
called it.

My understanding is that the flow looks something like Internet -> O365 Proxy 
servers -> O365 Tenant servers.  The proxy tier information is not included in 
the O365 Message Trace results.  Only log data from the tenant servers is 
included.

Which to me means that something other than O365 should always be responsible 
for the MX record.  Otherwise events happen and yet as an administrator I’m not 
privy to what, why, when, etc..  Using another service/MTA that I do have 
complete log data for allows me to know what is happening.

I found out about this lack of log data as I was testing something, it got 
rejected at the edge (i.e. proxy tier) and yet Message Trace didn’t show it.  
Thankfully we do have another SP for our MX and their logs clearly showed the 
rejection.

Now if I could just combine the SP and O365 logs into Splunk (or similar) I’d 
be very happy and could find things much faster.  :-)


-Chad



> On Jun 13, 2016, at 12:32 PM, Michael Wise via mailop <mailop@mailop.org> 
> wrote:
> 
> 
> Just to chime in for Office365, we either reject at the edge, or deliver to 
> Junk/Quarantine.
> 
> If there is an attack on our infrastructure in progress, and we can 
> specifically identify distinctives of the attack, we may craft a DROP rule 
> for that traffic, once we're certain of the bogus nature of it, but that 
> happens on the order of maybe once every two or three months, and the rule is 
> torn out as soon as the attack has subsided.
> 
> Otherwise, Office365 never drops mail, unless the user specifically chooses 
> an option (delete high confidence spam) to do so, which we don't recommend.
> 
> Aloha,
> Michael.
> -- 
> Michael J Wise | Microsoft | Spam Analysis | "Your Spam Specimen Has Been 
> Processed." | Got the Junk Mail Reporting Tool ?
> 
> -Original Message-
> From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Suresh 
> Ramasubramanian
> Sent: Monday, June 13, 2016 10:15 AM
> To: Brandon Long <bl...@google.com>
> Cc: mailop <mailop@mailop.org>; Hugo Slabbert <hslabb...@stargate.ca>
> Subject: Re: [mailop] Microsoft/Hotmail discards mails
> 
> That's where a human postmaster team comes in handy along with sufficient 
> automation (self removals, automated relists, automated upgrades to covering 
> cidr blocks, a template driven ticketing system that lets you handle multiple 
> tickets with a single set of actions for reply / closure ..
> 
> Give the automation you actually won't need as many people as you think (two 
> full time people for 40++ million users was fun till about eight years back)
> 
> --srs
> 
>> On 13-Jun-2016, at 9:36 PM, Brandon Long via mailop <mailop@mailop.org> 
>> wrote:
>> 
>> OTOH, our SMTP time rejections have their own issues, false positives are a 
>> lot more visible and harder to deal with (user's can't mark an smtp time 
>> rejection as "not spam").  Most of the questions/complaints on mailop about 
>> Gmail are due to our SMTP time rejections.
> 
> ___
> mailop mailing list
> mailop@mailop.org
> https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fchilli.nosignal.org%2fcgi-bin%2fmailman%2flistinfo%2fmailop=01%7c01%7cmichael.wise%40microsoft.com%7cb38463fb725c450836c808d393aed6d5%7c72f988bf86f141af91ab2d7cd011db47%7c1=cd3FiliSb4BCvmPKlHhR9b3%2fIfcwXxLM%2bronn06eY1M%3d
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails [slightly OT]

[G. Miliotis]

On 13/6/2016 19:14, Brandon Long via mailop wrote:
I would argue something differently: many email users (and postal 
mail, for that matter), have an expectation that email is mostly but 
not 100% reliable, due to spam false positives or just the lack of 
delivery notification.


People can then choose to not respond to a message and later claim 
they never got it, and folks are not surprised.


I'm not saying that as mail operators we should encourage this, but we 
should understand user expectations.


Ie, if we decided suddenly to turn on delivery notification 
requesting/responding for all Gmail users, that would be a huge change 
to user's expectations, and probably wouldn't go over very well.  It's 
easy to see why turning on read notifications would be problemmatic, 
but I think most users would be equally surprised by delivery 
notifications.  And this is quite different from several other 
messaging systems that people routinely use where delivery and read 
notifications are standard, along with typing and prescence notifications.


Brandon


I see your point about user expectations varying. Of course, users want 
to have all mail accounted for but also simultaneously want to be 
protected from spam and not to be "annoyed" by having to do 
administrative work. I still believe we have a choice that does not 
involve just giving up.


However, I'm not in agreement that users actually expect internet mail 
to be occasionally lost. I have serviced thousands of users and none of 
them told me they expect mail to dissappear. Maybe you have actual 
metrics that I don't and the trend changes at scale? I think the 
parallels between actual IRL post and internet mail have a limit, and 
this is part of it.


As for delivery notifications, sure, I would not see a point in forcing 
them on people. I was not suggesting we force delivery notifications on 
everyone, I was referring to not swallowing up mails without a bounce of 
some sort. Even time-delayed. Or even a compromise solution, like having 
a special folder for those mails, putting then into Junk, Deleted, etc. 
I believe we've actually made a choice as an internet society to get to 
this point, bastardising what mail is.


I guess some would call it progress, but I don't.

--GM



___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails

[Suresh Ramasubramanian]

That's where a human postmaster team comes in handy along with sufficient 
automation (self removals, automated relists, automated upgrades to covering 
cidr blocks, a template driven ticketing system that lets you handle multiple 
tickets with a single set of actions for reply / closure ..

Give the automation you actually won't need as many people as you think (two 
full time people for 40++ million users was fun till about eight years back)

--srs

> On 13-Jun-2016, at 9:36 PM, Brandon Long via mailop  wrote:
> 
> OTOH, our SMTP time rejections have their own issues, false positives are a 
> lot more visible and harder to deal with (user's can't mark an smtp time 
> rejection as "not spam").  Most of the questions/complaints on mailop about 
> Gmail are due to our SMTP time rejections.

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails [slightly OT]

[Brandon Long via mailop]

I would argue something differently: many email users (and postal mail, for
that matter), have an expectation that email is mostly but not 100%
reliable, due to spam false positives or just the lack of delivery
notification.

People can then choose to not respond to a message and later claim they
never got it, and folks are not surprised.

I'm not saying that as mail operators we should encourage this, but we
should understand user expectations.

Ie, if we decided suddenly to turn on delivery notification
requesting/responding for all Gmail users, that would be a huge change to
user's expectations, and probably wouldn't go over very well.  It's easy to
see why turning on read notifications would be problemmatic, but I think
most users would be equally surprised by delivery notifications.  And this
is quite different from several other messaging systems that people
routinely use where delivery and read notifications are standard, along
with typing and prescence notifications.

Brandon

On Thu, Jun 9, 2016 at 8:08 AM, G. Miliotis 
wrote:

> On 9/6/2016 17:46, Renaud Allard via mailop wrote:
>
>> Actually, many small operators also silently discard email. Whether it's
>> by incompetence, or voluntarily doesn't matter much. It's just less
>> visible than hotmail.
>>
>
> Undoubtedly, but they can't use the scaling-is-hard argument as a free
> pass. We should all be accountable if we break mail, big or small.
>
> In addition, you can prectically ignore a small mail operator but not the
> big players.
>
>
> --GM
>
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails

[Brandon Long via mailop]

On Fri, Jun 10, 2016 at 12:05 PM, Hugo Slabbert 
wrote:

> On Fri 2016-Jun-10 12:32:20 -0600, Tim Starr  wrote:
>
>>
>> I am not saying this is a good idea, but it sounds to me like what would
>> fit the bill here would be a new folder for each user called "Bounced" in
>> which they would see all messages sent to their email address but which
>> were bounced by their mailbox provider. However, that would defeat the
>> purpose of preventing sufficiently malicious email from wasting mailbox
>> provider resources, and would seem to be largely redundant with the
>> purposes of having a quarantine folder. It would allow for users to report
>> undesired bounces to the mailbox provider, though.
>>
>
> That doesn't really seem helpful to me.  If you've actually rejected the
> message and communicated that to the sending MTA, it's no longer your
> problem.  The sender can take up the issue of deliverability as you've
> given them sufficient information to do that.  We're dealing with the
> in-between zone where a message has not been rejected at SMTP time, but
> it's still spammy.  The Junk folder is the means to catch FPs and for the
> user to report those to their mailbox provider.  The problem is that
> silently discarding things after issuing a 25x removes that avenue from the
> user and the message vanishes into /dev/null.
>
> Honestly I would love to hear how other large mail hosts handle this.  The
> reasoning for discards after 25x have boiled down to "we operate at a scale
> you can only imagine; it doesn't work that way" plus some layer >=8
> issues.  That said, in this admittedly small sample group, I've seen this
> complaint leveled against Hotmail and the related services multiple times,
> but not against other large mailbox houses.
>
> Does Gmail & Google Apps do the same?  What about the large filtering
> services?  I and many others on this list do not operate at nearly the
> scale of the MS services, but some other orgs *do*.  Are we just not
> hearing about similar behaviour at those orgs?
>

No guarantee that we operate at the same scale (we're probably in the
ballpark), but we don't drop messages except when explicitly asked to by
senders/receivers (usually after they've managed to mailbomb themselves).

We either reject at SMTP time or we deliver to the user's mailbox (or where
ever their routing rules tell us to deliver to)... or we bounce.  We try to
keep bounces to a minimum, but that's not always possible.  I don't think
it likely we would bounce for just spam, however, usually it's due to late
ACL checks for Groups or due to split admin specified policy decisions for
messages with more than one recipient.  In some pretty extreme cases, we've
bounced after >30 days in the case of some irrecoverable internal bugs, but
our goal is deliver, reject or bounce, not to drop.

We do target a huge percentage of spam at SMTP time, and we have metrics to
try and keep the spam label delivery from getting too high, since no one
appreciates forcing users to look through a lot of spam or for us to have
to hold onto it (and delivery itself is fairly expensive).

Which isn't to say that handling this volume at SMTP time isn't
complicated, and perhaps we lucked out with our spam system to be able to
do that fairly easily... or we're just willing to take the resource hit to
do it.  I can imagine a different spam system which had higher latency and
wasn't able to be short-circuited for a quicker verdict with ease.

OTOH, our SMTP time rejections have their own issues, false positives are a
lot more visible and harder to deal with (user's can't mark an smtp time
rejection as "not spam").  Most of the questions/complaints on mailop about
Gmail are due to our SMTP time rejections.

Brandon
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails

[Dave Pooser]

>At the request of the customer-base, traffic that is classified as
>sufficiently spammy (by various "Black Box" algorithms that I have no
>knowledge of the inner workings...) is deleted even after a successful
>delivery.

Is this the case for O365 hosted email as well, or just a Hotmail thing?
Speaking as someone being dragged kicking and screaming from on-prem
Exchange to a subdomain of our beloved corporate overlords' O365 tenant,
this is the sort of thing I have nightmares about.
-- 
Dave Pooser
Cat-Herder-in-Chief, Pooserville.com



___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails

[Luis E. Muñoz]

First of all, my kudos to Michael for discussing this so openly.

On 10 Jun 2016, at 12:05, Hugo Slabbert wrote:

I think everyone gets that the preferred behaviour is to reject at 
SMTP time, that it gets difficult/impossible to do the more tests you 
try and stuff into the filtering decision making, and that we don't 
want backscatter.  But what options are there for working within those 
parameters while still honouring that a 25x response means that the 
user will have *some* indication of the message arriving, be that in 
their inbox, junk folder, or even just a report page/link of "these 
things were so horrible we did not even bother putting them in your 
spam folder"?


I don’t think these are “so horrible that we didn’t even put them 
in the spam folder”. There are obviously lightweight checks you can do 
before 25x. I would presume Hotmail is doing as much as they can there, 
because this is cheaper for them — this is the message you did not 
have to store, serve and eventually delete.


They then run their second tier tests, which are progressively more 
expensive. In some cases the messages get to the spam folder, in others 
the messages get silently discarded. We can only guess at the reason for 
the different outcomes. The point is that they can get away with 
silently discarding because their users do not complain about this in 
enough numbers, so there’s no argument for fixing this brokenness. 
Probably we arrived at this scenario because the anti-spam filters 
we’re talking about are the product of an evolutionary process years 
in the making, where incremental changes were used to adapt to the times 
— the current solution is *very* different to what was in place say, 
10 years ago.


More modern implementations in use at other large providers were 
designed from the ground up to avoid this entirely, which is why they 
are more cost effective over the long run. I think this could be better 
leveraged as a business reason to rally the required resources to fix 
this “weakness”. Of course, this depends in the business model to 
really support this kind of thing, which I find dubious for Hotmail.


Best regards

-lem
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails

[Hugo Slabbert]

On Fri 2016-Jun-10 12:32:20 -0600, Tim Starr  wrote:


I am not saying this is a good idea, but it sounds to me like what would
fit the bill here would be a new folder for each user called "Bounced" in
which they would see all messages sent to their email address but which
were bounced by their mailbox provider. However, that would defeat the
purpose of preventing sufficiently malicious email from wasting mailbox
provider resources, and would seem to be largely redundant with the
purposes of having a quarantine folder. It would allow for users to report
undesired bounces to the mailbox provider, though.


That doesn't really seem helpful to me.  If you've actually rejected the 
message and communicated that to the sending MTA, it's no longer your 
problem.  The sender can take up the issue of deliverability as you've 
given them sufficient information to do that.  We're dealing with the 
in-between zone where a message has not been rejected at SMTP time, but 
it's still spammy.  The Junk folder is the means to catch FPs and for the 
user to report those to their mailbox provider.  The problem is that 
silently discarding things after issuing a 25x removes that avenue from the 
user and the message vanishes into /dev/null.


Honestly I would love to hear how other large mail hosts handle this.  The 
reasoning for discards after 25x have boiled down to "we operate at a scale 
you can only imagine; it doesn't work that way" plus some layer >=8 issues.  
That said, in this admittedly small sample group, I've seen this complaint 
leveled against Hotmail and the related services multiple times, but not 
against other large mailbox houses.


Does Gmail & Google Apps do the same?  What about the large filtering 
services?  I and many others on this list do not operate at nearly the 
scale of the MS services, but some other orgs *do*.  Are we just not 
hearing about similar behaviour at those orgs?


I think everyone gets that the preferred behaviour is to reject at SMTP 
time, that it gets difficult/impossible to do the more tests you try and 
stuff into the filtering decision making, and that we don't want 
backscatter.  But what options are there for working within those 
parameters while still honouring that a 25x response means that the user 
will have *some* indication of the message arriving, be that in their 
inbox, junk folder, or even just a report page/link of "these things were 
so horrible we did not even bother putting them in your spam folder"?


Stuff the quick stuff in at SMTP time eval and reject the most egregious 
ones, do additional processing post-25x, deliver to junk folder if found to 
be spammy and feed back information from post-25x processing into the quick 
tests if possible (e.g. IP blacklisting for heavy offenders etc.).  Is such 
a thing feasible at über scale at play?


Dropping it on the floor is Not Nice.  We obviously don't live in an ideal 
world, but it would seem unfortunate for us to give up the goal of actually 
following through on our attestation that we will deliver the message to 
the user (even if in their naughty folder) because of scaling issues, if at 
all possible.


This is not any slight against Michael:  You provide a valuable bridge to 
the community and it is greatly appreciated that you brave the onslaught 
and offer insight into the inner workings of the machine.  You've indicated 
that you have a similar distate for silent drop and I think we're all on 
the same page with the objective.  I'm just hopeful there are alternative 
means that *do* scale and could be adopted to restore balance in the 
universe...




Tim Starr


--
Hugo



On Thu, Jun 9, 2016 at 9:52 AM, Renaud Allard via mailop 
wrote:




On 09/06/16 17:26, Steve Atkins wrote:




Actually, what I do is that when a mail goes to the junk folder, the
server gives a 5XX error message to the sender at the end of DATA phase.
So the sender, if real, knows something happened to his mail and that it
might not be read.



So if you mis-classify mail - and the fact that you *do* misclassify mail
is implicit
in your having a junk folder - users get bounced off the mailing lists
they've
subscribed to, despite having seen the mail arrive.



I do not really mis-classify emails. If it appears in the junk folder,
there is an extremely high chance that it's junk. In fact, I should
probably not have delivered it, and that's what I was doing before I
configured the junk folder. It's just done that to avoid the very rare
false positive.
If I look at my personal junk folder right now (2 weeks retention time),
it's 100% spam.


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop





___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop



___

Re: [mailop] Microsoft/Hotmail discards mails

[Tim Starr]

I am not saying this is a good idea, but it sounds to me like what would
fit the bill here would be a new folder for each user called "Bounced" in
which they would see all messages sent to their email address but which
were bounced by their mailbox provider. However, that would defeat the
purpose of preventing sufficiently malicious email from wasting mailbox
provider resources, and would seem to be largely redundant with the
purposes of having a quarantine folder. It would allow for users to report
undesired bounces to the mailbox provider, though.

Tim Starr

On Thu, Jun 9, 2016 at 9:52 AM, Renaud Allard via mailop 
wrote:

>
>
> On 09/06/16 17:26, Steve Atkins wrote:
>
>>
>>> Actually, what I do is that when a mail goes to the junk folder, the
>>> server gives a 5XX error message to the sender at the end of DATA phase.
>>> So the sender, if real, knows something happened to his mail and that it
>>> might not be read.
>>>
>>
>> So if you mis-classify mail - and the fact that you *do* misclassify mail
>> is implicit
>> in your having a junk folder - users get bounced off the mailing lists
>> they've
>> subscribed to, despite having seen the mail arrive.
>>
>>
> I do not really mis-classify emails. If it appears in the junk folder,
> there is an extremely high chance that it's junk. In fact, I should
> probably not have delivered it, and that's what I was doing before I
> configured the junk folder. It's just done that to avoid the very rare
> false positive.
> If I look at my personal junk folder right now (2 weeks retention time),
> it's 100% spam.
>
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails

[Rich Kulawiec]

On Thu, Jun 09, 2016 at 09:25:00AM +0100, Paul Smith wrote:
> I'd have thought that even if you do decide to just throw "extreme"
> junk away (which I think is a very bad idea, BTW), then you should
> tell the user that you've done so - either in a daily/weekly summary
> email or an online list or something. That seems to be the bare
> minimum for an MSP to do in such a case.

A better idea is to just reject it at connection time.  One of the
fundamental principles of mail system defense is that you *will*
make mistakes, so you should make them definitively, make them
consistently, make them as early as possible, and make them noisily.
For example: silently discarding an already-accepted message is horrible.
Rejecting it with a 550 and appropriate error message during the delivery
attempt is excellent.  It's better for everyone because it creates log
entries that can be found, read, and understood on both sides and thus
makes it possible to locate and correct a mistake -- if in fact it *is*
a mistake.

---rsk

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails

[Shawn K. Hall]

> You're saying that, simply because a sender or recipient 
> MIGHT be in Germany, that my US-based mail server has to send 
> an NDR? And risk getting added to a "backscatter" RBL?

No, you also have the option of delivering it to the user in a method
that equates to delivery, such as delivering to their spam/junk folder.

-S


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails

[John Levine]

>> At one point, Hotmail tried to turn off the delete action for sufficiently 
>> spammy, and just delivered it
>into Junk; Customers complained. Loudly. 
>
>Is there a public place/forum/whatever where people complained loudly? I
>am just curious to see their arguments about this.

The Hotmail users should definitely demand their money back.

Oh, wait.


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails [slightly OT]

[G. Miliotis]

On 9/6/2016 17:46, Renaud Allard via mailop wrote:

Actually, many small operators also silently discard email. Whether it's
by incompetence, or voluntarily doesn't matter much. It's just less
visible than hotmail.


Undoubtedly, but they can't use the scaling-is-hard argument as a free 
pass. We should all be accountable if we break mail, big or small.


In addition, you can prectically ignore a small mail operator but not 
the big players.


--GM


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails [slightly OT]

[Renaud Allard via mailop]

On 06/09/2016 04:33 PM, G. Miliotis wrote:
> On 9/6/2016 16:13, Michael Wise via mailop wrote:
>> The discussion is on-going.
> 
> This is at least one good thing about this whole deal. I think your
> suggestion about deleted items (marked as such somehow) would be a good
> compromise.
> 

While it's better, the junk folder is still the best solution. Do you
often search in your deleted folder for something you haven't deleted?

> FWIW, personally, I find it all an interesting social mental exercise.
> Apparently it's more important for huge mail operators to continue to
> exist and grow, rather than keep mail working as everyone expects it to.
> I'm seeing big players who have cornered the mail "market" that can't
> operate properly cause of their growth and their inability to solve the
> scaling problems. I don't see why we NEED to compromise the thing we do,
> just cause of the way we currently do it. We, as a society, chose to
> support the centralization of these services directly or indirectly. So,
> now we simply don't have mail anymore. We have "mostly mail".
> 

Actually, many small operators also silently discard email. Whether it's
by incompetence, or voluntarily doesn't matter much. It's just less
visible than hotmail.



smime.p7s
Description: S/MIME Cryptographic Signature
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails

[Renaud Allard via mailop]

On 06/09/2016 03:34 PM, Michael Wise via mailop wrote:
> That's a violation of RFC 821, etc.

It might be, but it's the conservative (less scalable) approach instead
of the aggressive one.

There are RFC5321 violations everywhere like this one ;)

RFC5321
4.5.3.2.  Timeouts
4.5.3.2.7.  Server Timeout: 5 Minutes.
   An SMTP server SHOULD have a timeout of at least 5 minutes while it
   is awaiting the next command from the sender.

$ time telnet mx1.hotmail.com 25
Trying 65.55.33.119...
Connected to mx1.hotmail.com.
Escape character is '^]'.
220 COL004-MC5F4.hotmail.com Sending unsolicited commercial or bulk
e-mail to Microsoft's computer network is prohibited. Other restrictions
are found at http://privacy.microsoft.com/en-us/anti-spam.mspx. Thu, 9
Jun 2016 07:26:53 -0700
Connection closed by foreign host.
1m03.66s real 0m00.00s user 0m00.01s system


> Of course, the expectation that the email won't be discarded inside the
> system is also not countenanced.
> 
> But making a decision on the fate of an email at END OF DATA is not
> something that massive mail systems do. All the decisions on that happen
> after the connection has ended.
> 
> Wish it were otherwise, but when each edge box is expected to handle
> thousands of connections opened per second, it doesn't scale.
> 
> Aloha,
> Michael.
> -- 
> Sent from my Windows Phone
> 
> From: Renaud Allard via mailop <mailto:mailop@mailop.org>
> Sent: ‎6/‎9/‎2016 2:10 AM
> To: mailop@mailop.org <mailto:mailop@mailop.org>
> Subject: Re: [mailop] Microsoft/Hotmail discards mails
> 
> 
> 
> On 06/09/2016 10:25 AM, Paul Smith wrote:
>> The problem is there may be a few other users who get false positives in
>> that type of spam quite frequently, and suddenly they are losing
>> messages with no hope of redemption or even knowledge that it's
>> happening.
> 
> Actually, what I do is that when a mail goes to the junk folder, the
> server gives a 5XX error message to the sender at the end of DATA phase.
> So the sender, if real, knows something happened to his mail and that it
> might not be read.
> 
> 
> 
> 
> 
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
> 



smime.p7s
Description: S/MIME Cryptographic Signature
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails

[Ian McDonald]

Hi Michael,

Can you advise how one would “ramp up” such a new IP? The very nature of such 
transactional traffic is that it’s bursty, and may go for weeks when one may 
send a few dozen mails, then a few thousand on a specific day, then nothing 
again. Wouldn’t your systems detect that as ‘anomalous’ behaviour and do 
something about it?

Thanks

--
ian

From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Michael Wise via 
mailop
Sent: 09 June 2016 14:27
To: Duncan Brannen <d...@st-andrews.ac.uk>; mailop@mailop.org
Subject: Re: [mailop] Microsoft/Hotmail discards mails


Separate IPs absolutely help, at least they do now. At some point, separate 
domains will be where it's at. "Canned Responses" are mandated by the Lawyers, 
who have had to deal with ... "Issues".

I have been told that Return Path Sender Score is certainly a factor, and that 
they also have some extra services available, but exactly how they get this 
data I do not know, and can't comment on. I don't know.

The largest factor that drives good reputation is having the Recipients 
safelist the sender. Another huge factor is engaging the recipient in a 
conversation of some sort. Further down the list is making sure that your 
traffic looks as little like spam as possible. If you use tricks that spammers 
do, for instance any kind of hashbuster text, etc... The system *WILL* notice.

Past that, we're not allowed to provide information on why a particular email 
or campaign was sent to junk or silently dropped, and honestly, I have never 
been motivated to figure out the mechanics. Remember that, "Each Sender is 
Unique!", and there's millions of them, and Billions of emails an hour, let 
alone a day.

Aloha,
Michael.
--
Sent from my Windows Phone

From: Duncan Brannen<mailto:d...@st-andrews.ac.uk>
Sent: ‎6/‎9/‎2016 1:16 AM
To: mailop@mailop.org<mailto:mailop@mailop.org>
Subject: Re: [mailop] Microsoft/Hotmail discards mails

Hi,
Just to throw our tuppence worth in.  We have the same problem.  It seems 
to be noticed when we send out offers of a place of study, a noticeable 
percentage of the emails
are never received despite being accepted by Hotmail / outlook / live.com for 
delivery.  We’re signed up for JMRP / SNDS, have opened tickets but can’t get 
anything
back other than a canned response.  (unusual activity or eligible/not eligible 
for partial mitigation)

Is there a method for feeding back suggestions about this, eg a notification 
along the lines of the Junk report mechanism?  By the sounds of it, there 
really isn’t any way to find out
why emails are silently junked and asking applicants to whitelist the 
University would seem to be the only way to mitigate? Does Returnpath / Sender 
score help in any way here?

One thought is to move all of our ‘business’ (ie official comms to applicants 
and enquirers) to one IP and keep staff/student / bulk email to eg alumni to a 
different IP but if anyone
has any suggestions I’m open to them.

Cheers,
Duncan


On 09/06/2016, 03:08, "mailop on behalf of Michael Wise via mailop" 
<mailop-boun...@mailop.org on behalf of 
mailop@mailop.org<mailto:mailop-boun...@mailop.org%20on%20behalf%20of%20mai...@mailop.org>>
 wrote:


At the request of the customer-base, traffic that is classified as sufficiently 
spammy (by various "Black Box" algorithms that I have no knowledge of the inner 
workings...) is deleted even after a successful delivery.

At one point, Hotmail tried to turn off the delete action for sufficiently 
spammy, and just delivered it into Junk; Customers complained. Loudly. So 
whether the system is correctly classifying your traffic or not, I cannot say. 
But the behavior is not unexpected in certain scenarios. Which one of them 
applies to you, I cannot say. Even if I wanted to! But I really have no idea, 
and no way to find out.

This "Delete" action is a well-known mitigation that is not unique to Hotmail.

About the only way around it would be to login to your test account, and safe 
sender the sending email address.
Among other things, that will force the system to reconsider the verdict that 
it has assigned to the IP and the traffic coming from it.

It's possible that the IPs have a left-over bad reputation from a previous 
sender, but that's difficult to tell.

Good luck.

Aloha,
Michael.
--
Michael J Wise | Microsoft | Spam Analysis | "Your Spam Specimen Has Been 
Processed." | Got the Junk Mail Reporting Tool ?

-Original Message-
From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Andreas Ziegler
Sent: Wednesday, June 8, 2016 6:50 PM
To: mailop@mailop.org<mailto:mailop@mailop.org>
Subject: [mailop] Microsoft/Hotmail discards mails

Hi,

a user of my server complained, that some of his mails don't reach mail 
accounts from hotmail/live/outlook etc. that complaint is nothing new, the 
problem ex

Re: [mailop] Microsoft/Hotmail discards mails

[Dominique Rousseau]

Le Thu, Jun 09, 2016 at 02:09:31PM +, Michael Wise via mailop 
[mailop@mailop.org] a écrit:
> Unsure what you're saying. If it's the .DE extension, then by that
> logic, we, "explicitly target" a lot of users. Pretty much the whole
> world, actually.

That was the point :)

Eric (in my understanding) was implying that being a US-based company
doesn't imply having to consider foreign (in this case german) laws.
For internet services, almost anybody is able to access you service.
But registering a domaine in CC TLDs and having it configured such a way
that you get access to the service looks like an explicit move towards
wanting this country's users to use your service.
And as such, you should abide by their laws.
(and I believe MS has some offices in Germany, too)

(as a not so good example, Google had to use the "googlemail" name for
their Gmail service, for german users, due to some trademark dispute)


-- 
Dominique Rousseau 
Neuronnexion, Prestataire Internet & Intranet
21 rue Frédéric Petit - 8 Amiens
tel: 03 22 71 61 90 - fax: 03 22 71 61 99 - http://www.neuronnexion.coop

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails

[Alarig Le Lay]

On Thu Jun  9 15:59:33 2016, Dominique Rousseau wrote:
> Le Thu, Jun 09, 2016 at 01:49:26PM +, Eric Henson [ehen...@pfsweb.com] a 
> écrit:
> > You're saying that, simply because a sender or recipient MIGHT be in
> > Germany, that my US-based mail server has to send an NDR? 
> 
> I do believe that Microsoft is explicitely targetting german users :
> 
> # dig +short www.hotmail.de
> mail.live.com.
> dispatch.kahuna.glbdns2.microsoft.com.
> 157.56.122.211
> 157.56.122.210

It looks similar for the french domain, and we do not have this law:

alarig@pikachu ~ % dig www.hotmail.fr
;; ANSWER SECTION:
www.hotmail.fr. 3600IN  CNAME   mail.live.com.
mail.live.com.  3587IN  CNAME   
dispatch.kahuna.glbdns2.microsoft.com.
dispatch.kahuna.glbdns2.microsoft.com. 287 IN A 157.55.230.156
dispatch.kahuna.glbdns2.microsoft.com. 287 IN A 157.56.198.220

Plus, the MX are the same:
alarig@pikachu ~ % dig MX hotmail.de 
;; ANSWER SECTION:
hotmail.de. 86400   IN  MX  5 mx3.hotmail.com.
hotmail.de. 86400   IN  MX  5 mx1.hotmail.com.
hotmail.de. 86400   IN  MX  5 mx4.hotmail.com.
hotmail.de. 86400   IN  MX  5 mx2.hotmail.com.

alarig@pikachu ~ % dig MX hotmail.fr 
;; ANSWER SECTION:
hotmail.fr. 3600IN  MX  5 mx1.hotmail.com.
hotmail.fr. 3600IN  MX  5 mx4.hotmail.com.
hotmail.fr. 3600IN  MX  5 mx2.hotmail.com.
hotmail.fr. 3600IN  MX  5 mx3.hotmail.com.

-- 
alarig


signature.asc
Description: Digital signature
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails

[Michael Wise via mailop]

Unsure what you're saying. If it's the .DE extension, then by that logic, we, 
"explicitly target" a lot of users. Pretty much the whole world, actually.

Or perhaps your point is lost on me. :)

Aloha,
Michael.
--
Sent from my Windows Phone

From: Dominique Rousseau<mailto:d.rouss...@nnx.com>
Sent: ‎6/‎9/‎2016 7:04 AM
To: mailop@mailop.org<mailto:mailop@mailop.org>
Subject: Re: [mailop] Microsoft/Hotmail discards mails

Le Thu, Jun 09, 2016 at 01:49:26PM +, Eric Henson [ehen...@pfsweb.com] a 
écrit:
> You're saying that, simply because a sender or recipient MIGHT be in
> Germany, that my US-based mail server has to send an NDR?

I do believe that Microsoft is explicitely targetting german users :

# dig +short 
https://na01.safelinks.protection.outlook.com/?url=www.hotmail.de=01%7c01%7cmichael.wise%40microsoft.com%7c2f4b3f5e86474db078cc08d3906f05ae%7c72f988bf86f141af91ab2d7cd011db47%7c1=l%2b1yi9pPwqN%2fU23bTejFSOV9XTpa9vGaffhio7lo%2brk%3d
mail.live.com.
dispatch.kahuna.glbdns2.microsoft.com.
157.56.122.211
157.56.122.210


--
Dominique Rousseau
Neuronnexion, Prestataire Internet & Intranet
21 rue Frédéric Petit - 8 Amiens
tel: 03 22 71 61 90 - fax: 03 22 71 61 99 - 
https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fwww.neuronnexion.coop=01%7c01%7cmichael.wise%40microsoft.com%7c2f4b3f5e86474db078cc08d3906f05ae%7c72f988bf86f141af91ab2d7cd011db47%7c1=BeqN17SWqYmLznWiHpUmpxztkqM0Do6l8zNC3VhkZeU%3d

___
mailop mailing list
mailop@mailop.org
https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fchilli.nosignal.org%2fcgi-bin%2fmailman%2flistinfo%2fmailop=01%7c01%7cmichael.wise%40microsoft.com%7c2f4b3f5e86474db078cc08d3906f05ae%7c72f988bf86f141af91ab2d7cd011db47%7c1=POPVfuBLMpkkPdpWRqn7ZQXxUG3E6ZNgf%2fH62BrfAbM%3d
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails

[Dominique Rousseau]

Le Thu, Jun 09, 2016 at 01:49:26PM +, Eric Henson [ehen...@pfsweb.com] a 
écrit:
> You're saying that, simply because a sender or recipient MIGHT be in
> Germany, that my US-based mail server has to send an NDR? 

I do believe that Microsoft is explicitely targetting german users :

# dig +short www.hotmail.de
mail.live.com.
dispatch.kahuna.glbdns2.microsoft.com.
157.56.122.211
157.56.122.210


-- 
Dominique Rousseau 
Neuronnexion, Prestataire Internet & Intranet
21 rue Frédéric Petit - 8 Amiens
tel: 03 22 71 61 90 - fax: 03 22 71 61 99 - http://www.neuronnexion.coop

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails

[Michael Wise via mailop]

And they WILL notice.

Aloha,
Michael.
--
Sent from my Windows Phone

From: Eric Henson<mailto:ehen...@pfsweb.com>
Sent: ‎6/‎9/‎2016 3:46 AM
To: Renaud Allard<mailto:ren...@allard.it>
Cc: mailop@mailop.org<mailto:mailop@mailop.org>
Subject: Re: [mailop] Microsoft/Hotmail discards mails

You're giving spammers very valuable information on which of their emails are 
classified as spam and which aren't.


-Original Message-
From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Renaud Allard via 
mailop
Sent: Thursday, June 9, 2016 4:05 AM
To: mailop@mailop.org
Subject: Re: [mailop] Microsoft/Hotmail discards mails



On 06/09/2016 10:25 AM, Paul Smith wrote:
> The problem is there may be a few other users who get false positives
> in that type of spam quite frequently, and suddenly they are losing
> messages with no hope of redemption or even knowledge that it's
> happening.

Actually, what I do is that when a mail goes to the junk folder, the server 
gives a 5XX error message to the sender at the end of DATA phase.
So the sender, if real, knows something happened to his mail and that it might 
not be read.



___
mailop mailing list
mailop@mailop.org
https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fchilli.nosignal.org%2fcgi-bin%2fmailman%2flistinfo%2fmailop=01%7c01%7cmichael.wise%40microsoft.com%7c4584e9d4f7f64c27bb8c08d390535750%7c72f988bf86f141af91ab2d7cd011db47%7c1=yTGLpsFMPfp%2fCuyuUOi%2fl%2fVARP2eD9f3eoWhgdHMY50%3d
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails

[Michael Wise via mailop]

The point is lost on you.
So here it is, spelled out:

There's a huge difference to most, "Senders" between a 250 and any kind of 4xx 
or 5xx refusal. Some top tier ESPs even have real-time graphs!

Aloha,
Michael.
--
Sent from my Windows Phone

From: Renaud Allard via mailop<mailto:mailop@mailop.org>
Sent: ‎6/‎9/‎2016 4:16 AM
To: Eric Henson<mailto:ehen...@pfsweb.com>
Cc: mailop@mailop.org<mailto:mailop@mailop.org>
Subject: Re: [mailop] Microsoft/Hotmail discards mails



On 06/09/2016 12:39 PM, Eric Henson wrote:
> You're giving spammers very valuable information on which of their emails are 
> classified as spam and which aren't.

How so? There is no difference in rejecting a spam with 5xx and
rejecting it with 5xx but still delivering it into junk folder. The only
way to not give info to spammers (if they even look at it) is to accept
and drop the mail, which is the probably worst thing you can do.

I am not sure spammers are reading the reasons for a reject, but real
people (at least mail admins) need to know why a legitimate mail has
been rejected.

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails

[Duncan Brannen]

Thanks Michael,
That’s helpful and at least something I can 
give to our admissions people.

Cheers,
Duncan


From: Michael Wise <michael.w...@microsoft.com>
Date: Thursday, 9 June 2016 at 14:26
To: Duncan Brannen <d...@st-andrews.ac.uk>, "mailop@mailop.org" 
<mailop@mailop.org>
Subject: RE: [mailop] Microsoft/Hotmail discards mails


Separate IPs absolutely help, at least they do now. At some point, separate 
domains will be where it's at. "Canned Responses" are mandated by the Lawyers, 
who have had to deal with ... "Issues".

I have been told that Return Path Sender Score is certainly a factor, and that 
they also have some extra services available, but exactly how they get this 
data I do not know, and can't comment on. I don't know.

The largest factor that drives good reputation is having the Recipients 
safelist the sender. Another huge factor is engaging the recipient in a 
conversation of some sort. Further down the list is making sure that your 
traffic looks as little like spam as possible. If you use tricks that spammers 
do, for instance any kind of hashbuster text, etc... The system *WILL* notice.

Past that, we're not allowed to provide information on why a particular email 
or campaign was sent to junk or silently dropped, and honestly, I have never 
been motivated to figure out the mechanics. Remember that, "Each Sender is 
Unique!", and there's millions of them, and Billions of emails an hour, let 
alone a day.

Aloha,
Michael.
--
Sent from my Windows Phone

From: Duncan Brannen<mailto:d...@st-andrews.ac.uk>
Sent: ‎6/‎9/‎2016 1:16 AM
To: mailop@mailop.org<mailto:mailop@mailop.org>
Subject: Re: [mailop] Microsoft/Hotmail discards mails

Hi,
Just to throw our tuppence worth in.  We have the same problem.  It seems 
to be noticed when we send out offers of a place of study, a noticeable 
percentage of the emails
are never received despite being accepted by Hotmail / outlook / live.com for 
delivery.  We’re signed up for JMRP / SNDS, have opened tickets but can’t get 
anything
back other than a canned response.  (unusual activity or eligible/not eligible 
for partial mitigation)

Is there a method for feeding back suggestions about this, eg a notification 
along the lines of the Junk report mechanism?  By the sounds of it, there 
really isn’t any way to find out
why emails are silently junked and asking applicants to whitelist the 
University would seem to be the only way to mitigate? Does Returnpath / Sender 
score help in any way here?

One thought is to move all of our ‘business’ (ie official comms to applicants 
and enquirers) to one IP and keep staff/student / bulk email to eg alumni to a 
different IP but if anyone
has any suggestions I’m open to them.

Cheers,
Duncan


On 09/06/2016, 03:08, "mailop on behalf of Michael Wise via mailop" 
<mailop-boun...@mailop.org on behalf of mailop@mailop.org> wrote:


At the request of the customer-base, traffic that is classified as sufficiently 
spammy (by various "Black Box" algorithms that I have no knowledge of the inner 
workings...) is deleted even after a successful delivery.

At one point, Hotmail tried to turn off the delete action for sufficiently 
spammy, and just delivered it into Junk; Customers complained. Loudly. So 
whether the system is correctly classifying your traffic or not, I cannot say. 
But the behavior is not unexpected in certain scenarios. Which one of them 
applies to you, I cannot say. Even if I wanted to! But I really have no idea, 
and no way to find out.

This "Delete" action is a well-known mitigation that is not unique to Hotmail.

About the only way around it would be to login to your test account, and safe 
sender the sending email address.
Among other things, that will force the system to reconsider the verdict that 
it has assigned to the IP and the traffic coming from it.

It's possible that the IPs have a left-over bad reputation from a previous 
sender, but that's difficult to tell.

Good luck.

Aloha,
Michael.
--
Michael J Wise | Microsoft | Spam Analysis | "Your Spam Specimen Has Been 
Processed." | Got the Junk Mail Reporting Tool ?

-Original Message-
From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Andreas Ziegler
Sent: Wednesday, June 8, 2016 6:50 PM
To: mailop@mailop.org
Subject: [mailop] Microsoft/Hotmail discards mails

Hi,

a user of my server complained, that some of his mails don't reach mail 
accounts from hotmail/live/outlook etc. that complaint is nothing new, the 
problem exists for months now.

the users mails are dkim signed, the domain has DKIM and SPF TXT DNS records, 
since yesterday there is also a DMARC record.

i investigated further, set up test accounts on both ends and indeed, they are 
accepting the mail with 250 but it doesn't appear in the inbox or even 

Re: [mailop] Microsoft/Hotmail discards mails

[Michael Wise via mailop]

"Well Known" to people who send high volumes of mail.

HotMail has hundreds of millions of users.

Things that work when you have a thousand users are under strain when you have 
ten thousand, and fail long before a hundred thousand.

Things that work well for a hundred thousand can barely handle a million, and 
have no hope of reaching ten million.

And things that worked at ten million require significant retooling and rework 
and huge investments and ... It's enormous to get past one hundred million. And 
to push it further is huge.

There are enormous issues, especially at the edge, that require methodologies 
at scale that people who are used to running a mail server with a few thousand 
users can't even dream about, especially when the system comes under attack, or 
some sender tries to game it, which they do ... All the freaking time.

I wasn't the one who had to handle the blow-back for delivering all the traffic 
that the system considered spammiest into Junk, but I trust the people who 
turned on the feature and then turned it off. I have suggested that instead it 
be delivered into Deleted Items, from which it could still be rescued. The 
discussion is on-going.

But the bottom line is, the whole system is a huge, Machine Learning engine 
driven almost exclusively by end user feedback; a message is selected at random 
that had been sent to the user, and they are asked to classify it, Spam or Not? 
And if too many users click, "Spam" ... Fairly quickly both that traffic, and 
traffic, "Similar" (proprietary, so don't bother asking; even I don't know...) 
to it will wind up in the Junk folder, and then get silently dropped, and at 
long last, the sending IP(s) will be blocked.

If you've read this far, and don't know about SNDS and JMRP, or don't  know how 
to open a ticket with HotMail sender support, well ... I'll post more later 
today.

Aloha,
Michael.
--
Sent from my Windows Phone

From: Mark Foster<mailto:blak...@blakjak.net>
Sent: ‎6/‎8/‎2016 9:28 PM
To: mailop@mailop.org<mailto:mailop@mailop.org>
Subject: Re: [mailop] Microsoft/Hotmail discards mails

As a long time hotmail.com account holder, I can tell you that I would
never request a silent-discard option.

If you are able to determine via black-box algorithms that a message is
sufficiently spammy, why not refuse after post-dot?

I'm sure Hotmail deals with spam volumes that are orders of magnitude
bigger than any other system i've ever touched or dealt with, but even
so, whether bounded by law or not, this seems to be amongst the worst
actions a mail platform administrator could take where the end users
probably have not assented to the practice (I sincerely doubt Hotmail
has communicated this approach to its _entire_ customer base).

Mark.


On 9/06/2016 2:08 p.m., Michael Wise via mailop wrote:
> At the request of the customer-base, traffic that is classified as 
> sufficiently spammy (by various "Black Box" algorithms that I have no 
> knowledge of the inner workings...) is deleted even after a successful 
> delivery.
>
> At one point, Hotmail tried to turn off the delete action for sufficiently 
> spammy, and just delivered it into Junk; Customers complained. Loudly. So 
> whether the system is correctly classifying your traffic or not, I cannot 
> say. But the behavior is not unexpected in certain scenarios. Which one of 
> them applies to you, I cannot say. Even if I wanted to! But I really have no 
> idea, and no way to find out.
>
> This "Delete" action is a well-known mitigation that is not unique to Hotmail.
>
> About the only way around it would be to login to your test account, and safe 
> sender the sending email address.
> Among other things, that will force the system to reconsider the verdict that 
> it has assigned to the IP and the traffic coming from it.
>
> It's possible that the IPs have a left-over bad reputation from a previous 
> sender, but that's difficult to tell.
>
> Good luck.
>
> Aloha,
> Michael.


___
mailop mailing list
mailop@mailop.org
https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fchilli.nosignal.org%2fcgi-bin%2fmailman%2flistinfo%2fmailop=01%7c01%7cmichael.wise%40microsoft.com%7c5e7317a2e86d48a2505908d3901e8eb1%7c72f988bf86f141af91ab2d7cd011db47%7c1=H0Rjn3ESEERa9liKuABBXs0LSufni2I0yUzzxqF59bs%3d
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails

[G. Miliotis]

On 9/6/2016 05:08, Michael Wise via mailop wrote:

At one point, Hotmail tried to turn off the delete action for sufficiently 
spammy, and just delivered it into Junk; Customers complained. Loudly. So 
whether the system is correctly classifying your traffic or not, I cannot say. 
But the behavior is not unexpected in certain scenarios. Which one of them 
applies to you, I cannot say. Even if I wanted to! But I really have no idea, 
and no way to find out.

This "Delete" action is a well-known mitigation that is not unique to Hotmail.


I directly dispute the "well-known" part.

I am curious to know whether this policy, justified or not, is clearly 
explained to users who sign up to the services that implement them 
during the sign-up process. Cause when I tell my customers,friends and 
strangers about this "well-known" "mitigation" strategy, they look at me 
like I just landed in a huge, music-playing flying saucer, without 
exception.


Somehow I think that if users were told clearly "we'll flood you with 
ads and  log/process/sell your data, cause this is our business model. 
We will also silently drop some of your mail, btw" use of these services 
would decrease. Most definitely businesses at the very least would not 
be using them.


Maybe we should push back against idiots instead of accommodating them. 
I really would like to see the complaints of the users who want their 
mail to be "mitigated" by deletion... It must make a fun evening reading 
them.


--GM

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails

[Eric Henson]

You're giving spammers very valuable information on which of their emails are 
classified as spam and which aren't.


-Original Message-
From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Renaud Allard via 
mailop
Sent: Thursday, June 9, 2016 4:05 AM
To: mailop@mailop.org
Subject: Re: [mailop] Microsoft/Hotmail discards mails



On 06/09/2016 10:25 AM, Paul Smith wrote:
> The problem is there may be a few other users who get false positives 
> in that type of spam quite frequently, and suddenly they are losing 
> messages with no hope of redemption or even knowledge that it's 
> happening.

Actually, what I do is that when a mail goes to the junk folder, the server 
gives a 5XX error message to the sender at the end of DATA phase.
So the sender, if real, knows something happened to his mail and that it might 
not be read.



___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails

[Renaud Allard via mailop]

On 06/09/2016 10:25 AM, Paul Smith wrote:
> The problem is there may be a few other users who get false positives in
> that type of spam quite frequently, and suddenly they are losing
> messages with no hope of redemption or even knowledge that it's
> happening.

Actually, what I do is that when a mail goes to the junk folder, the
server gives a 5XX error message to the sender at the end of DATA phase.
So the sender, if real, knows something happened to his mail and that it
might not be read.





smime.p7s
Description: S/MIME Cryptographic Signature
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails

[Paul Smith]

On 09/06/2016 08:42, David Hofstee wrote:

I'm dazzled by users here... Isn't the junk-box supposed to hold junk? Wow.

Maybe there should be more junk-boxes for the various shades of grey :-).
I'd have thought that even if you do decide to just throw "extreme" junk 
away (which I think is a very bad idea, BTW), then you should tell the 
user that you've done so - either in a daily/weekly summary email or an 
online list or something. That seems to be the bare minimum for an MSP 
to do in such a case.


I actually understand users' preferences in this, because false 
positives get fewer the more 'spammy' a spam filter thinks a messages 
is, so when a user has seen zero false positives in 'extreme spam' for a 
few months they expect that will always be the case so don't want to see 
those messages at all.


The problem is there may be a few other users who get false positives in 
that type of spam quite frequently, and suddenly they are losing 
messages with no hope of redemption or even knowledge that it's 
happening. From the MSP's point of view, surely they should take the 
view that one lost 'good' message is far more important than someone 
having to spend a minute to look through a few more spam messages (as a 
variant of Blackstone's formulation ;-) )



___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails

[David Hofstee]

I'm dazzled by users here... Isn't the junk-box supposed to hold junk? Wow. 

Maybe there should be more junk-boxes for the various shades of grey :-). 

Met vriendelijke groet,


David Hofstee

Deliverability Management
MailPlus B.V. Netherlands (ESP)

- Oorspronkelijk bericht -
Van: "Renaud Allard via mailop" <mailop@mailop.org>
Aan: mailop@mailop.org
Verzonden: Donderdag 9 juni 2016 09:14:35
Onderwerp: Re: [mailop] Microsoft/Hotmail discards mails

Hi,

On 06/09/2016 04:08 AM, Michael Wise via mailop wrote:
> 
> At one point, Hotmail tried to turn off the delete action for sufficiently 
> spammy, and just delivered it into Junk; Customers complained. Loudly. 

Is there a public place/forum/whatever where people complained loudly? I
am just curious to see their arguments about this.

Best Regards


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails

[Renaud Allard via mailop]

Hi,

On 06/09/2016 04:08 AM, Michael Wise via mailop wrote:
> 
> At one point, Hotmail tried to turn off the delete action for sufficiently 
> spammy, and just delivered it into Junk; Customers complained. Loudly. 

Is there a public place/forum/whatever where people complained loudly? I
am just curious to see their arguments about this.

Best Regards



smime.p7s
Description: S/MIME Cryptographic Signature
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails

[Mark Foster]

As a long time hotmail.com account holder, I can tell you that I would 
never request a silent-discard option.


If you are able to determine via black-box algorithms that a message is 
sufficiently spammy, why not refuse after post-dot?


I'm sure Hotmail deals with spam volumes that are orders of magnitude 
bigger than any other system i've ever touched or dealt with, but even 
so, whether bounded by law or not, this seems to be amongst the worst 
actions a mail platform administrator could take where the end users 
probably have not assented to the practice (I sincerely doubt Hotmail 
has communicated this approach to its _entire_ customer base).


Mark.


On 9/06/2016 2:08 p.m., Michael Wise via mailop wrote:

At the request of the customer-base, traffic that is classified as sufficiently spammy 
(by various "Black Box" algorithms that I have no knowledge of the inner 
workings...) is deleted even after a successful delivery.

At one point, Hotmail tried to turn off the delete action for sufficiently 
spammy, and just delivered it into Junk; Customers complained. Loudly. So 
whether the system is correctly classifying your traffic or not, I cannot say. 
But the behavior is not unexpected in certain scenarios. Which one of them 
applies to you, I cannot say. Even if I wanted to! But I really have no idea, 
and no way to find out.

This "Delete" action is a well-known mitigation that is not unique to Hotmail.

About the only way around it would be to login to your test account, and safe 
sender the sending email address.
Among other things, that will force the system to reconsider the verdict that 
it has assigned to the IP and the traffic coming from it.

It's possible that the IPs have a left-over bad reputation from a previous 
sender, but that's difficult to tell.

Good luck.

Aloha,
Michael.



___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails

[Andreas Ziegler]

Hi,

thanks for your fast and detailed reply!

i will follow your suggestion regarding tackling the system by marking a
sender as safe, so it might reconsider its decisions.

as a side note: at least here in germany, discarding mail without any
notification of the sender or recipient is called supression and is
illegal (§206 StGB).

Best Regards

Andreas


 Original-Nachricht 
Betreff: Re: [mailop] Microsoft/Hotmail discards mails
Von: Michael Wise <michael.w...@microsoft.com>
An: Andreas Ziegler <m...@andreas-ziegler.de>, mailop@mailop.org
<mailop@mailop.org>
Datum: 9.6.2016, 04:08:39

> 
> At the request of the customer-base, traffic that is classified as 
> sufficiently spammy (by various "Black Box" algorithms that I have no 
> knowledge of the inner workings...) is deleted even after a successful 
> delivery.
> 
> At one point, Hotmail tried to turn off the delete action for sufficiently 
> spammy, and just delivered it into Junk; Customers complained. Loudly. So 
> whether the system is correctly classifying your traffic or not, I cannot 
> say. But the behavior is not unexpected in certain scenarios. Which one of 
> them applies to you, I cannot say. Even if I wanted to! But I really have no 
> idea, and no way to find out.
> 
> This "Delete" action is a well-known mitigation that is not unique to Hotmail.
> 
> About the only way around it would be to login to your test account, and safe 
> sender the sending email address.
> Among other things, that will force the system to reconsider the verdict that 
> it has assigned to the IP and the traffic coming from it.
> 
> It's possible that the IPs have a left-over bad reputation from a previous 
> sender, but that's difficult to tell.
> 
> Good luck.
> 
> Aloha,
> Michael.
> 

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Microsoft/Hotmail discards mails

[Michael Wise via mailop]

At the request of the customer-base, traffic that is classified as sufficiently 
spammy (by various "Black Box" algorithms that I have no knowledge of the inner 
workings...) is deleted even after a successful delivery.

At one point, Hotmail tried to turn off the delete action for sufficiently 
spammy, and just delivered it into Junk; Customers complained. Loudly. So 
whether the system is correctly classifying your traffic or not, I cannot say. 
But the behavior is not unexpected in certain scenarios. Which one of them 
applies to you, I cannot say. Even if I wanted to! But I really have no idea, 
and no way to find out.

This "Delete" action is a well-known mitigation that is not unique to Hotmail.

About the only way around it would be to login to your test account, and safe 
sender the sending email address.
Among other things, that will force the system to reconsider the verdict that 
it has assigned to the IP and the traffic coming from it.

It's possible that the IPs have a left-over bad reputation from a previous 
sender, but that's difficult to tell.

Good luck.

Aloha,
Michael.
-- 
Michael J Wise | Microsoft | Spam Analysis | "Your Spam Specimen Has Been 
Processed." | Got the Junk Mail Reporting Tool ?

-Original Message-
From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Andreas Ziegler
Sent: Wednesday, June 8, 2016 6:50 PM
To: mailop@mailop.org
Subject: [mailop] Microsoft/Hotmail discards mails

Hi,

a user of my server complained, that some of his mails don't reach mail 
accounts from hotmail/live/outlook etc. that complaint is nothing new, the 
problem exists for months now.

the users mails are dkim signed, the domain has DKIM and SPF TXT DNS records, 
since yesterday there is also a DMARC record.

i investigated further, set up test accounts on both ends and indeed, they are 
accepting the mail with 250 but it doesn't appear in the inbox or even junk 
folder.

According to SNDS, the IP has "normal status" and no events are logged.
i reached out to them through their form two times and got the same answer 
twice, that the IP doesn't qualify for mitigation.

the thing is, i can't figure out
a) why they discard the mails
b) why they don't reject them, that would be much better

we're a low volume sender, so i investigated the logs manually and can't find 
any outgoing spam.

all of the users recipients do really want to get these mails and are very 
upset that they don't receive them.
and even if they didn't want to, they could tell via mail or even in person, as 
all of them are at the same university (and are friends).

perhaps someone has an additional idea, another form or contact address or what 
can i try to solve this?

ticket numbers: SRX1342522740ID / SRX1342663522ID.

Regards

Andreas

___
mailop mailing list
mailop@mailop.org
https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fchilli.nosignal.org%2fcgi-bin%2fmailman%2flistinfo%2fmailop=01%7c01%7cmichael.wise%40microsoft.com%7cb2c91735275742b7b2e408d390093f5c%7c72f988bf86f141af91ab2d7cd011db47%7c1=ccB7YaSdDu3ZN4SrE8MCC6JwpavpsqE9aJz6InPWXPM%3d
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop