Re: [mailop] Massive Spam Incident @ Outlook.com?

2022-10-16 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Wed, 2022-10-12 at 13:01 +, Slavko via mailop wrote: > I did some experiments with that (not mail related) in past and most > often > user's response was something as -- "They are big, they are doing > things > right!" The most of us known,

Re: [mailop] SMTP noise from *.bouncer.cloud

2022-09-04 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Sun, 2022-09-04 at 19:49 +, Radek Kaczynski via mailop wrote: > Regarding the list of IPs - I'd prefer to send it to the interested > people directly. > I'd like to have a track of record to whom I have exposed it and You realize of course

Re: [mailop] SMTP noise from *.bouncer.cloud

2022-09-03 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Sun, 2022-09-04 at 00:43 +0200, Radek Kaczynski via mailop wrote: > If any of you would like to get a full list of our IP addresses and > domains so that you can block Bouncer's requests - please feel free to > email me at ra...@usebouncer.com.

Re: [mailop] smtp dane/tlsa

2022-09-03 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Sat, 2022-09-03 at 17:41 +, ml+mailop--- via mailop wrote: > How did you notice that "something is now broken"? A former client was trying to setup Fedora 36 sendmail with dane validation. F36 comes with sendmail 8.17.1 which is supposed to

Re: [mailop] smtp dane/tlsa

2022-09-02 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Fri, 2022-09-02 at 18:42 +, ml+mailop--- via mailop wrote: > Are you sure you want 3 0 1 and not 3 1 1? Yes. We are publishing the hash of the full certificate. Note there are two tlsa records, one corresponding to the previous LE

[mailop] smtp dane/tlsa

2022-09-02 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Years ago I setup automation for tlsa records to support smtp dane here. However, something is now broken, and I am not sure what is wrong. _25._tcp.mail3.five-ten-sg.com. IN TLSA 3 0 1 (

Re: [mailop] So, Sendgrid / Zoom, planning on actually doing anything about webinar spams?

2022-07-22 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Wed, 2022-07-20 at 12:41 -0600, Brie via mailop wrote: > It's still going on even though it was 'being looked into'. Fixed here by blacklisting the DKIM signature from zoom.us -BEGIN PGP SIGNATURE-

Re: [mailop] Google's Request to the FEC about Allowing Political Email to Bypass Spam Filtering

2022-07-09 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Sat, 2022-07-09 at 17:22 -0600, Anne Mitchell via mailop wrote: > "It shall be unlawful for an operator of an email service to use a > filtering algorithm to apply a label to an email sent to an email > account from a political campaign unless

Re: [mailop] AT blocking IP addresses

2022-03-30 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Wed, 2022-03-30 at 10:55 -0700, Michael Peddemors via mailop wrote: > Imagine the day where you can't use email unless you use Gmail or > o356. If that happens, there will be two mail systems (gmail/o365) and (everyone else). If the (gmail/o365)

Re: [mailop] Can someone from google/gmail contact me offlist?

2022-03-30 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Wed, 2022-03-30 at 09:56 -0500, Al Iverson via mailop wrote: > Since this specifically refers to domain reputation I'd make sure all > mail is properly signing with DKIM. Domain rep can also fall back to > the return-path domain, so if that's

Re: [mailop] So uh... Zoom/Sendgrid... How's that webinar spam investigation coming?

2021-08-04 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Wed, 2021-08-04 at 16:40 -0700, Luke via mailop wrote: > Bounces and spam report percentages dropped. I am probably not the only one that has SA blocking all mail from some of those senders. header SENDGRID4 X-Entity-ID =~

Re: [mailop] Contact for Zoom webinar spam sent via Sendgrid (ugh)

2021-07-11 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Thu, 2021-07-08 at 09:14 -0700, Luke via mailop wrote: > Both of the accounts reported by Michael have been suspended. DATE: 07/11/21 07:00:22 PDT IP: o5.sg.zoom.us :::149.72.199.144 env_From: bounces+21079884-d4de-.. X-Entity-ID:

Re: [mailop] Contact for Zoom webinar spam sent via Sendgrid (ugh)

2021-07-08 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Thu, 2021-07-08 at 09:31 +0300, Atro Tossavainen via mailop wrote: > That one is Zoom.us itself. > Received: from o5.sg.zoom.us (o5.sg.zoom.us [149.72.199.144]) > Received: from o12.ptr3622.sg.zoom.us (o12.ptr3622.sg.zoom.us > [167.89.93.232])

Re: [mailop] Contact for Zoom webinar spam sent via Sendgrid (ugh)

2021-07-07 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Tue, 2021-07-06 at 23:59 +0300, Atro Tossavainen via mailop wrote: > X-Entity-ID: 7mxhBNMkQ9yfwz0A5+NG7Q== > Return-Path: https://list.mailop.org/listinfo/mailop

Re: [mailop] protection.outlook.com refusing to accept mail with misleading temp error message

2021-06-02 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Tue, 2021-06-01 at 21:46 -0400, yuv via mailop wrote: > but I do like the fact that if someone puts > a letter with my address in a post office box anywhere in the world, > it > makes its way to my snail box within a reliable service standard.

Re: [mailop] Microsoft antispam

2021-02-07 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Fri, 2021-02-05 at 10:04 -0600, Lyle Giese via mailop wrote: > I just looked at the dns entries for foddi.net. The A and > records for mx1.mail.foddi.net has a TTL of 120 seconds. For many mail > providers that indicates a dynamic IP

Re: [mailop] cloudapp.azure.com?

2020-12-17 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Thu, 2020-12-17 at 07:28 -0800, Michael Peddemors via mailop wrote: > But yeah, it's ugly on Azure right now.. 41.201.224.52.list.dnswl.org. 10800 IN TXT "cloudapp.azure.com https://dnswl.org/s/?s=53622; 41.201.224.52.list.dnswl.org. 10800 IN

Re: [mailop] Just how does SendGrid fail this badly?

2020-08-18 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Tue, 2020-08-18 at 12:03 +, Andy Smith via mailop wrote: > From: "chiark.greenend.org.uk" So sendgrid account 15204622 was sending mail as: Received: from dhl.com (unknown) by ismtpd0005p1lon1.sendgrid.net (SG) with ESMTP

Re: [mailop] Just how does SendGrid fail this badly?

2020-08-18 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Tue, 2020-08-18 at 15:23 +0300, Atro Tossavainen via mailop wrote: > The SendGrid account sending these yesterday is 13999362. Where do you find that account number in the headers? I see some from today with "Upgrade (FINAL WARNING)" in the

Re: [mailop] Google and Spam detection

2020-07-24 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Fri, 2020-07-24 at 22:08 -0400, John Levine via mailop wrote: > Depends whether you consider Comcast to be big. They sure have a lot > of customers. If five-ten-sg.com wants to deliver to comcast.net, my publishing tlsa records for

Re: [mailop] Is there a contact for ono.com

2020-07-15 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Thu, 2020-07-16 at 00:07 +0300, Atro Tossavainen via mailop wrote: > Since https://www.ono.com/ is equally unaccessible from my domestic > Internet connection (also in Finland), I'd say #1 sounds more likely > to me. I can ping www.ono.com ==

Re: [mailop] SPF strict / DMARC interaction / "big" provider behavior...

2020-06-17 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Wed, 2020-06-17 at 16:45 -0400, Bill Cole via mailop wrote: > > This problem is part of why DMARC was developed. Very few people are > adequately confident of their understanding of DMARC and of its > reliability to make it the root cause of mail

Re: [mailop] Sendgrid and phishing

2020-06-17 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Wed, 2020-06-17 at 08:55 -0500, Michael Rathbun via mailop wrote: > > Pointing out to users reporting these that blocking Sendgrid > entirely > (the temptation arises) would take out the SG traffic that is highly > desired (at least 70%). Two

Re: [mailop] SendGrid Abuse unresponsive

2020-05-10 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Tue, 2020-05-05 at 15:06 -0700, Jay Hennigan via mailop wrote: > On 5/5/20 14:30, Blake Hudson via mailop wrote: > > Been getting a variety of Amex scams for several weeks via SendGrid. > > Wish they had a better reporting mechanism. > The

Re: [mailop] [OFF TOPIC] Any WindStream abuse team members on here?

2020-05-07 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Wed, 2020-05-06 at 23:39 -0500, Michael Rathbun via mailop wrote: > > The one we see from that group is 183.136.225.44, currently knocking > at the > door but being halted by the "all 183.128.0.0/11 refuse" rule. 183.136.225.45 and

Re: [mailop] SendGrid Abuse unresponsive

2020-05-05 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Tue, 2020-05-05 at 07:48 -0700, Michael Peddemors via mailop wrote: > This is a little too obvious, and while historically SendGrid ran a > tight ship, and got a little lee way from spam auditors.. it's getting > very bad, and going on for too

Re: [mailop] Weekly Update on SpamAuditor reports

2020-04-19 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Fri, 2020-04-17 at 09:28 -0700, Michael Peddemors via mailop wrote: > * SendGrid compromised accounts sending phishing > Seeing a lot more cases of this occurring again, mostly phishing > attacks. Yup. IP: wrqvbqzd.outbound-mail.sendgrid.net

Re: [mailop] list bombing

2019-11-25 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Mon, 2019-11-25 at 10:32 -0800, Kurt Andersen (b) via mailop wrote: > Are you seeing any significant portion of these messages bearing the > Form-Sub header? (documented in https://tools.ietf.org/html/draft- > levine-mailbomb-header-01) On a low

Re: [mailop] delivery problems from mimecast.com

2019-11-21 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Thu, 2019-11-21 at 17:09 +0100, Claus Assmann via mailop wrote: > I wasted several hours to set up one host to get a Let's Encrypt cert, > configured my server to use that for connections from mimecast, and > ... still get the same error. My

Re: [mailop] Gmail marking email from me as spam

2019-10-11 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Thu, 2019-10-10 at 22:06 -0400, John Levine via mailop wrote: > In article <1570757713.1030.53.ca...@16bits.net> you write: > >Count me too as someone with a tiny server that Gmail automatically > >files in spam with apparently no reason. >

Re: [mailop] booking.com dmarc

2019-06-04 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Mon, 2019-06-03 at 16:10 -0700, Alan Hodgson via mailop wrote: > You can sign with a sub-domain or parent domain as long as they share > the same organizational domain. My understanding was incorrect. Page 10 of RFC7489 says "In relaxed mode,

Re: [mailop] What is the story with QQ.COM?

2019-06-03 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Sun, 2019-06-02 at 20:12 +, Benjamin BILLON via mailop wrote: > If those emails seem to be sent from botnets, I believe they're not > sent from QQ.com. They have a SPF -all policy, a p=none DMARC policy, > and I can't check if they have DKIM

Re: [mailop] DigitalOcean calling for social media s* storm? (Re: Why is it so hard to have takedown's performed..)

2019-04-29 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Mon, 2019-04-29 at 16:49 -0700, Michael Peddemors via mailop wrote: > PPS, You know the IP(s) can change at any time ;) That is what cron is for. So far, synapp.io has been very good about listing *only* their own address validators in their spf

Re: [mailop] DigitalOcean calling for social media s* storm? (Re: Why is it so hard to have takedown's performed..)

2019-04-29 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Mon, 2019-04-29 at 09:12 -0700, Michael Peddemors via mailop wrote: > Speaking of.. anyone have any insight into these guys? > They keep popping up on various CDN's eg, DO, AZURE, etc.. > 45.32.138.192 (M) 1