Re: [mailop] Massive Spam Incident @ Outlook.com?

2022-10-16 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Wed, 2022-10-12 at 13:01 +, Slavko via mailop wrote: > I did some experiments with that (not mail related) in past and most > often > user's response was something as -- "They are big, they are doing > things > right!" The most of us known, th

Re: [mailop] SMTP noise from *.bouncer.cloud

2022-09-04 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Sun, 2022-09-04 at 19:49 +, Radek Kaczynski via mailop wrote: > Regarding the list of IPs - I'd prefer to send it to the interested > people directly. > I'd like to have a track of record to whom I have exposed it and You realize of course t

Re: [mailop] SMTP noise from *.bouncer.cloud

2022-09-03 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Sun, 2022-09-04 at 00:43 +0200, Radek Kaczynski via mailop wrote: > If any of you would like to get a full list of our IP addresses and > domains so that you can block Bouncer's requests - please feel free to > email me at ra...@usebouncer.com. P

Re: [mailop] smtp dane/tlsa

2022-09-03 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Sat, 2022-09-03 at 17:41 +, ml+mailop--- via mailop wrote: > How did you notice that "something is now broken"? A former client was trying to setup Fedora 36 sendmail with dane validation. F36 comes with sendmail 8.17.1 which is supposed to s

Re: [mailop] smtp dane/tlsa

2022-09-02 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Fri, 2022-09-02 at 18:42 +, ml+mailop--- via mailop wrote: > Are you sure you want 3 0 1 and not 3 1 1? Yes. We are publishing the hash of the full certificate. Note there are two tlsa records, one corresponding to the previous LE certificate

[mailop] smtp dane/tlsa

2022-09-02 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Years ago I setup automation for tlsa records to support smtp dane here. However, something is now broken, and I am not sure what is wrong. _25._tcp.mail3.five-ten-sg.com. IN TLSA 3 0 1 ( 834d710b2feb790cc9b2c6d251c65b1fedc24c51a4149bdfeae4d40e0be

Re: [mailop] So, Sendgrid / Zoom, planning on actually doing anything about webinar spams?

2022-07-22 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Wed, 2022-07-20 at 12:41 -0600, Brie via mailop wrote: > It's still going on even though it was 'being looked into'. Fixed here by blacklisting the DKIM signature from zoom.us -BEGIN PGP SIGNATURE- iHMEAREKADMWIQSuFMepaSkjWnTxQ5QvqPuaK

Re: [mailop] Google's Request to the FEC about Allowing Political Email to Bypass Spam Filtering

2022-07-09 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Sat, 2022-07-09 at 17:22 -0600, Anne Mitchell via mailop wrote: > "It shall be unlawful for an operator of an email service to use a > filtering algorithm to apply a label to an email sent to an email > account from a political campaign unless the

Re: [mailop] AT&T blocking IP addresses

2022-03-30 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Wed, 2022-03-30 at 10:55 -0700, Michael Peddemors via mailop wrote: > Imagine the day where you can't use email unless you use Gmail or > o356. If that happens, there will be two mail systems (gmail/o365) and (everyone else). If the (gmail/o365)

Re: [mailop] Can someone from google/gmail contact me offlist?

2022-03-30 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Wed, 2022-03-30 at 09:56 -0500, Al Iverson via mailop wrote: > Since this specifically refers to domain reputation I'd make sure all > mail is properly signing with DKIM. Domain rep can also fall back to > the return-path domain, so if that's diff

Re: [mailop] So uh... Zoom/Sendgrid... How's that webinar spam investigation coming?

2021-08-04 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Wed, 2021-08-04 at 16:40 -0700, Luke via mailop wrote: > Bounces and spam report percentages dropped. I am probably not the only one that has SA blocking all mail from some of those senders. header SENDGRID4 X-Entity-ID =~ /7mxhBNMkQ9yfwz0A5\+NG

Re: [mailop] Contact for Zoom webinar spam sent via Sendgrid (ugh)

2021-07-11 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Thu, 2021-07-08 at 09:14 -0700, Luke via mailop wrote: > Both of the accounts reported by Michael have been suspended. DATE: 07/11/21 07:00:22 PDT IP: o5.sg.zoom.us :::149.72.199.144 env_From: bounces+21079884-d4de-.. X-Entity-ID: 7mxhBNM

Re: [mailop] Contact for Zoom webinar spam sent via Sendgrid (ugh)

2021-07-08 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Thu, 2021-07-08 at 09:31 +0300, Atro Tossavainen via mailop wrote: > That one is Zoom.us itself. > Received: from o5.sg.zoom.us (o5.sg.zoom.us [149.72.199.144]) > Received: from o12.ptr3622.sg.zoom.us (o12.ptr3622.sg.zoom.us > [167.89.93.232])

Re: [mailop] Contact for Zoom webinar spam sent via Sendgrid (ugh)

2021-07-07 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Tue, 2021-07-06 at 23:59 +0300, Atro Tossavainen via mailop wrote: > X-Entity-ID: 7mxhBNMkQ9yfwz0A5+NG7Q== > Return-Path: https://list.mailop.org/listinfo/mailop

Re: [mailop] protection.outlook.com refusing to accept mail with misleading temp error message

2021-06-02 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Tue, 2021-06-01 at 21:46 -0400, yuv via mailop wrote: > but I do like the fact that if someone puts > a letter with my address in a post office box anywhere in the world, > it > makes its way to my snail box within a reliable service standard. Yo

Re: [mailop] Microsoft antispam

2021-02-07 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Fri, 2021-02-05 at 10:04 -0600, Lyle Giese via mailop wrote: > I just looked at the dns entries for foddi.net. The A and > records for mx1.mail.foddi.net has a TTL of 120 seconds. For many mail > providers that indicates a dynamic IP address.

Re: [mailop] cloudapp.azure.com?

2020-12-17 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Thu, 2020-12-17 at 07:28 -0800, Michael Peddemors via mailop wrote: > But yeah, it's ugly on Azure right now.. 41.201.224.52.list.dnswl.org. 10800 IN TXT "cloudapp.azure.com https://dnswl.org/s/?s=53622"; 41.201.224.52.list.dnswl.org. 10800 IN

Re: [mailop] Just how does SendGrid fail this badly?

2020-08-18 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Tue, 2020-08-18 at 12:03 +, Andy Smith via mailop wrote: > From: "chiark.greenend.org.uk" So sendgrid account 15204622 was sending mail as: Received: from dhl.com (unknown) by ismtpd0005p1lon1.sendgrid.net (SG) with ESMTP id

Re: [mailop] Just how does SendGrid fail this badly?

2020-08-18 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Tue, 2020-08-18 at 15:23 +0300, Atro Tossavainen via mailop wrote: > The SendGrid account sending these yesterday is 13999362. Where do you find that account number in the headers? I see some from today with "Upgrade (FINAL WARNING)" in the subje

Re: [mailop] Google and Spam detection

2020-07-24 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Fri, 2020-07-24 at 22:08 -0400, John Levine via mailop wrote: > Depends whether you consider Comcast to be big. They sure have a lot > of customers. If five-ten-sg.com wants to deliver to comcast.net, my publishing tlsa records for _25._tcp.mail3

Re: [mailop] Is there a contact for ono.com

2020-07-15 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Thu, 2020-07-16 at 00:07 +0300, Atro Tossavainen via mailop wrote: > Since https://www.ono.com/ is equally unaccessible from my domestic > Internet connection (also in Finland), I'd say #1 sounds more likely > to me. I can ping www.ono.com == 62.

Re: [mailop] SPF strict / DMARC interaction / "big" provider behavior...

2020-06-17 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Wed, 2020-06-17 at 16:45 -0400, Bill Cole via mailop wrote: > > This problem is part of why DMARC was developed. Very few people are > adequately confident of their understanding of DMARC and of its > reliability to make it the root cause of mail

Re: [mailop] Sendgrid and phishing

2020-06-17 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Wed, 2020-06-17 at 08:55 -0500, Michael Rathbun via mailop wrote: > > Pointing out to users reporting these that blocking Sendgrid > entirely > (the temptation arises) would take out the SG traffic that is highly > desired (at least 70%). Two mon

Re: [mailop] SendGrid Abuse unresponsive

2020-05-10 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Tue, 2020-05-05 at 15:06 -0700, Jay Hennigan via mailop wrote: > On 5/5/20 14:30, Blake Hudson via mailop wrote: > > Been getting a variety of Amex scams for several weeks via SendGrid. > > Wish they had a better reporting mechanism. > The report

Re: [mailop] [OFF TOPIC] Any WindStream abuse team members on here?

2020-05-07 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Wed, 2020-05-06 at 23:39 -0500, Michael Rathbun via mailop wrote: > > The one we see from that group is 183.136.225.44, currently knocking > at the > door but being halted by the "all 183.128.0.0/11 refuse" rule. 183.136.225.45 and 183.136.225.4

Re: [mailop] SendGrid Abuse unresponsive

2020-05-05 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Tue, 2020-05-05 at 07:48 -0700, Michael Peddemors via mailop wrote: > This is a little too obvious, and while historically SendGrid ran a > tight ship, and got a little lee way from spam auditors.. it's getting > very bad, and going on for too lon

Re: [mailop] Weekly Update on SpamAuditor reports

2020-04-19 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Fri, 2020-04-17 at 09:28 -0700, Michael Peddemors via mailop wrote: > * SendGrid compromised accounts sending phishing > Seeing a lot more cases of this occurring again, mostly phishing > attacks. Yup. IP: wrqvbqzd.outbound-mail.sendgrid.net ::

Re: [mailop] list bombing

2019-11-25 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Mon, 2019-11-25 at 10:32 -0800, Kurt Andersen (b) via mailop wrote: > Are you seeing any significant portion of these messages bearing the > Form-Sub header? (documented in https://tools.ietf.org/html/draft- > levine-mailbomb-header-01) On a low

Re: [mailop] delivery problems from mimecast.com

2019-11-21 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Thu, 2019-11-21 at 17:09 +0100, Claus Assmann via mailop wrote: > I wasted several hours to set up one host to get a Let's Encrypt cert, > configured my server to use that for connections from mimecast, and > ... still get the same error. My serv

Re: [mailop] Gmail marking email from me as spam

2019-10-11 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Thu, 2019-10-10 at 22:06 -0400, John Levine via mailop wrote: > In article <1570757713.1030.53.ca...@16bits.net> you write: > >Count me too as someone with a tiny server that Gmail automatically > >files in spam with apparently no reason. > >There

[mailop] any contact at interactive.wsj.com

2019-06-20 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Anyone here work for or have a contact at WSJ (or possibly createsend)? We have some subscribers to their interactive.wsj.com email version, and they receive it nicely. But exactly one user has been unable to receive anything other than 1-1 correspon

Re: [mailop] booking.com dmarc

2019-06-04 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Mon, 2019-06-03 at 16:10 -0700, Alan Hodgson via mailop wrote: > You can sign with a sub-domain or parent domain as long as they share > the same organizational domain. My understanding was incorrect. Page 10 of RFC7489 says "In relaxed mode, the

Re: [mailop] What is the story with QQ.COM?

2019-06-03 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Sun, 2019-06-02 at 20:12 +, Benjamin BILLON via mailop wrote: > If those emails seem to be sent from botnets, I believe they're not > sent from QQ.com. They have a SPF -all policy, a p=none DMARC policy, > and I can't check if they have DKIM b

Re: [mailop] DigitalOcean calling for social media s* storm? (Re: Why is it so hard to have takedown's performed..)

2019-04-29 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Mon, 2019-04-29 at 16:49 -0700, Michael Peddemors via mailop wrote: > PPS, You know the IP(s) can change at any time ;) That is what cron is for. So far, synapp.io has been very good about listing *only* their own address validators in their spf

Re: [mailop] DigitalOcean calling for social media s* storm? (Re: Why is it so hard to have takedown's performed..)

2019-04-29 Thread Carl Byington via mailop
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Mon, 2019-04-29 at 09:12 -0700, Michael Peddemors via mailop wrote: > Speaking of.. anyone have any insight into these guys? > They keep popping up on various CDN's eg, DO, AZURE, etc.. > 45.32.138.192 (M) 1 mta-wk-3.mk3.ipruz.