Re: [mailop] SendGrid Abuse unresponsive

[Atro Tossavainen via mailop]

On Thu, May 21, 2020 at 09:29:02AM -0400, Chris via mailop wrote:
> Atro, what was Y axis?  Individual emails?  10's?  100's?

More than that. Still only a drop in the ocean when it comes to an ESP
that sends billions a day, of course. We are no Microsoft or Google.

> And you just seemed to say that it was all sendgrid, not taking into
> account whether it was spam or not.  Correct?

Any mail received at our spamtraps, of whose composition you might
have a fairly decent idea, identified as being sent by SendGrid. As
I said and you quoted it back at me, 

>> So, it bears to be remembered that the graph I shared is of the total
>> number of mail detected as SendGrid only, with absolutely no comment
>> on which customers it was or whether the mail was legit ESP customer
>> mail or in any manner any stuff that an ESP would normally not expect
>> to be sending in the first place.

So, as to whether it was spam or not: you have to indicate your definition
of spam first, and then it becomes possible to at least attempt to have
that conversation with respect to this data.

-- 
Atro Tossavainen, Founder, Partner
Koli-Lõks OÜ (reg. no. 12815457, VAT ID EE101811635)
Tallinn, Estonia
tel. +372-5883-4269, http://www.koliloks.eu/

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Chris via mailop]

Atro, what was Y axis?  Individual emails?  10's?  100's?

And you just seemed to say that it was all sendgrid, not taking into 
account whether it was spam or not.  Correct?


Um.

On 2020-05-21 05:01, Atro Tossavainen via mailop wrote:

Hey Ray,


I checked again this morning and its 'back on track' here also now.

I saw a (big) drop here during the day but it has cought up.


Having a bit of longer-term perspective is good.

Having said that, my business partner remarked that "we are also dealing
with a situation where companies that never spammed before are trying
it out of desperation."

So, it bears to be remembered that the graph I shared is of the total
number of mail detected as SendGrid only, with absolutely no comment
on which customers it was or whether the mail was legit ESP customer
mail or in any manner any stuff that an ESP would normally not expect
to be sending in the first place.




___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Jakub Olexa via mailop]

Hi,

the patterns look the same since jan 1st for recycled and pristine traps:

adding typos:

there is a dip between apr 5th and 13th... other than that I don't see
much of a difference

Jakub Olexa
Founder & CEO
E-mail: ja...@mailkit.com 
Tel: +420 777 744 440 

Mailkit - Closing the circle between Deliverability and Engagement


On 21.5.2020 11:01, Atro Tossavainen via mailop wrote:
> Hey Ray,
>
>> I checked again this morning and its 'back on track' here also now.
>>
>> I saw a (big) drop here during the day but it has cought up.
> Having a bit of longer-term perspective is good.
>
> Having said that, my business partner remarked that "we are also dealing
> with a situation where companies that never spammed before are trying
> it out of desperation."
>
> So, it bears to be remembered that the graph I shared is of the total
> number of mail detected as SendGrid only, with absolutely no comment
> on which customers it was or whether the mail was legit ESP customer
> mail or in any manner any stuff that an ESP would normally not expect
> to be sending in the first place.
>

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Atro Tossavainen via mailop]

Hey Ray,

> I checked again this morning and its 'back on track' here also now.
> 
> I saw a (big) drop here during the day but it has cought up.

Having a bit of longer-term perspective is good.

Having said that, my business partner remarked that "we are also dealing
with a situation where companies that never spammed before are trying
it out of desperation."

So, it bears to be remembered that the graph I shared is of the total
number of mail detected as SendGrid only, with absolutely no comment
on which customers it was or whether the mail was legit ESP customer
mail or in any manner any stuff that an ESP would normally not expect
to be sending in the first place.

-- 
Atro Tossavainen, Founder, Partner
Koli-Lõks OÜ (reg. no. 12815457, VAT ID EE101811635)
Tallinn, Estonia
tel. +372-5883-4269, http://www.koliloks.eu/

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Raymond Dijkxhoorn via mailop]

Hai!


I don't see any drop in volumes here.   I just spent 10 minutes
looking at anything hitting traps today from Sendgrid ASN and soon
found plenty of concern:



I concur with Steve.

http://www.atro.fi/sendgrid.png

Y axis is linear, thin line is trendline.


Thanks Atro!

I checked again this morning and its 'back on track' here also now.

I saw a (big) drop here during the day but it has cought up.

Bye, Raymond___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Atro Tossavainen via mailop]

> I don't see any drop in volumes here.   I just spent 10 minutes
> looking at anything hitting traps today from Sendgrid ASN and soon
> found plenty of concern:

I concur with Steve.

http://www.atro.fi/sendgrid.png

Y axis is linear, thin line is trendline.

-- 
Atro Tossavainen, Founder, Partner
Koli-Lõks OÜ (reg. no. 12815457, VAT ID EE101811635)
Tallinn, Estonia
tel. +372-5883-4269, http://www.koliloks.eu/

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Raymond Dijkxhoorn via mailop]

Hello Steve,

I'm seeing a very significant drop off of sendgrid-originated spam. Couple 
of minor phish/419 in the past 24 hours.


Anybody else?



I don't see any drop in volumes here.   I just spent 10 minutes looking at 
anything hitting traps today from Sendgrid ASN and soon found plenty of 
concern:


Usually i am inline with your findings but ...


From: "rakuten" 
Reply-To: ratu...@ratuken.jp
Subject: Subject

From: l...@avibra.fr
Mime-Version: 1.0
Subject: Merci pour votre message
Bonjour D=D0=B0ting site for se=D1=85 with girls in th=D0=B5 USA


Its still certainly not empty. We do agree there. But the volumes are 
definately going down significantly.


I see a drop of 42% roughly on the traps , and i hope they will continue 
to work on them.


That last spam you subscribed to, i am sure ;)

Good night! Raymond___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Michael Peddemors via mailop]

Still seeing the phishing attempts.. Only reason there is less, is some 
of the older IP(s) still in blacklists ;)


Just kidding, but volume high enough to show that they don't have the 
issue handled as of yet..


On 2020-05-19 12:48 p.m., Chris via mailop wrote:
I'm seeing a very significant drop off of sendgrid-originated spam. 
Couple of minor phish/419 in the past 24 hours.


Anybody else?

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop




--
"Catch the Magic of Linux..."

Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic
A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd.

604-682-0300 Beautiful British Columbia, Canada

This email and any electronic data contained are confidential and intended
solely for the use of the individual or entity to which they are addressed.
Please note that any views or opinions presented in this email are solely
those of the author and are not intended to represent those of the company.

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Chris via mailop]

I'm seeing a very significant drop off of sendgrid-originated spam. 
Couple of minor phish/419 in the past 24 hours.


Anybody else?

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Chris via mailop]

On 2020-05-12 13:10, Melinda Plemel via mailop wrote:
I can help with this issue.  Feel free to DM me and I'll get it taken 
care of.


Hi Melinda, the email in question is Len Shneyder 

You know Len of course.

He REALLY needs to get on here.

I didn't realize that Len was now in the sendgrid picture.  I think I 
missed an acquisition somewhere...


Len is a great guy, known him for at least a decade.  I just had a 1 1/4 
hour video chat with him on all this stuff.


Sendgrid has been fighting and closing 2 or 3 distinct and separate 
attack methodologies.  They have plugged everything they know about. 
There are some remaining bits of it which may take a little while to 
eradicate, but they're working hard on it.


Len and I went through a number of high volume bits of spam I'd received 
- pillz/porn and 419 in this batch.  All but one had already been 
actioned, and the last was zapped during the call.


Len and I left the call with an agreement that I'd wait a few days 
before digging back in, to give the last bits of what they've done to 
take effect.


Len also said that they're have several very new people in their abuse 
group who are not up to speed, and one experienced one who is going on 
mat leave imminently, so they're stretched.


In urgent/serious situations where the abuse@ contact does not seem to 
be working, he wanted me to encourage people to contact him directly (at 
the email given above).  Please try to not flood him with too much - 
keep it to the worst.



___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Melinda Plemel via mailop]

I can help with this issue.  Feel free to DM me and I'll get it taken care
of.

Melinda

On Tue, May 12, 2020 at 10:58 AM Steven Champeon via mailop <
mailop@mailop.org> wrote:

> on Mon, May 11, 2020 at 01:45:42PM -0400, Matt V via mailop wrote:
> > On 2020-05-05 11:09 p.m., Andy Smith via mailop wrote:
> >
> > I've been told by at least one Sendgrid person that they have
> > requested membership to the list and are awaiting administrator
> > approvals...
>
> Yep, apparently the folks who run the list don't actually read mail
> to -owner@. Len is a good guy and has been waiting for days to get a
> response. WTF, people?
>
> --
> hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2553 w:
> http://hesketh.com/
> Internet security and antispam hostname intelligence:
> http://enemieslist.com/
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Steven Champeon via mailop]

on Mon, May 11, 2020 at 01:45:42PM -0400, Matt V via mailop wrote:
> On 2020-05-05 11:09 p.m., Andy Smith via mailop wrote:
> 
> I've been told by at least one Sendgrid person that they have
> requested membership to the list and are awaiting administrator
> approvals...

Yep, apparently the folks who run the list don't actually read mail
to -owner@. Len is a good guy and has been waiting for days to get a
response. WTF, people? 

-- 
hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2553 w: http://hesketh.com/
Internet security and antispam hostname intelligence: http://enemieslist.com/

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Chris via mailop]

On 2020-05-11 14:15, Brielle via mailop wrote:

On 5/11/2020 11:45 AM, Matt V via mailop wrote:

On 2020-05-05 11:09 p.m., Andy Smith via mailop wrote:

I've been told by at least one Sendgrid person that they have 
requested membership to the list and are awaiting administrator 
approvals...



Better late than never I guess...


To be blunt, they've been members of M3AAWG for many many years.  M3AAWG 
is better at dealing with these sorts of laxness on the part of an ESP 
who wants to remain on everybody's good books/sheer clout, than any 
"ordinary mailing list" (sorry guys ...;-) could possibly have.


I knew about 6 Sendgrid people from years of collaborating with them in 
person and online.  They were one of the best at fixing problems.


For a variety of reasons I've not been dealing with M3AAWG nearly as 
much as I used to, but I can only assume, for this degree of crap coming 
out (and oh my yes, I see it too), that none of the people I knew are 
still there OR no longer have the authority to deal with it.


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Luke via mailop]

The very first reply to this thread was from a SendGrid representative.
They generally respond pretty quickly any time they are mentioned here.

Luke

On Mon, May 11, 2020 at 11:24 AM Brielle via mailop 
wrote:

> On 5/11/2020 11:45 AM, Matt V via mailop wrote:
> > On 2020-05-05 11:09 p.m., Andy Smith via mailop wrote:
> >
> > I've been told by at least one Sendgrid person that they have requested
> > membership to the list and are awaiting administrator approvals...
> >
> >
>
> Better late than never I guess...
>
> --
> Brielle Bruns
> The Summit Open Source Development Group
> http://www.sosdg.org/ http://www.ahbl.org
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Brielle via mailop]

On 5/11/2020 11:45 AM, Matt V via mailop wrote:

On 2020-05-05 11:09 p.m., Andy Smith via mailop wrote:

I've been told by at least one Sendgrid person that they have requested 
membership to the list and are awaiting administrator approvals...





Better late than never I guess...

--
Brielle Bruns
The Summit Open Source Development Group
http://www.sosdg.org/ http://www.ahbl.org

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Matt V via mailop]

On 2020-05-05 11:09 p.m., Andy Smith via mailop wrote:

I've been told by at least one Sendgrid person that they have requested 
membership to the list and are awaiting administrator approvals...



--
~
MATT


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Carl Byington via mailop]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

On Tue, 2020-05-05 at 15:06 -0700, Jay Hennigan via mailop wrote:
> On 5/5/20 14:30, Blake Hudson via mailop wrote:
> > Been getting a variety of Amex scams for several weeks via SendGrid.
> > Wish they had a better reporting mechanism.

> The reporting mechanism is fine. There just isn't anyone who cares on
> the other end of it.

It also seems that there is NO outbound spam filtering at all. Consider
this one, a standard lottery commission spam:

Subject: Claim Winning Now!
From: Elizabeth 
Date: Sun, 10 May 2020 18:42:30 + (UTC)
Reply-To: mallettte...@yahoo.com

Really sendgrid - you allow a From: header of xx@yy ??


-BEGIN PGP SIGNATURE-
Version: GnuPG v2.0.14 (GNU/Linux)

iEYEAREKAAYFAl64WAYACgkQL6j7milTFsG+OgCcDLWxhx92xN9Uuc/Nxg0Y344S
ufoAn3Z+togXTmc3S2tyAgvIwu1CJbZE
=qP1n
-END PGP SIGNATURE-



___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Andrew C Aitchison via mailop]

On Wed, 6 May 2020, Andy Smith via mailop wrote:


Hello,

On Tue, May 05, 2020 at 02:50:39PM -0700, Carl Byington via mailop wrote:

It is bad enough that our local spamassassin rules add 5 points if the
message is dkim signed by sendgrid.net.


Same here and it's extra frustrating because there is so much ham in
there as well. Just some SendGrid clients I've had to whitelist:

   GoCardless
   UK Liberal Democrat party
   Just-Eat
   BorrowMyDoggy
   Imgur
   Threadless
   CDKeys.com
   Picfair
   Nextdoor
   GitHub

the list goes on; I haven't even got to the end of what I have had
to whitelist just for my users.

I just wish these brands knew they were sharing a service that mixes
in their email with phishing campaigns that aren't cleaned up even
after months.


Could you write something up for your users and ours
to send to the brand marketing people ?

--
Andrew C. Aitchison Kendal, UK
and...@aitchison.me.uk

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Andy Smith via mailop]

Hello,

On Tue, May 05, 2020 at 02:50:39PM -0700, Carl Byington via mailop wrote:
> It is bad enough that our local spamassassin rules add 5 points if the
> message is dkim signed by sendgrid.net.

Same here and it's extra frustrating because there is so much ham in
there as well. Just some SendGrid clients I've had to whitelist:

GoCardless
UK Liberal Democrat party
Just-Eat
BorrowMyDoggy
Imgur
Threadless
CDKeys.com
Picfair
Nextdoor
GitHub

the list goes on; I haven't even got to the end of what I have had
to whitelist just for my users.

I just wish these brands knew they were sharing a service that mixes
in their email with phishing campaigns that aren't cleaned up even
after months.

All of this reported to abuse@; can't even see evidence of list
washing, it just keeps coming.

Cheers,
Andy

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Jay Hennigan via mailop]

On 5/5/20 14:30, Blake Hudson via mailop wrote:
Been getting a variety of Amex scams for several weeks via SendGrid. 
Wish they had a better reporting mechanism.


The reporting mechanism is fine. There just isn't anyone who cares on 
the other end of it.


--
Jay Hennigan - j...@west.net
Network Engineering - CCIE #7880
503 897-8550 - WB6RDV

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Carl Byington via mailop]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

On Tue, 2020-05-05 at 07:48 -0700, Michael Peddemors via mailop wrote:
> This is a little too obvious, and while historically SendGrid ran a
> tight ship, and got a little lee way from spam auditors.. it's getting
> very bad, and going on for too long.. risking loosing any preferential
> treatment..

It is bad enough that our local spamassassin rules add 5 points if the
message is dkim signed by sendgrid.net.


-BEGIN PGP SIGNATURE-
Version: GnuPG v2.0.14 (GNU/Linux)

iEYEAREKAAYFAl6x36kACgkQL6j7milTFsE2OgCeLwhoqVz9/Zxbc8HWq9W7AeWW
ubQAn3sD3yvE8pN57i75feThvdyDVBM5
=5ki/
-END PGP SIGNATURE-



___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Michael Peddemors via mailop]

And DHL, NETFLIX, and others.. and they are SO blatant and obvious..

Maybe the DHL/Netflix/Amex guys have a bigger stick that they can use, 
the amount of phishing attempts through SendGrid is staggering, and 
especially when exactly the same phishing email comes in day after day..


I am sure that these companies and their customers are suffering a 
monetary loss ..


From: "NETFLlX" 
Mime-Version: 1.0
Reply-To: ad...@ibizperu.com
Message-ID: 
Subject: Please Update Your Payment Method.
List-Unsubscribe: 

X-SG-EID: 
FPVrtLHU9M4sDT1ATFN/QI+n707JakhnaCXRFxaaQuxQVmlAdwwnzg7a76XGUnNfiv+rnN7O+ehvw9


gszB7V6nlk3iu4/pEcuyrdO+Ti1eair2jeqBD7abKR1i2oW3Qpau9vZViutg1WQ4VA9cNL48yy0aRU
 5MSY+mOJ/fAw5/DUIMaet6VQL+RJMdZWm6FI599DRKwTS1wOJIrSk17y+g==

Not sure a 'better' reporting tool is needed, if they aren't taking 
action on the reports that they are getting.. A one liner filter rule 
should have stopped these weeks ago..




On 2020-05-05 2:30 p.m., Blake Hudson via mailop wrote:
Been getting a variety of Amex scams for several weeks via SendGrid. 
Wish they had a better reporting mechanism.


Received: from wrqvfvsw.outbound-mail.sendgrid.net 
(wrqvfvsw.outbound-mail.sendgrid.net [149.72.248.105])

     (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
     (No client certificate requested)
     by mail.ispn.net (Postfix) with ESMTPS id 65FE3800E4E
     for ; Tue, 28 Apr 2020 12:04:22 -0500 (CDT)
DKIM-Filter: OpenDKIM Filter v2.11.0 mail.ispn.net 65FE3800E4E
Authentication-Results: mail.ispn.net;
     dkim=pass (1024-bit key) header.d=mytuner.mobi 
header.i=@mytuner.mobi header.b="e2+SR0dP"

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mytuner.mobi;
     h=content-type:mime-version:subject:to:from:list-unsubscribe;
     s=s1; bh=hTbLWa0rB3Wwo49o0xU2xD9v4bjCR41krW7VkpSSxzw=; b=e2+SR0d
     P7ePRapdg8cLSi5DcN4zltCNr7B0hOOVYEuW4uM4Wjml3DlKmym1U8iZxogOAbit
     RYVNhmHtTrKG2ykVesUyZpOZZk6xvjyUSbqepBPMMh++2xiEhWVZrKtquE8gwqGh
     wt0tQamfhNOT/BlnS4cnr8U8FW2RrnKobwtM=
Received: by filter1430p1mdw1.sendgrid.net with SMTP id 
filter1430p1mdw1-2514-5EA8620E-32

     2020-04-28 17:04:14.507763321 + UTC m=+1091412.289296934
Received: from WIN-KM74NPGSU4J.us-west-2.compute.internal (unknown)
     by ismtpd0035p1las1.sendgrid.net (SG) with ESMTP id 
oDjUdUZhRYO-Wd8jQmosYw

     Tue, 28 Apr 2020 17:04:14.270 + (UTC)
Content-Type: multipart/alternative; boundary="===1274991544=="
MIME-Version: 1.0
Subject: Security Notification on your Card
To: Customers 
From: "American Express" 
Date: Tue, 28 Apr 2020 17:04:14 + (UTC)
Message-ID: 
List-Unsubscribe: 

X-SG-EID: 
eLF1XdoUgtODrTnreYcGkW29+W8SlXhMCPQICHWXv4c4UPqo4BYpwT6WdoB1GFSwuwd6mNC9sCJf1r

  5PzIFZRABSj7gKeokjHm7Lnl8QkLAKEXf2JojGJnXeyze4NC/w39UhwzU/ki7FK6ScIgZx+gfhUQEe
  W/8/g7BcHCE1Lc+BnEOTTL+ZjLy6xWcHvoTOvSwKTV5H7YXMjUPnsbijhXY/GG1vgjjAfJT228fgF5
  JgGA5Yu0hMI46ZfVGtVOMh



On 5/5/2020 9:48 AM, Michael Peddemors via mailop wrote:

Since on the topic of SendGrid..

Received: from dhl.com (unknown)
by geopod-ismtpd-2-1 (SG) with ESMTP
id yXjQUIVNTmWUp86G27YZTw
for ;
Tue, 05 May 2020 10:02:57.886 + (UTC)
From: DHL Express 
Subject: Shipment Arrival Notice.
Date: Tue, 05 May 2020 10:02:57 + (UTC)
Message-ID: <20200505100257.58c63efbca795...@dhl.com>
MIME-Version: 1.0
X-SG-EID:

=?us-ascii?Q?Fty1fbakBjfkMnPdNSS4UpmkoEOMkDriB8B3kSQUjCzRogyCEiG1y0V8I5N3J4?= 


 =?us-ascii?Q?Y=2FMd=2F0SFVzCTWMExjNhU9h6pIlyK51PQJ=2FVJLye?=
 =?us-ascii?Q?RmHv4lJals+LEOvb4dhaYhRi0UPG27bJ=2FJA5mqh?=
 =?us-ascii?Q?VL0Nx9J=2FyaWQ+bIzekwAAGSkhnpeyO+imjI0Cgh?=
 =?us-ascii?Q?r7cfzn2kmMSVsOUIPudnngC0yrk3M=2F80HBjUiIy?=
 =?us-ascii?Q?Wl1Av6MSMteTs=2FjUoR3TVyk006pkGBREAMe4gdV?=
 =?us-ascii?Q?7+1=2F+mc9MUFtHbXdptHbg=3D=3D?=

I don't even think they are trying to stop outbound phishing 

Re: [mailop] SendGrid Abuse unresponsive

[Blake Hudson via mailop]

Been getting a variety of Amex scams for several weeks via SendGrid. 
Wish they had a better reporting mechanism.


Received: from wrqvfvsw.outbound-mail.sendgrid.net 
(wrqvfvsw.outbound-mail.sendgrid.net [149.72.248.105])

    (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
    (No client certificate requested)
    by mail.ispn.net (Postfix) with ESMTPS id 65FE3800E4E
    for ; Tue, 28 Apr 2020 12:04:22 -0500 (CDT)
DKIM-Filter: OpenDKIM Filter v2.11.0 mail.ispn.net 65FE3800E4E
Authentication-Results: mail.ispn.net;
    dkim=pass (1024-bit key) header.d=mytuner.mobi 
header.i=@mytuner.mobi header.b="e2+SR0dP"

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mytuner.mobi;
    h=content-type:mime-version:subject:to:from:list-unsubscribe;
    s=s1; bh=hTbLWa0rB3Wwo49o0xU2xD9v4bjCR41krW7VkpSSxzw=; b=e2+SR0d
    P7ePRapdg8cLSi5DcN4zltCNr7B0hOOVYEuW4uM4Wjml3DlKmym1U8iZxogOAbit
    RYVNhmHtTrKG2ykVesUyZpOZZk6xvjyUSbqepBPMMh++2xiEhWVZrKtquE8gwqGh
    wt0tQamfhNOT/BlnS4cnr8U8FW2RrnKobwtM=
Received: by filter1430p1mdw1.sendgrid.net with SMTP id 
filter1430p1mdw1-2514-5EA8620E-32

    2020-04-28 17:04:14.507763321 + UTC m=+1091412.289296934
Received: from WIN-KM74NPGSU4J.us-west-2.compute.internal (unknown)
    by ismtpd0035p1las1.sendgrid.net (SG) with ESMTP id 
oDjUdUZhRYO-Wd8jQmosYw

    Tue, 28 Apr 2020 17:04:14.270 + (UTC)
Content-Type: multipart/alternative; boundary="===1274991544=="
MIME-Version: 1.0
Subject: Security Notification on your Card
To: Customers 
From: "American Express" 
Date: Tue, 28 Apr 2020 17:04:14 + (UTC)
Message-ID: 
List-Unsubscribe: 

X-SG-EID: 
eLF1XdoUgtODrTnreYcGkW29+W8SlXhMCPQICHWXv4c4UPqo4BYpwT6WdoB1GFSwuwd6mNC9sCJf1r

 5PzIFZRABSj7gKeokjHm7Lnl8QkLAKEXf2JojGJnXeyze4NC/w39UhwzU/ki7FK6ScIgZx+gfhUQEe
 W/8/g7BcHCE1Lc+BnEOTTL+ZjLy6xWcHvoTOvSwKTV5H7YXMjUPnsbijhXY/GG1vgjjAfJT228fgF5
 JgGA5Yu0hMI46ZfVGtVOMh




On 5/5/2020 9:48 AM, Michael Peddemors via mailop wrote:

Since on the topic of SendGrid..

Received: from dhl.com (unknown)
by geopod-ismtpd-2-1 (SG) with ESMTP
id yXjQUIVNTmWUp86G27YZTw
for ;
Tue, 05 May 2020 10:02:57.886 + (UTC)
From: DHL Express 
Subject: Shipment Arrival Notice.
Date: Tue, 05 May 2020 10:02:57 + (UTC)
Message-ID: <20200505100257.58c63efbca795...@dhl.com>
MIME-Version: 1.0
X-SG-EID:

=?us-ascii?Q?Fty1fbakBjfkMnPdNSS4UpmkoEOMkDriB8B3kSQUjCzRogyCEiG1y0V8I5N3J4?= 


 =?us-ascii?Q?Y=2FMd=2F0SFVzCTWMExjNhU9h6pIlyK51PQJ=2FVJLye?=
 =?us-ascii?Q?RmHv4lJals+LEOvb4dhaYhRi0UPG27bJ=2FJA5mqh?=
 =?us-ascii?Q?VL0Nx9J=2FyaWQ+bIzekwAAGSkhnpeyO+imjI0Cgh?=
 =?us-ascii?Q?r7cfzn2kmMSVsOUIPudnngC0yrk3M=2F80HBjUiIy?=
 =?us-ascii?Q?Wl1Av6MSMteTs=2FjUoR3TVyk006pkGBREAMe4gdV?=
 =?us-ascii?Q?7+1=2F+mc9MUFtHbXdptHbg=3D=3D?=

I don't even think they are trying to stop outbound phishing any more..

This is a little too obvious, and while historically SendGrid ran a 
tight ship, and got a little lee way from spam auditors.. it's getting 
very bad, and going on for too long.. risking loosing any preferential 
treatment..


Overnite..

149.72.1.84 (M)   5 wrqvhkrq.outbound-mail.sendgrid.net
149.72.24.42  2 wrqvkvnx.outbound-mail.sendgrid.net
   149.72.24.51   1 wrqvkvpp.outbound-mail.sendgrid.net
149.72.25.142 7 wrqvkwvz.outbound-mail.sendgrid.net
149.72.43.171 9 wrqvnbxb.outbound-email.sendgrid.net
149.72.58.101 3 wrqvpxsr.outbound-email.sendgrid.net
149.72.63.131   (RS)  3 wrqvpfvp.outbound-email.sendgrid.net
   149.72.63.135 50 wrqvpfvt.outbound-email.sendgrid.net
   149.72.63.193  6 wrqvpfck.outbound-email.sendgrid.net
149.72.134.56   (M)   1 o2.ptr4806.marketing.sg.getweave.com
149.72.146.9    (M)   1 wrqvwnhw.outbound-mail.sendgrid.net
149.72.163.111    4 wrqvxpsf.outbound-mail.sendgrid.net
149.72.185.201    1 wrqvbwcw.outbound-mail.sendgrid.net
149.72.194.224    3   o1.sg.intherooms.com
149.72.219.45 6 wrqvdbnd.outbound-mail.sendgrid.net
149.72.224.183  (RS)  2 wrqvzhbt.outbound-mail.sendgrid.net
149.72.226.67 5 wrqvznqp.outbound-mail.sendgrid.net
149.72.227.4 50 wrqvzphq.outbound-mail.sendgrid.net
149.72.243.74 5 wrqvfpqx.outbound-mail.sendgrid.net
   149.72.243.152 1 wrqvfpwv.outbound-mail.sendgrid.net





On 2020-05-05 6:31 a.m., Jaroslaw Rafa via mailop wrote:

Dnia  5.05.2020 o godz. 08:32:43 Michael Orlitzky via mailop pisze:


That message 

Re: [mailop] SendGrid Abuse unresponsive

[Florian Vierke via mailop]

Hi guys,

My colleague Daniel has published a blog post with great info to exactly that 
topic this week.. whoever is interested, please have a look: 
https://inboxplacement.com/2020/05/machine-clicks-in-email/

It’s not only tools following links, it’s mainly some well-known isps ;)

Cheers,



[signature_1395543467]<http://www.mapp.com/>
Florian Vierke | Sr. Manager, Deliverability Services

m: +49 1590 4236431
e: florian.vie...@mapp.com<mailto:florian.vie...@mapp.com>

Follow us:  [cid:image006.png@01D4B7E6.669D8F70] 
<https://www.linkedin.com/company/mapp-digital>
[cid:image007.png@01D4B7E6.669D8F70] <https://twitter.com/Mapp_Digital>   
[cid:image008.png@01D4B7E6.669D8F70] 
<https://facebook.com/MappDigitalInternational>


From: mailop  on behalf of Alexander Zeh via mailop 

Sent: Tuesday, May 5, 2020 17:54
To: mailop@mailop.org 
Subject: Re: [mailop] SendGrid Abuse unresponsive


This email has reached Mapp via an external source



Hi Andy,

well.. there is software out there that does exactly that. Follow every single 
link. Sometimes multiple times even with a delay of hours. At least that’s what 
I am seeing. That stuff is pretty annoying. But you’re right, for abuse reports 
there should be a webform and some kind of captcha. I don’t agree with the 
unsubscribe mechanism though. As list-unsubscribe is supposed to be done by the 
mail client in the background without showing the result to the user, a captcha 
or something like that would defeat the purpose. But that’s already kind of 
solved with https://tools.ietf.org/html/rfc8058.

Cheers,
Alex

Am 05.05.2020 um 17:42 schrieb Andy Smith via mailop 
mailto:mailop@mailop.org>>:

Hi Alexander,

On Tue, May 05, 2020 at 05:25:38PM +0200, Alexander Zeh via mailop wrote:
It would also be great if SendGrid would include an abuse reporting
URL in the headers of each message, specific to that message, i.e.
that passes along all info that SendGrid would need to identify that
campaign/client.

I’m not so sure about that, having in mind that the list-unsubscribe header 
already causes some headache on my end as some filters are checking and 
therefore „clicking“ all the URLs they find in body and header.

At a minimum wouldn't such software already follow all links and
confirm deliverability on behalf of the recipient every time they
got marketing email? That seems like a bad idea to begin with, and
also a bad idea from the web server side.

All web contact forms already need some sort of "I am not a bot"
detection because of software like that; you couldn't have some sort
of "this is spam" web service that took a report solely based on a
GET request, and sensible unsubscribe mechanisms don't work that way
either.

Cheers,
Andy

___
mailop mailing list
mailop@mailop.org<mailto:mailop@mailop.org>
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop


Mapp Digital Germany GmbH with registered offices at Dachauer, Str. 63, 80335 
München.
Registered with the District Court München HRB 226181
Managing Directors: Frasier, Christopher & Warren, Steve
This e-mail is from Mapp Digital and its international legal entities and may 
contain information that is confidential or proprietary.
If you are not the intended recipient, do not read, copy or distribute the 
e-mail or any attachments. Instead, please notify the sender and delete the 
e-mail and any attachments.
Please consider the environment before printing. Thank you.
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Alexander Zeh via mailop]

Hi Andy,

well.. there is software out there that does exactly that. Follow every single 
link. Sometimes multiple times even with a delay of hours. At least that’s what 
I am seeing. That stuff is pretty annoying. But you’re right, for abuse reports 
there should be a webform and some kind of captcha. I don’t agree with the 
unsubscribe mechanism though. As list-unsubscribe is supposed to be done by the 
mail client in the background without showing the result to the user, a captcha 
or something like that would defeat the purpose. But that’s already kind of 
solved with https://tools.ietf.org/html/rfc8058 
.

Cheers,
Alex

> Am 05.05.2020 um 17:42 schrieb Andy Smith via mailop :
> 
> Hi Alexander,
> 
> On Tue, May 05, 2020 at 05:25:38PM +0200, Alexander Zeh via mailop wrote:
>>> It would also be great if SendGrid would include an abuse reporting
>>> URL in the headers of each message, specific to that message, i.e.
>>> that passes along all info that SendGrid would need to identify that
>>> campaign/client.
>> 
>> I’m not so sure about that, having in mind that the list-unsubscribe header 
>> already causes some headache on my end as some filters are checking and 
>> therefore „clicking“ all the URLs they find in body and header. 
> 
> At a minimum wouldn't such software already follow all links and
> confirm deliverability on behalf of the recipient every time they
> got marketing email? That seems like a bad idea to begin with, and
> also a bad idea from the web server side.
> 
> All web contact forms already need some sort of "I am not a bot"
> detection because of software like that; you couldn't have some sort
> of "this is spam" web service that took a report solely based on a
> GET request, and sensible unsubscribe mechanisms don't work that way
> either.
> 
> Cheers,
> Andy
> 
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Andy Smith via mailop]

Hi Alexander,

On Tue, May 05, 2020 at 05:25:38PM +0200, Alexander Zeh via mailop wrote:
> > It would also be great if SendGrid would include an abuse reporting
> > URL in the headers of each message, specific to that message, i.e.
> > that passes along all info that SendGrid would need to identify that
> > campaign/client.
> 
> I’m not so sure about that, having in mind that the list-unsubscribe header 
> already causes some headache on my end as some filters are checking and 
> therefore „clicking“ all the URLs they find in body and header. 

At a minimum wouldn't such software already follow all links and
confirm deliverability on behalf of the recipient every time they
got marketing email? That seems like a bad idea to begin with, and
also a bad idea from the web server side.

All web contact forms already need some sort of "I am not a bot"
detection because of software like that; you couldn't have some sort
of "this is spam" web service that took a report solely based on a
GET request, and sensible unsubscribe mechanisms don't work that way
either.

Cheers,
Andy

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Alexander Zeh via mailop]

Hello,

> It would also be great if SendGrid would include an abuse reporting
> URL in the headers of each message, specific to that message, i.e.
> that passes along all info that SendGrid would need to identify that
> campaign/client.

I’m not so sure about that, having in mind that the list-unsubscribe header 
already causes some headache on my end as some filters are checking and 
therefore „clicking“ all the URLs they find in body and header. 

Cheers,
Alex
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Andy Smith via mailop]

Hi Atro,

On Tue, May 05, 2020 at 05:37:26PM +0300, Atro Tossavainen via mailop wrote:
> On Tue, May 05, 2020 at 02:15:07PM +, Andy Smith via mailop wrote:
> > At present the process is to just forward the mail to
> > abuse@sendgrid. It's great that they accept reports that way and
> > I'm not suggesting that change, but a lot of the time clicking
> > on one link is much faster and less error prone.
> 
> For those who don't have a problem with the ESP listwashing on behalf
> of the spammy sender, sure.

Sure, you pretty much have to only include the envelope sender with
the recipient VERP edited out if you want to try to guard against
list washing.

I can't really see that as the reason that any ESP would refuse to
include an abuse-reporting link though. I mean, it's not out of
abundance of care for the recipient, is it?

In reality very few people are going to go to the lengths of
trying to remove all recipient-identifying detail out of an email
they are sending to abuse@, and I'm not suggesting closing down that
option. I still would expect that most of the things that end up at
abuse@sendgrid are going to include identifying information for
recipients.

These are really very different kinds of reporting scenarios I'm
talking about and it's clearly not acceptable to be clicking links
in spamtrap email.

I would hope that anyone reporting spam understands that the act of
doing so can verify that the recipient address exists, allow
list washing, etc., unless they are very careful about how they do
it (and even then…)

> >   implied that the recipient did not accept SpamCop reports. In fact
> >   in that case it was that SpamCop didn't want to send reports to
> >   Hetzner. So it is not possible to determine which side made the
> >   decision to not allow those reports.
> 
> Did I say it yet that Hetzner is worse than useless?

If we are just going to restate our opinions from that thread then
mine is that as the reporter I would like to be the one who decides
whether to make the report even if SpamCop thinks the abuse team is
useless.

I wouldn't object to SpamCop defaulting it to disabled with some
note like, "we don't advise reporting this because all we see is
list washing"¹. As it stands there is no information as to why it's
disabled, so it just can't be reported that way and I am unable to
know whether that is because the abuse team rejects it, SpamCop
doesn't like it, or some other reason.

I realise that SpamCop can do whatever they like and as a user
paying nothing for the service I just get to deal with it. It's just
feedback.

Cheers,
Andy

¹ Or whatever more neutral wording if that had legal implications.

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Atro Tossavainen via mailop]

On Tue, May 05, 2020 at 07:48:12AM -0700, Michael Peddemors via mailop wrote:
> Since on the topic of SendGrid..

http://mainsleaze.spambouncer.org/2019-11-to-2020-04-in-spamtraps-esps/

The trends for Salesforce and SendGrid are remarkably upwards...

-- 
Atro Tossavainen, Chairman of the Board
Infinite Mho Oy, Helsinki, Finland
tel. +358-44-5000 600, http://www.infinitemho.fi/

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Michael Peddemors via mailop]

Since on the topic of SendGrid..

Received: from dhl.com (unknown)
by geopod-ismtpd-2-1 (SG) with ESMTP
id yXjQUIVNTmWUp86G27YZTw
for ;
Tue, 05 May 2020 10:02:57.886 + (UTC)
From: DHL Express 
Subject: Shipment Arrival Notice.
Date: Tue, 05 May 2020 10:02:57 + (UTC)
Message-ID: <20200505100257.58c63efbca795...@dhl.com>
MIME-Version: 1.0
X-SG-EID:

=?us-ascii?Q?Fty1fbakBjfkMnPdNSS4UpmkoEOMkDriB8B3kSQUjCzRogyCEiG1y0V8I5N3J4?=
 =?us-ascii?Q?Y=2FMd=2F0SFVzCTWMExjNhU9h6pIlyK51PQJ=2FVJLye?=
 =?us-ascii?Q?RmHv4lJals+LEOvb4dhaYhRi0UPG27bJ=2FJA5mqh?=
 =?us-ascii?Q?VL0Nx9J=2FyaWQ+bIzekwAAGSkhnpeyO+imjI0Cgh?=
 =?us-ascii?Q?r7cfzn2kmMSVsOUIPudnngC0yrk3M=2F80HBjUiIy?=
 =?us-ascii?Q?Wl1Av6MSMteTs=2FjUoR3TVyk006pkGBREAMe4gdV?=
 =?us-ascii?Q?7+1=2F+mc9MUFtHbXdptHbg=3D=3D?=

I don't even think they are trying to stop outbound phishing any more..

This is a little too obvious, and while historically SendGrid ran a 
tight ship, and got a little lee way from spam auditors.. it's getting 
very bad, and going on for too long.. risking loosing any preferential 
treatment..


Overnite..

149.72.1.84 (M)   5   wrqvhkrq.outbound-mail.sendgrid.net
149.72.24.42  2   wrqvkvnx.outbound-mail.sendgrid.net
   149.72.24.51   1   wrqvkvpp.outbound-mail.sendgrid.net
149.72.25.142 7   wrqvkwvz.outbound-mail.sendgrid.net
149.72.43.171 9   wrqvnbxb.outbound-email.sendgrid.net
149.72.58.101 3   wrqvpxsr.outbound-email.sendgrid.net
149.72.63.131   (RS)  3   wrqvpfvp.outbound-email.sendgrid.net
   149.72.63.135 50   wrqvpfvt.outbound-email.sendgrid.net
   149.72.63.193  6   wrqvpfck.outbound-email.sendgrid.net
149.72.134.56   (M)   1   o2.ptr4806.marketing.sg.getweave.com
149.72.146.9(M)   1   wrqvwnhw.outbound-mail.sendgrid.net
149.72.163.1114   wrqvxpsf.outbound-mail.sendgrid.net
149.72.185.2011   wrqvbwcw.outbound-mail.sendgrid.net
149.72.194.2243   o1.sg.intherooms.com
149.72.219.45 6   wrqvdbnd.outbound-mail.sendgrid.net
149.72.224.183  (RS)  2   wrqvzhbt.outbound-mail.sendgrid.net
149.72.226.67 5   wrqvznqp.outbound-mail.sendgrid.net
149.72.227.4 50   wrqvzphq.outbound-mail.sendgrid.net
149.72.243.74 5   wrqvfpqx.outbound-mail.sendgrid.net
   149.72.243.152 1   wrqvfpwv.outbound-mail.sendgrid.net





On 2020-05-05 6:31 a.m., Jaroslaw Rafa via mailop wrote:

Dnia  5.05.2020 o godz. 08:32:43 Michael Orlitzky via mailop pisze:


That message was never retried, even though this page says you'll retry
for 72 hours:

   https://sendgrid.com/docs/glossary/deferrals/

That sample is fresh in my mind, but it's not a unique problem. We do
pre-queue scanning and sometimes you're just gonna get a busy signal.
We'd all love it if you could re-send at least once per the RFC so that
people will stop calling us about lost messages =)


I have also seen previously several times that Sendgrid did not retry.
However, I've also seen cases when Sendgrid did retry properly. I wonder if
it depends on the sender/customer. Maybe they retry when sending messages
for some customers and don't retry when sending for other ones?

Personally I had a slightly different problem with Sendgrid Sometimes when
they retry, they retry immediately (without any noticeable delay), and each
time connect from a different IP address. After only a small number of such
unsuccessful retries, they give up. Again, it happens only for particular
senders and not for others.

Retrying immediately when you get a 4xx makes no sense in my opinion,
because if 4xx response is caused by some issue on the receiving end, you
couldn't expect that the issue will go away immediately once you retry.
Usually it takes some time to resolve the issue, so the sender should
implement reasonable delays between retries.

Using a different IP address for each retry makes it also impossible for the
message to go past greylisting for the recipients who are using it, as
greylisting expects retry from the same IP address as the original attempt
to send the message (also, greylisting expects a reasonable delay before
retry as well). (Please, don't debate now about greylisting itself and
whether it should be used or not. At least it has it's use against botnet
spam).

A few years ago I ran into this issue and it was an important transactional
message, so I try to report it to Sendgrid via some form on their website
(sorry, I don't remember details, quite a long time has passed), but it
seemed evident that the person responding to me didn't know what I'm talking
about and what greylisting is at all - he or she was referring me to
documents on their website that had nothing to do with the issue - so I gave
up.





--
"Catch the Magic 

Re: [mailop] SendGrid Abuse unresponsive

[Atro Tossavainen via mailop]

On Tue, May 05, 2020 at 02:15:07PM +, Andy Smith via mailop wrote:
> Hello,
> 
> On Tue, May 05, 2020 at 06:00:44AM +0300, Atro Tossavainen via mailop wrote:
> > Any chance SendGrid might amend its ticket system so that there would
> > be autoreplies when tickets are created that showed issue numbers
> > connected with the original request
> 
> It would also be great if SendGrid would include an abuse reporting
> URL in the headers of each message, specific to that message, i.e.
> that passes along all info that SendGrid would need to identify that
> campaign/client.

Personally, just the user ID that is in the envelope-from is fine
for me. I usually have spamtrap stuff to report and I am not planning
to click on any links that would reveal the receiving address.

> At present the process is to just forward the mail to
> abuse@sendgrid. It's great that they accept reports that way and I'm
> not suggesting that change, but a lot of the time clicking on one
> link is much faster and less error prone.

For those who don't have a problem with the ESP listwashing on behalf
of the spammy sender, sure.

>   implied that the recipient did not accept SpamCop reports. In fact
>   in that case it was that SpamCop didn't want to send reports to
>   Hetzner. So it is not possible to determine which side made the
>   decision to not allow those reports.

Did I say it yet that Hetzner is worse than useless?

-- 
Atro Tossavainen, Chairman of the Board
Infinite Mho Oy, Helsinki, Finland
tel. +358-44-5000 600, http://www.infinitemho.fi/

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Andy Smith via mailop]

Hello,

On Tue, May 05, 2020 at 06:00:44AM +0300, Atro Tossavainen via mailop wrote:
> Any chance SendGrid might amend its ticket system so that there would
> be autoreplies when tickets are created that showed issue numbers
> connected with the original request

It would also be great if SendGrid would include an abuse reporting
URL in the headers of each message, specific to that message, i.e.
that passes along all info that SendGrid would need to identify that
campaign/client.

Each mail does appear to include an X-SG-ID header which looks like
it might carry that sort of information, so it would be nice if there
could be a link that pre-fills an abuse report for that mail.

At present the process is to just forward the mail to
abuse@sendgrid. It's great that they accept reports that way and I'm
not suggesting that change, but a lot of the time clicking on one
link is much faster and less error prone.

MailChimp and several other ESPs do this, and it can be very
helpful.

And while I am asking for the moon on a stick, I've no idea which
side is refusing to play ball¹ but it is currently not possible to
report SendGrid emails through SpamCop. If it were possible for that
to change that would be lovely.

Cheers,
Andy

¹ There was a thread a while back about Hetzner and SpamCop where I
  had thought that an abuse address being disabled in SpamCop
  implied that the recipient did not accept SpamCop reports. In fact
  in that case it was that SpamCop didn't want to send reports to
  Hetzner. So it is not possible to determine which side made the
  decision to not allow those reports.

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Jaroslaw Rafa via mailop]

Dnia  5.05.2020 o godz. 08:32:43 Michael Orlitzky via mailop pisze:
> 
> That message was never retried, even though this page says you'll retry
> for 72 hours:
> 
>   https://sendgrid.com/docs/glossary/deferrals/
> 
> That sample is fresh in my mind, but it's not a unique problem. We do
> pre-queue scanning and sometimes you're just gonna get a busy signal.
> We'd all love it if you could re-send at least once per the RFC so that
> people will stop calling us about lost messages =)

I have also seen previously several times that Sendgrid did not retry. 
However, I've also seen cases when Sendgrid did retry properly. I wonder if
it depends on the sender/customer. Maybe they retry when sending messages
for some customers and don't retry when sending for other ones?

Personally I had a slightly different problem with Sendgrid Sometimes when
they retry, they retry immediately (without any noticeable delay), and each
time connect from a different IP address. After only a small number of such
unsuccessful retries, they give up. Again, it happens only for particular
senders and not for others.

Retrying immediately when you get a 4xx makes no sense in my opinion,
because if 4xx response is caused by some issue on the receiving end, you
couldn't expect that the issue will go away immediately once you retry.
Usually it takes some time to resolve the issue, so the sender should
implement reasonable delays between retries.

Using a different IP address for each retry makes it also impossible for the
message to go past greylisting for the recipients who are using it, as
greylisting expects retry from the same IP address as the original attempt
to send the message (also, greylisting expects a reasonable delay before
retry as well). (Please, don't debate now about greylisting itself and
whether it should be used or not. At least it has it's use against botnet
spam).

A few years ago I ran into this issue and it was an important transactional
message, so I try to report it to Sendgrid via some form on their website
(sorry, I don't remember details, quite a long time has passed), but it
seemed evident that the person responding to me didn't know what I'm talking
about and what greylisting is at all - he or she was referring me to
documents on their website that had nothing to do with the issue - so I gave
up.
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Michael Orlitzky via mailop]

On 5/4/20 10:49 PM, Will Boyd via mailop wrote:
> Hi Kyle,
> 
> I've located those tickets. It looks like a colleague did reply on
> Wednesday to 4218173 and the reply went to Angelo. I'm not on our abuse
> team but will ping them with both ticket numbers to follow up.
> 

If you'll allow me to hijack this thread while it has some eyeballs...

  Apr 30 15:27:58 mx1 postfix/postscreen[12495]: NOQUEUE: reject: RCPT
  from [198.37.144.39]:25470: 450 4.3.2 Service currently unavailable;
  from=,
  to=, proto=ESMTP,
  helo=

That message was never retried, even though this page says you'll retry
for 72 hours:

  https://sendgrid.com/docs/glossary/deferrals/

That sample is fresh in my mind, but it's not a unique problem. We do
pre-queue scanning and sometimes you're just gonna get a busy signal.
We'd all love it if you could re-send at least once per the RFC so that
people will stop calling us about lost messages =)

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Atro Tossavainen via mailop]

On Mon, May 04, 2020 at 08:49:32PM -0600, Will Boyd via mailop wrote:
> Hi Kyle,
> 
> I've located those tickets. It looks like a colleague did reply on
> Wednesday to 4218173 and the reply went to Angelo. I'm not on our abuse
> team but will ping them with both ticket numbers to follow up.

Thanks Will for picking up.

Any chance SendGrid might amend its ticket system so that there would
be autoreplies when tickets are created that showed issue numbers
connected with the original request, and/or that any further
correspondence would similarly include anything from the initial
conversation? As it stands, I receive "We resolved #78493284309284930"
and I have no way to tell what #78493284309284930 was on.

> 
> Will
> 
> On Mon, May 4, 2020 at 8:20 PM Kyle Thorne via mailop 
> wrote:
> 
> > Hi everyone,
> >
> > Is anyone from SendGrid on-list that can help with an abuse report that
> > has gone unanswered?
> >
> > We have two tickets with SendGrid that have *no response: *4218173 and
> > 4278230.
> >
> > This fraud account is phishing our users, so there's no reason SendGrid
> > shouldn't be able to suspend / ban this account.
> >
> > Anyone available to help with this?
> > [image: VentraIP Australia logo]
> >
> >
> > *Kyle Thorne*Chief Technical Officer \\ VentraIP Australia
> >
> > ___
> > mailop mailing list
> > mailop@mailop.org
> >
> > https://urldefense.com/v3/__https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop__;!!NCc8flgU!PA5pfJG6J5H3bnL4o7HBO_4WtTKIGCsdTv88PJGyiDXQYv4DLPkFQZqSPF0AXGbKgg$
> >
> 
> 
> -- 
> [image: sendgridlogo2.png] 
> Will Boyd
> Sr. Email Deliverability Consultant

> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop


-- 
Atro Tossavainen, Chairman of the Board
Infinite Mho Oy, Helsinki, Finland
tel. +358-44-5000 600, http://www.infinitemho.fi/

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] SendGrid Abuse unresponsive

[Will Boyd via mailop]

Hi Kyle,

I've located those tickets. It looks like a colleague did reply on
Wednesday to 4218173 and the reply went to Angelo. I'm not on our abuse
team but will ping them with both ticket numbers to follow up.

Will

On Mon, May 4, 2020 at 8:20 PM Kyle Thorne via mailop 
wrote:

> Hi everyone,
>
> Is anyone from SendGrid on-list that can help with an abuse report that
> has gone unanswered?
>
> We have two tickets with SendGrid that have *no response: *4218173 and
> 4278230.
>
> This fraud account is phishing our users, so there's no reason SendGrid
> shouldn't be able to suspend / ban this account.
>
> Anyone available to help with this?
> [image: VentraIP Australia logo]
>
>
> *Kyle Thorne*Chief Technical Officer \\ VentraIP Australia
>
> ___
> mailop mailing list
> mailop@mailop.org
>
> https://urldefense.com/v3/__https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop__;!!NCc8flgU!PA5pfJG6J5H3bnL4o7HBO_4WtTKIGCsdTv88PJGyiDXQYv4DLPkFQZqSPF0AXGbKgg$
>


-- 
[image: sendgridlogo2.png] 
Will Boyd
Sr. Email Deliverability Consultant
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop