After making many adjustments to SPF and DKIM I dont understand where and why we would be getting blcoked. Please advise.

Original Message Headers

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=talonstorage.com;

 s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version;

 bh=Scv7lGvXULtgLjKinYwOxNG7B6yEwLM5eHUF+wiN7pM=;

 b=Hin/KTUS23cEMzT2EUJIY82XTUNOs0J37Ac78gE8RIS0Eo0Irthcid8P1D6oQxsHy0b28td3rvwcfFH4zBNokMOCwmWu0gltQ2pB68rR3RUbHCQAZE+Xr7X8NBjNgMDvXOcWb7tNEuxbTycQVUPgOCX5RY9QDtki2VMQpHTsngk=

Received: from CY4PR17MB0998.namprd17.prod.outlook.com (10.173.181.8) by

 CY4PR17MB0997.namprd17.prod.outlook.com (10.173.181.7) with Microsoft SMTP

 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id

 15.1.991.14; Tue, 28 Mar 2017 10:12:06 +0000

Received: from CY4PR17MB0998.namprd17.prod.outlook.com ([10.173.181.8]) by

 CY4PR17MB0998.namprd17.prod.outlook.com ([10.173.181.8]) with mapi id

 15.01.0991.020; Tue, 28 Mar 2017 10:12:06 +0000

Subject: RE: [Request ID :##711742000007169003##] :Core Update Issue

Thread-Topic: [Request ID :##711742000007169003##] :Core Update Issue

Thread-Index: AQHSp6XdT+YpUP8a/kO1FsnuusiKRKGqB49w

Date: Tue, 28 Mar 2017 10:12:06 +0000

Message-ID: <CY4PR17MB09983CDB716842ABFD5DA183A0320@CY4PR17MB0998.namprd17.prod.outlook.com>

Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-originating-ip: [2601:88:8101:100:2c89:5715:86da:5369]

x-microsoft-exchange-diagnostics: 1;CY4PR17MB0997;7:hIFs6jRwQvStp/JHRN9P8mMJtkka/x7tY/qg0EnwQwz2C4eEO5qXgMz58qVqweh5lO689tNCQXIKLI0OgYCfT5q6VOQnK/XdQa143JSsuQ3tvoOwnCQpkN237iclLqurKv8HflLTiwSWoHLbgw8g7f2Kpkec0Y0IQf2S5jDYeHXf5/lldQJ7V3FJMdF6EZ6LUZ2H7CS7vkLdVHPRfL+wciZtpIQaU+QED5J4pb9s/HcnZzN29kPYlXNrKChj2qTbPLZZ5+++iSTadK+SE0mFKtMa6MWi103/Y7z8NwX0BArgJinIgQ2CzBJCYk36sOF7ozVLMbJqbNi8321ProwMyg==

x-ld-processed: 9f4be20c-e356-464f-a317-e08c66b54afd,ExtAddr

x-ms-office365-filtering-correlation-id: ad33faf3-02ba-4c3c-f234-08d475c2e344

x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(2017030254075)(201703131423059)(201703031133065)(201702281549059);SRVR:CY4PR17MB0997;

x-microsoft-antispam-prvs: <CY4PR17MB0997404E5528DBFEE54B5966A0320@CY4PR17MB0997.namprd17.prod.outlook.com>

x-exchange-antispam-report-test: UriScan:(61668805478150)(192374486261705)(82924173822182)(21748063052155)(245836752223355);

x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(6040433)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6041248)(201703131423058)(201702281528058)(201703061421058)(201703061406058)(20161123562025)(20161123555025)(20161123558025)(20161123560025)(20161123564025)(6072148);SRVR:CY4PR17MB0997;BCL:0;PCL:0;RULEID:;SRVR:CY4PR17MB0997;

x-forefront-prvs: 0260457E99

x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(39410400002)(39830400002)(39450400003)(39400400002)(377454003)(10710500007)(6116002)(2906002)(86362001)(5630700001)(15650500001)(102836003)(2351001)(790700001)(53936002)(6506006)(6436002)(77096006)(4326008)(110136004)(5660300001)(189998001)(3660700001)(81166006)(2420400007)(53546009)(25786009)(7110500001)(3280700002)(38730400002)(8676002)(8936002)(99286003)(76176999)(7906003)(54356999)(6246003)(50986999)(74316002)(7736002)(2900100001)(33656002)(6306002)(54896002)(236005)(5640700003)(606005)(54906002)(2950100002)(6916009)(55016002)(2501003)(122556002)(229853002)(7696004)(9686003);DIR:OUT;SFP:1102;SCL:1;SRVR:CY4PR17MB0997;H:CY4PR17MB0998.namprd17.prod.outlook.com;FPR:;SPF:None;MLV:ovrnspm;PTR:InfoNoRecords;LANG:en;

spamdiagnosticoutput: 1:99

spamdiagnosticmetadata: NSPM

Content-Type: multipart/alternative;

        boundary="_000_CY4PR17MB09983CDB716842ABFD5DA183A0320CY4PR17MB0998namp_"

MIME-Version: 1.0

X-OriginatorOrg: talonstorage.com

X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Mar 2017 10:12:06.0982

 (UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 9f4be20c-e356-464f-a317-e08c66b54afd

X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR17MB0997

Hi,

We have one customer who is unable to send mails to us.  If they use a different domain, with a different mailserver and public IP, mail works fine.

I cannot see any mails in the portal which are being blocked and I have whiltelisted the senders domain, although I dont think in this case that will have any effect.

The logs I have received from the sending server are:

2017-03-23 15:12:31 1cr4Pf-001dOF-78 <= xyz@domain.co.uk H=(whuk101.redbackinternet.net) [127.0.0.1]:46795 I=[127.0.0.1]:25 P=esmtpa A=dovecot_login:xyz@domain.co.uk S=631 id=7cd01d794fbf0f59926f459a82a9cc00@domain.co.uk T="test" from <xyz@domain.co.uk> for user.name@recipientdomain.co.uk
2017-03-23 15:12:33 1cr4Pf-001dOF-78 H=cluster5a.eu.messagelabs.com [216.82.251.230]: SMTP error from remote mail server after RCPT TO:<user.name@recipientdomain.co.uk>: 421 Service Temporarily Unavailable
2017-03-23 15:12:33 1cr4Pf-001dOF-78 == user.name@recipientdomain.co.uk<user.name@recipientdomain.co.uk> R=dkim_lookuphost T=dkim_remote_smtp defer (-44) H=cluster5a.eu.messagelabs.com [216.82.251.230]: SMTP error from remote mail server after RCPT TO:<user.name@recipientdomain.co.uk>: 421 Service Temporarily Unavailable

You can see 421 Service Temporarily Unavailable.  No other customers are reporting this error, I have checked to see if the senders IP has been blacklisted and it doesnt look like it has (109.203.103.150).

How do we get this resolved?  Any help would be appreciated.  As a side note, cluster5a.eu.messagelabs.com is our secondary MX record and not primary - I find it a little strange that secondary is being used, as it has a higher weight.

Thanks,

Daniel

Hi,

Emails sent from our server to customers who use messagelabs are accepted by the messagelabs server, but never delivered.  This is really dangerous, if an email is not delivered the sending server should be notified of the reason why so the sender knows the message was not recieved.

Here's an example log entry:

2017-03-28 13:11:37 1cspyL-003Zy1-Qc <= sender@domain.co.uk H=mail-pg0-f45.google.com [74.125.83.45] P=esmtpsa X=TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no A=plain:sender@domain.co.uk S=4245 id=CADHKSS7LTgDYFzMo8+OeWdiu8D4j1p3RMoSCF2KhCT3W_ihkaw@mail.gmail.com T="Test" from <sender@domain.co.uk> for recipient@depaulcharity.org.uk

2017-03-28 13:11:38 1cspyL-003Zy1-Qc => recipient@depaulcharity.org.uk<recipient@depaulcharity.org.uk> F=<sender@domain.co.uk> R=lookuphost T=remote_smtp S=4368 H=cluster8.eu.messagelabs.com [85.158.139.19] X=TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256 CV=yes C="250 ok 1490703098 qp 31506 server-6.tower-178.messagelabs.com!1490703098!83424282!1"

I've checked at http://ipremoval.sms.symantec.com/lookup/ and I'm seeing the following message:

The IP address 164.132.254.220 was found to have a negative reputation. Reasons for this assessment include:

• The host has been observed sending spam in a format that is similar to snow shoe spamming techniques.

Our server is not on any blacklists and has a good reputation with Cyren (http://www.cyren.com/ip-reputation-check.html) and Cisco Senderbase (http://www.senderbase.org/lookup/?search_string=16...).

Please provide us with more information so we can resolve this situation asap.  This is costing us and our clients money!

Good morning,

Our corporate email server (IP 95.141.47.150) is being blocked by your network. Going to http://ipremoval.sms.symantec.com/lookup/ helps just for some days and then it's blocked again. The server is clean, clients are AV protected, domains hosted are provided with SPF in dns to legitimate relays. Can you help me find out which is the root cause? 

thank you,

best regards,

Michele Baresi

Hi,

We appear to be having some issues with some customers starting a day ago.  They could be different customers, but we get the same response.

We go through mimecats to send and receive our email.  I have checked some of their ip addresses for IP investigation, but they come back clean.

This is the bounce back;

---------------------------------------------------------------------------------------------------

This is a delivery failure notification message indicating that
an email you addressed to email address :
-- eddie.dougherty@lottechemical.co.uk

could not be delivered. The problem appears to be :
-- Recipient email server rejected the message

Additional information follows :
-- Message filtered. Refer to the Troubleshooting page at
http://www.symanteccloud.com/troubleshooting for more
information. (#5.7.1)

This condition occurred after 1 attempt(s) to deliver over
a period of 0 hour(s).

If you sent the email to multiple recipients, you will receive one
of these messages for each one which failed delivery, otherwise
they have been sent.

---------------------------------------------------------------------------------------------------

I have searched high and low for #5.7.1 and -- Recipient email server rejected the message, but cannot find anything.

The customers do not believe it is their end, but as the message states, its the recipients end.

Thank you for any help.

Regards.

Garry.

Dears,

Our SMG showing the belwo message when we try to send emails to any MX *.messagelabs.com domain:

553-message filtered. refer to the troubleshooting page at\r\n553-http://www.symanteccloud.com/troubleshooting for more\r\n553 information. (#5.7.1)

Our domain is alhamrani.net

Thank you.

Fahad

Hello,

I am writting in regards to an issue that has been ongoing for a while with our cloud server solution and we haven't been able to find any error on our side.

To shed some light on the situation we have an IP range of 185.119.216.0/22, currently we have the range of 185.119.216.0/24 in production on our cloud server providing mail server solution to our customer. Our customers complain almost every day that they cannot deliver emails to certain recipients - customers using symantec blacklist. Every day we have to delist a certain IP from this range from your website http://ipremoval.sms.symantec.com/lookup/ in order for our customers to be able to reach users of your product.

My question is why is it being blocked and if there is anything we can do on our end? Can you do something on your end? I tried contacting your support yet we had no proper response since we don't use your product and we were refused to be transferred to anyone from technical support. The only response we got was to contact our customers to contact their customers to whitelist their domains. As a system administrator I have a rhetorical question - what is this solution? It does not make sense in any sense of system administration, that would actually mean asking our customers to send emails to thousands and maybe hundred thousand or even milion emails addresses (thus resulting in even more spam) and ask them to whitelist them? Even potential clients that could be using your product? Such solution is unacceptable.

I just read another post about similar issue (we don't seem to be the only ones having this issue with your blacklist and exactly the same problem). We acquired this IP range from USA and I believe (based on some previous posts) that this could be an issue with historical bad repution of this IP range? Can you confirm this please? If that is the case and we provide information about acquisition of this IP range at some point, will you be able to reset some kind of threshold for what is spam and what not? We have system monitoring on spams therefore there should be the least amount of spam, maybe none at all.

I would deeply appreciate your collaboration on this because it is severely affecting our business and your "technical support" was not helpful at all. We need a system solution or information on what has to be done in order to avoid this except for whitelisting all of our domains throughout the whole world on every possible domain.

Please let me know if you need any additional information to investigate this issue.
 

Best Regards,

Marek Puverle

Icewarp Mail Server Administrator

Hola. Tengo un servidor dedicado alojado en miami con el que me encargo de darle a las empresas que administró todos los servicios necesarios. Email, web, base de datos, etc

Tengo un problema que ellos quieren mandar un email a unos de sus clientes y el servidor dice que la conexión fallo al conectar con la IP. Investigando encontré que ellos tienen la seguridad de los emails con ustedes y que todos los rango de IP de mi dedicados están como reputación negativa en sus servidores.. a lo mejor por eso no puedo concretar el envío.

Cuando desde el servidor de emails hago una prueba a mail92.messagelabs.com por puerto 25 me dice que la conexión fue rechazada..

Verifique mis IPS en sus buscador de reputación y dicen que es negativa y yo tengo todos los estándares de seguridad Dkim dmarc spf.

Mi rango de IP es del 103.195.100.17 al 22

Pero el que uso ahora es el 103.195.100.18

Se podrá solucionar el problema ya que mi empresa no puede mandar mails a la otra por este bloqueo..
Desde ya muchas gracias

Hello!

I'm currently experiencing the situation that the IP of one of my servers gets on your blacklist again and again. (that means that I place an investigation request and a few hours to days later the IP is removed and all queued mail get sent)

Again a few days later the mails are being blocked again and the server's IP is reported as "The host has been observed sending spam in a format that is similar to snow shoe spamming techniques."

Yesterday I again submitted a removal request, but this time it was not processed until now:

The IP address 62.75.169.191 has already been submitted for investigation

As I don't have any clue why the IP gets on the blacklist again, please advice what I can do to prevent that.
(the IP is not reported on any other blacklist)

Thanks in advance!

Best regards,

Daniel JM

Hi

from few weeks my shared mail server ip as bad reputation.
I monitor daily the server status and is ok and clean.
the ip of the server is  [37.59.49.128].

I send many request of investigation every 2 day and the early times your remove the ip from bad reputation list but the last times is in investigation from 5 days.
please help me.
 

About 5 days ago I requested to investigate my email server (IP 212.83.136.185)
but you keep listing us as "bad reputation". We check every day all inbound and outbound emails to stay out of malicious or junk email. We have checked several DNS black lists and the ip is not listed there.

Please con you take a look at this issue?

Thank you.
Ferran M.

Hello,

A client using my server for emails is having issues sending emails to a client using your service. The errors are:

2017-04-05 19:42:04 1cvpc4-000YoU-Td H=cluster1a.us.messagelabs.com [85.158.139.103]: SMTP error from remote mail server after RCPT TO:<ganesh.shankar@sita.in>: 421 Service Temporarily Unavailable
2017-04-05 19:42:04 1cvpc4-000YoU-Td == ganesh.shankar@sita.in R=dkim_lookuphost T=dkim_remote_smtp defer (-44) H=cluster1a.us.messagelabs.com [85.158.139.103]: SMTP error from remote mail server after RCPT TO:<ganesh.shankar@sita.in>: 421 Service Temporarily Unavailable
2017-04-05 19:42:04 1cvpc4-000YoU-Td == anurag.tiwari@sita.in R=dkim_lookuphost T=dkim_remote_smtp defer (-18) H=cluster1a.us.messagelabs.com [85.158.139.103]: Remote host closed connection in response to pipelined RCPT TO:<anurag.tiwari@sita.in>

SMTP error from remote mail server after RCPT TO:<ganesh.shankar@sita.in>: 421 Service Temporarily Unavailable

Can you see if our IP or their ISP IP has been temporarily blacklisted or why their emails are not getting through please??
server address is 80.172.253.133 and 80.172.253.139. 

Sender IP:

62.28.231.222

If it is temporary like your error sugests how long will it take to heal itself?
Thanks in advance for any help/advice it would be much appreciated.

Kind Regards

Mark

Hello,

my smtp server (IP 91.220.44.4) can't send messages to one of our client because:

(lost connection with cluster8.us.messagelabs.com[216.82.251.37] while sending message body).

Plase help me.

Best Regards

Marek

Dear sirs

Our mail server 212.129.54.20 listed in your blacklist with a bad reputation. Each day for a couple od weeks I request an investigation at http://ipremoval.sms.symantec.com/lookup/ and the problem isn't resolved yet.This issue is costing to our company a lot of problems with our customer using Symantec mail security and so rejecting our emails.
Our server is used for regular emails and never used to send spams or illigal emails. Our mail server is not listed in any worldwide blacklist but yours. There is no spam coming out from our mail server, there is no virus on our mail server.

Please help me to solve this problem ?

Regards
Mohamed

Dear Sir,

We're using Postfix on a Linux server to send emails via SMTP. Emails are relayed from our server. 
Most emails reach their destination fine, however certain addresses never receive our emails. When I check the mailq I see the following:

Apr 6 04:25:30 srv postfix/smtp[16320]: connect tocluster1.us.messagelabs.com[216.82.249.179]:25: Connection timed out
Apr 6 04:25:30 srv postfix/smtp[16320]: 8271142813674: to=<abc@domain.com>, relay=none, delay=21560, delays=21410/0.02/150/0, dsn=4.4.1, status=deferred (connect to cluster1.us.messagelabs.com[216.82.249.179]:25: Connection timed out)
Apr 6 04:33:30 srv postfix/smtp[16856]: connect tocluster14.us.messagelabs.com[216.82.241.197]:25: Connection timed out
Apr 6 04:33:30 srv postfix/smtp[16857]: connect tocluster14.us.messagelabs.com[216.82.241.197]:25: Connection timed out
Apr 6 04:34:00 srv postfix/smtp[16856]: connect tocluster14.us.messagelabs.com[216.82.248.67]:25: Connection timed out
Apr 6 04:34:00 srv postfix/smtp[16857]: connect tocluster14.us.messagelabs.com[216.82.248.67]:25: Connection timed out
Apr 6 04:34:30 srv postfix/smtp[16856]: connect tocluster14.us.messagelabs.com[216.82.248.67]:25: Connection timed out
Apr 6 04:34:30 srv postfix/smtp[16857]: connect tocluster14.us.messagelabs.com[216.82.241.197]:25: Connection timed out
Apr 6 04:35:00 srv postfix/smtp[16856]: connect tocluster14.us.messagelabs.com[216.82.241.197]:25: Connection timed out
Apr 6 04:35:00 srv postfix/smtp[16857]: connect tocluster14.us.messagelabs.com[216.82.248.67]:25: Connection timed out
Apr 6 04:35:31 srv postfix/smtp[16856]: connect tocluster14.us.messagelabs.com[216.82.248.67]:25: Connection timed out

I have checked the blacklists on mxlookup.com and our domain has all green ticks (nobody is blacklisting us). 
Also I have checked our IP address here: http://ipremoval.sms.symantec.com/lookup/ and it says The IP address you submitted, xxx.xxx.xxx.xxx, does not have a negative reputation and therefore cannot be submitted for investigation.

I can give you our IP or hostname in a private message if you need it.

Kindly helps us to resolve this issue.

Regards
Mahadev

Hello,

We have put in several requests for removal of our IP from having been blocked for email to customers of yours. We had an outbreak that was corrected and the issue resolved and have been removed off all other blacklists but yours. Please de-list us. Our IP is 50.200.60.78 Thank you!

Hello,

A client is having issues sending emails to a client using your service. The errors are:

Last Error: 421 Service Temporarily Unavailable

Can you see if their IP has been temporarily blacklisted or let me know why their emails are not getting through?
Their email server's IP address is 172.126.72.233. 

If it is temporary like your error sugests how long will it take to heal itself?

Thanks in advance for any help/advice it would be much appreciated.

Sincerely,

Dean

Hello,

I noticed last week that we were not able to get any emails from one of our companies servers IP addresses 91.109.242.124

I raised the IP address in the http://investigate.brightmail.com/lookup/ on the 4th April and it is still under investigation. This is severely impacting our workstream and other than this forum, there was no where to chase for an update. There is also the fear that it could get flagged again. 

The IP is not reported as being bad on any other blacklist, please advise how we can remove it from the blaclist asap and ensure it is kept off

Thanks in advance

Shauna

Hello,

unfortunately we have two IP addresses used by our customers blocked by Symantec BL. Those are normal and uncompromised servers. I would like to ask for removal of such IPs from your BL.

Affected IPs:

31.187.78.51
31.187.78.53

​As said, those are uncompromised mail servers. If there is a specific reason why they are listed, please do let us know.

Evidence:

Failed Recipient: [edited]@tin.it
Reason: Remote host said: 550 mail not accepted from blacklisted IP address
[31.187.78.51]

-- The header and top 20 lines of the message follows --

Received: from PALUMBO (host50-180-static.21-80-b.business.telecomitalia.it
[80.21.180.50]) by mail.saframotor.it with SMTP;
Fri, 31 Mar 2017 10:33:45 +0200
Message-ID:
From:
To:
Subject: prova
Date: Fri, 31 Mar 2017 10:48:07 +0200
MIME-Version: 1.0
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0023_01D2AA0C.481CC460"
X-Priority: 3
X-MSMail-Priority: Normal
Importance: Normal
X-Mailer: Microsoft Windows Live Mail 16.4.3528.331
Disposition-Notification-To:
X-MimeOLE: Produced By Microsoft MimeOLE V16.4.3528.331

AND

Could not deliver message to the following recipient(s):

Failed Recipient: [edited]@tin.it
Reason: Remote host said: 550 mail not accepted from blacklisted IP
address [31.187.78.53]

-- The header and top 20 lines of the message follows --

Received: from UtentePC (net-5-89-41-74.cust.vodafonedsl.it [5.89.41.74])
by mail1.craftybit.it with SMTP;
Thu, 6 Apr 2017 10:08:00 +0200
From: "HozonLift"<[edited]@hozonlift.it>
To: <[edited]@tin.it>
Subject: msg di prova
Date: Thu, 6 Apr 2017 10:19:32 +0200
Message-ID: <004901d2aeae$854d64b0$8fe82e10$@hozonlift.it>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_004A_01D2AEBF.48D634B0"
X-Mailer: Microsoft Outlook 15.0
Thread-Index: AdKuroUIzKJIfn9FQmG/tKfzCjYF1w==
Content-Language: it

please, let us know if we need to provide more evidence.

Best regards,
VaiSulWeb Support Team

Hello,

We have an IP that has been submitted for investigation over 14 days now, without any updates.

##########################

##########################

This IP  was blacklisted as a result of compromised and spamming users found on our network. The spamming was addressed shortly after we discovered the abuse and is currently still blacklisted. Our team has attempted to use the various IP reputation lookup tools after requesting delisting, but to no avail.

Please assist us in either removing the blacklist against this IP or providing additional information that may help us resolve this issue.

Thank you.