For the last 5 weeks or so, we've had an issue where email to several different domains did not arrive at the recipient address, and did not generate an NDR.
It took us a while to pin the issue down, but the only common feature was the domains this was happening with were all MessageLabs customers:
We've done extensive testing at our end: We've checked our Mail Domain (Stockvale.co.uk) Email server IP's (Main: 81.137.233.190& Backup: 88.97.35.149), and upstream mail relay (78.137.116.48) are not on any blacklists using http://mxtoolbox.com, setup as Open relays using http://www.mailradar.com/openrelay/, have a valid SPF Record at http://www.kitterman.com/spf/validate.html, not listed on the Symantec lookup tool at http://ipremoval.sms.symantec.com/lookup, and setup full reverse DNS names and DKIM Records, which we didn't previously have. None of this fixed the issue
Tracking the following domains we can see they all:
- Are MessageLabs customers
- The Cluster servers accepted the email
- The recipient never received the email
- The sender never received a Non Delivery Report (NDR)
claritytm.co.uk
aviva.com
essentra.com
ibs-systems.co.uk
prsformusic.com
ensgroup.co.uk
ima.org.uk
All other domains are receiving our email fine, including Barracuda and office365 clients.
Tracking through our relay, we can see the MessageLabs servers accepting the email:
Jun 6 11:01:45 webserver postfix/smtp[1624]: 72E2181253: to=<[****]@aviva.com>, relay=cluster8.eu.messagelabs.com[85.158.137.19]:25, delay=0.79, delays=0.15/0/0.29/0.34, dsn=2.0.0, status=sent (250 ok 1496743305 qp 3184 server-6.tower-39.messagelabs.com!1496743304!98273900!1)
Jun 6 17:03:25 webserver postfix/smtp[13408]: 9F6E481266: to=<[****]@essentra.com>, relay=cluster3.eu.messagelabs.com[194.106.220.35]:25, delay=0.59, delays=0.11/0/0.25/0.23, dsn=2.0.0, status=sent (250 ok 1496765005 qp 16145 server-14.tower-91.messagelabs.com!1496765004!28796128!1)
Jun 6 17:04:29 webserver postfix/smtp[13408]: 55E2781262: to=<[****]@ibs-systems.co.uk>, relay=cluster3.eu.messagelabs.com[85.158.137.83]:25, delay=0.91, delays=0.1/0/0.43/0.38, dsn=2.0.0, status=sent (250 ok 1496765069 qp 3187 server-15.tower-140.messagelabs.com!1496765068!83241465!1)
Jun 6 17:06:23 webserver postfix/smtp[13326]: BA15C81262: to=<[****]@prsformusic.com>, relay=cluster3.eu.messagelabs.com[85.158.136.35]:25, delay=0.66, delays=0.11/0/0.26/0.29, dsn=2.0.0, status=sent (250 ok 1496765183 qp 9135 server-4.tower-125.messagelabs.com!1496765182!79490357!1)
Jun 6 17:07:14 webserver postfix/smtp[13326]: AE27481262: to=<[****]@ensgroup.co.uk>, relay=cluster8.eu.messagelabs.com[85.158.137.19]:25, delay=0.7, delays=0.1/0/0.24/0.36, dsn=2.0.0, status=sent (250 ok 1496765234 qp 25118 server-12.tower-39.messagelabs.com!1496765233!98217780!1)
We are friendly with another MessageLabs customer, rickardluckin.co.uk, who were also having the issue: They opened up a case in their Symantec portal (Reference ref:_00D30jPy._50038rHwPj:ref)
This is the reply they got back from support:
"MessageLabs have come back stating that this is a false positive on their spam systems. Although I have added in the exceptions it would be a good idea to get this resolved correctly. Please can you get a copy of the emails in .MSG format for me I can supply the mail to MessageLabs and they can remove the false positive from the antispam services."
We got the .eml/.msg mails sent over, but they've not had an update on the case, and have limited time to chase on our behalf for a resolution, hence me posting here.
At the moment, rickardluckin.co.uk is the only MessageLabs customer stockvale.co.uk can email, thanks to them explicitly whitelisting us.
Could a member of the Symantec support team:
- Check on this issue, either on its own, or as part of ref:_00D30jPy._50038rHwPj:ref
- Confirm the block is removed so we can test with customers other than rickardluckin.co.uk
- Let us know if this was a genuine false positive on Symantec's end, or if there are any changes/improvements we need to make at our end to improve email reliability to MessageLabs customers
Many thanks.
