Hello,

I can't send any messages to recipients who use messagelabs email service.

My email server send.solutions is at this IP address: 37.59.175.64

I get this error message everytime I try: host cluster1.eu.messagelabs.com[195.245.230.83] refused to talk to me: 501 Connection rejected by policy [7.7] 20805, please visit www.messagelabs.com/support for more details about this error message.

Is it possible to remove this IP address from the blacklist ?

Our server is being bloqued with these message

messagelabs.com 3114 connection rejected by policy

Can you check an delist our IP's? 

Our IP's are: 217.182.108.123 and 145.239.113.17

It's a new mail server with an outbound antispam protection filter. So we are not sending spam.

Many thaks

Oscar

Hello,

Just wanna share the tool I built and since MessageLabs doesn't have an API. It automates Track and Trace so you can enter multiple parameters, e.g., list of senders, subjects or recipients and in any combination you want. I often hit "Too many search results" error when specifying *@mydomain.com. Specifying individual addresses solves the problem but the web GUI doesn't allow you to do that. 

I'm still working packaging it into a library but in the meantime, here's what's in the tool's help menu:

>python trackntrace.py -h
usage: trackntrace.py [-h] [-S QUERY_SUBJECT [QUERY_SUBJECT ...]]
                      [-s SENDER [SENDER ...]] [-r RECIPIENT [RECIPIENT ...]]
                      [-l LAST_HOP [LAST_HOP ...]] [-d [DAYS]] [-H [HOURS]]
                      [-M [MIN_DATE]] [-X [MAX_DATE]] [-o [OUTPUT]]

A program that uses Track and Trace feature of SymantecCloud Messagelabs to
locate emails.

optional arguments:
  -h, --help            show this help message and exit
  -S QUERY_SUBJECT [QUERY_SUBJECT ...], --query-subject QUERY_SUBJECT [QUERY_SUBJECT ...]
                        Specifies the email subject(s) to search for. Input
                        file is accepted.
  -s SENDER [SENDER ...], --sender SENDER [SENDER ...]
                        Retrieve all emails sent by this sender(s). Input file
                        is accepted.
  -r RECIPIENT [RECIPIENT ...], --recipient RECIPIENT [RECIPIENT ...]
                        Search all emails sent to this address(es). Input file
                        is accepted.
  -l LAST_HOP [LAST_HOP ...], --last-hop LAST_HOP [LAST_HOP ...]
                        Look for all emails that were sent by this IP
                        address(es). Input file is accepted.
  -d [DAYS], --days [DAYS]
                        No. of days prior to search for.
  -H [HOURS], --hours [HOURS]
                        No. of hours prior to search for.
  -M [MIN_DATE], --min-date [MIN_DATE]
                        Find all emails sent starting from this date. Date
                        format: Y-m-d_I:Mp. Example: 2017-07-25_02:43am
  -X [MAX_DATE], --max-date [MAX_DATE]
                        Find all emails sent up to this date. Date format:
                        Y-m-d_I:Mp. Example: 2017-07-25_08:20am
  -o [OUTPUT], --output [OUTPUT]
                        Where to write output report. Defaults to
                        trackandtrace_result.csv.

EXAMPLE: Search MessageLabs for emails sent to some users with a certain
subject over the last 5 days: "> python trackntrace.py -d 5 -S "Your Invoice
is Ready" -r user1@yourdomain.com user2@yourdomain.com

Hi,

We are also having the exact same issue as this person in another recent post.

"emails not getting to messagelabs clients; recieved with 250, no NDR"

https://www.symantec.com/connect/forums/emails-not...

e-mails from our domain marks-clerk.com are being accepted by the messagelabs mail servers, but not forwarded onto the customer/client no NDR's are being generated. This has been happening for the last 3-4 weeks.

Alot of important e-mails are not being delivered, but we can see successful delivery to the mesagelabs servers from our tracking system, we utilise Mimecast.

Our mail server IP's are

91.208.124.105

91.208.124.104

This only appears to be happening with customers of Messagelabs.

Can someone please assist?

Hi,

I have a problem with our new email-servers and cluster*.eu.messagelabs.com as remote server.

Sending emails results in: 2017-07-29 15:40:54 H=cluster5a.eu.messagelabs.com [216.82.251.230] Operation timed out

Our Server are new and the IPs are not on an blacklists. Searching on google directed me to this forum. So please can you help me to whitelist or remove our servers from any blackllst.

These IPs are used by our servers:

- 138.201.149.13

- 138.201.149.19

- 138.201.59.104

- 138.201.59.105

We are not sending spam, but I have about 70 legal mails in queue with timeouts from the messagelab-servers.

If there is an other website for this request, please tell me the link to it.

Thank you very much.

Best regards

We’re excited to announce New Impersonation Controls and Advanced Email Security Analytics that now include insights into both clean and malicious emails in Symantec Cloud Email Security (the Symantec solution that includes Email Security.cloud and ATP:Email). These new capabilities provide the strongest protection against Business Email Compromise and the deepest visibility into targeted email attacks. The New Impersonation Controls are available today in Email Security.cloud and the Advanced Email Security Analytics will be available in ATP:Email later this quarter. For more information on these new capabilities:

• Read the launch announcement
• Read the Impersonation Controls announcement
• Watch a video on our Business Email Compromise solution
• Join our webcast on August 30
• Visit the Symantec Email Security.cloud page

Nirav Shah
Manager, Product & GTM Strategy, Symantec

Hello,

Been looking for ways on how to programatically get our email logs from messagelabs. Seems there's no API available. Or is there?

Just wanna share the tool I built and since MessageLabs doesn't appear to have an API. It automates Track and Trace so you can enter multiple parameters, e.g., list of senders, subjects or recipients and in any combination you want. I often hit "Too many search results" error when specifying *@mydomain.com. Specifying individual addresses solves the problem but the web GUI doesn't allow you to do that. http://infosecscripts.org/trackntrace.html

Hi,

One of my customers is having trouble emailing a supplier who's email is being filtered by MessageLabs.

The sender receives no NDR but the receipent never receives the email.

I've done a blocklist lookup on the senders IP address 82.70.102.70 and they are not listed anywhere.

Please advise how we can get to the bottom of this issue?

Hello support,

I've noticed that probably your servers blocking connections from our servers. Our clients can not send messages to email accounts in domains supported by you. I was trying initiate connection on port 25 but every time is refused or timeout.

IP : 213.184.28.29

telnet -b 213.184.28.29 cluster8.eu.messagelabs.com
Trying 85.158.137.99...
telnet: connect to address 85.158.137.99: Connection refused
Trying 85.158.140.211...
telnet: connect to address 85.158.140.211: Connection refused
Trying 85.158.139.35...
telnet: connect to address 85.158.139.35: Connection refused
Trying 85.158.137.3...
telnet: connect to address 85.158.137.3: Connection refused
Trying 85.158.140.195...
telnet: connect to address 85.158.140.195: Connection refused
Trying 85.158.139.51...
telnet: connect to address 85.158.139.51: Connection refused
Trying 85.158.137.19...
telnet: connect to address 85.158.137.19: Connection refused
Trying 85.158.139.19...
telnet: connect to address 85.158.139.19: Connection refused
 

IP 213.184.31.73

telnet -b 213.184.31.73 cluster8a.eu.messagelabs.com 25
Trying 85.158.139.103...
telnet: connect to address 85.158.139.103: Connection timed out
Trying 216.82.251.230...
telnet: connect to address 216.82.251.230: Connection timed out

IP : 213.184.28.39

telnet -b 213.184.28.39 cluster8.eu.messagelabs.com
Trying 85.158.139.19...
telnet: connect to address 85.158.139.19: Connection refused
Trying 85.158.137.19...
telnet: connect to address 85.158.137.19: Connection refused
Trying 85.158.139.51...
telnet: connect to address 85.158.139.51: Connection refused
Trying 85.158.140.195...
telnet: connect to address 85.158.140.195: Connection refused
Trying 85.158.137.3...
telnet: connect to address 85.158.137.3: Connection refused
Trying 85.158.139.35...
telnet: connect to address 85.158.139.35: Connection refused
Trying 85.158.140.211...
telnet: connect to address 85.158.140.211: Connection refused
Trying 85.158.137.99...
telnet: connect to address 85.158.137.99: Connection refused

IP : 213.184.31.91

telnet -b 213.184.31.91 cluster8.eu.messagelabs.com
Trying 85.158.137.99...
telnet: connect to address 85.158.137.99: Connection refused
Trying 85.158.139.19...
telnet: connect to address 85.158.139.19: Connection refused
Trying 85.158.137.19...
telnet: connect to address 85.158.137.19: Connection refused
Trying 85.158.139.51...
telnet: connect to address 85.158.139.51: Connection refused
Trying 85.158.140.195...
telnet: connect to address 85.158.140.195: Connection refused
Trying 85.158.137.3...
telnet: connect to address 85.158.137.3: Connection refused
Trying 85.158.139.35...
telnet: connect to address 85.158.139.35: Connection refused
Trying 85.158.140.211...
telnet: connect to address 85.158.140.211: Connection refused

Could you check and unblock out IPs ?

Kind regards

Andrzej Zielinski

Hi Tech Support

Can you please look into this situation as we are getting emails being rejected from one domain - www.digway.co.uk and the emails relating to them. The only emails being rejected are the ones that Symantec is monitoring. No other domain is affected.

We have been in continual contact with tmdhosting.com who we have used for a couple of years without any problems until this 501 Connection Error.

We have been informed that the ISP is not on a blacklist and we can guarantee that there is no spam / junk mail being sent by our client.

OUR IP IS 198.20.127.153

Please see full discussions and efforts we have made but to no avail as even today 2 more 501 errors occured; highly annoying.

I have sent sent an email to you but no acknowledgement of any sort, this was after numerous attempts via the site.

Can someone please let us know what is happening and why are our clients being rejected. This is costing us credibility, time and potential business as the client wants to order more services from us.

I would really appreciate a reply as soon as possible as this has been going on for nearly 3 weeks.

Thanking you in advance.

Amir Azam

__________________________________________________________

Sorry for the lengthy communique that is going to follow:

Dear Tech Support

Can you please look at this situation for us as it is affecting our relationship with our client.

We keep getting the following error:

501 Connection rejected by policy [7.7]

We have been onto our hosting / email providers, a reasonably reliable company:

www.tmdhosting.com

They have assured us that our VPS is clean and not on a blacklist:

198.20.127.153

See: https://www.talosintelligence.com/reputation_center/lookup?search=198.20.127.153

We have been having these issues for nearly 3 weeks now, all mainly related to one domain:

www.digway.co.uk

emails that are getting blocked by your system are from:

raj@digway.co.uk

barry@digway.co.uk

gary.gola@digway.co.uk

The server has no issues with any other email recipients other than those monitored by Symantec and all the errors are;

Series of 501 Connection rejected by policy [7.7]

Is this server / can this server not be lifted off any blacklisting that you may have.

The number of emails sent monthly from this server is just just in the hundreds and we know for a fact that none of our clients are send block emails / spam.

This is our communication with TMD in trying to resolve the situation, it is seriousl becoming an issue:

eMail Rejections on www.digway.co.uk Accounts

ID: 956244

 Status: Customer-Reply

Amir Azam

Client

23/07/2017 12:16

Hi GST

Can you please look at www.digway.co.uk thoroughly as emails from this domain have been problematic. Initial main problems were due to a 501 error (Symantec placing our server on a blacklist).

I have just had this message from raj@digway.co.uk

_________________________________________________________________

-----Original Message-----

From: Raj [mailto:raj@digway.co.uk] 

Sent: 23 July 2017 11:46

To: 'Amir'

Subject: FW: Warning: message 1dY8iS-0007Xc-NR delayed 72 hours

Hi Amir 

Getting a lot of rejections it appears....

This another one...any thoughts??

-----Original Message-----

From: Mail Delivery System [mailto:Mailer-Daemon@vps1068.tmdvps.com]

Sent: 23 July 2017 11:47

To: raj@digway.co.uk

Subject: Warning: message 1dY8iS-0007Xc-NR delayed 72 hours

This message was created automatically by mail delivery software.

A message that you sent has not yet been delivered to one or more of its recipients after more than 72 hours on the queue on vps1068.tmdvps.com.

The message identifier is: 1dY8iS-0007Xc-NR

The subject of the message is: RE: New Membership

The date of the message is: Thu, 20 Jul 2017 11:22:57 +0100

The address to which the message has not yet been delivered is:

r.binns@rha.uk.net

host mx2-eu1.ppe-hosted.com [62.209.50.27]

No action is required on your part. Delivery attempts will continue for some time, and this warning may be repeated at intervals if the message remains undelivered. Eventually the mail delivery software will give up, and when that happens, the message will be returned to you.

_________________________________________________________________

THIS DOMAIN WWW.DIGWAY.CO.UK IS REALLY IMPORTANT TO US AND IT ALONG WITH ALL EMAIL ACCOUNTS NEED TO BE 100% SPOT ON.

Can you please tell me why it experiences issues and how we can get round this.

a. Is it the server

b. Is it being blacklisted (and why if so, as we are not abusing the email system)

c. Do we need more resources (disk space / RAM...etc)

CAN SOMEONE PLEASE LOOK INTO THIS AND GET GIVE ME SOME ADVICE AS OF ALLOUR DOMAINS THIS IS THE MOST IMPORTANT ONE. AND NO OTHER DOMAIN IS EXPERIENCING ANY EMAIL ISSUES BARRING THE EMAIL ACCOUNTS ON THIS DOMAIN. WE CAN ONLY KEEP THE CLIENT AT BAY FOR SO LONG. SO PLEASE IF WE NEED TO DO ANYTHING TO RESPOVE THIS PLEASE LE ME KNOW WHAT NEEDS TO BE DONE.

Thanking you in advance

Amir

----------------------------

IP Address: 2.29.226.199

Ned Johnson

Staff

23/07/2017 12:36  

How would you rate this reply?

Hello,

Thank you for contacting TMDHosting Technical Support Team!

We have reviewed this and it seems that the issue with the email is related to EHLO:

2017-07-23 11:47:07 1dY8iS-0007Xc-NR H=mx1-eu1.ppe-hosted.com [62.209.50.26]: Remote host closed connection in response to EHLO vps1068.tmdvps.com

2017-07-23 11:47:13 1dY8iS-0007Xc-NR H=mx1-eu1.ppe-hosted.com [91.209.104.155]: Remote host closed connection in response to EHLO vps1068.tmdvps.com

2017-07-23 11:47:19 1dY8iS-0007Xc-NR H=mx2-eu1.ppe-hosted.com [91.209.104.156]: Remote host closed connection in response to EHLO vps1068.tmdvps.com

2017-07-23 11:47:25 1dY8iS-0007Xc-NR H=mx2-eu1.ppe-hosted.com [62.209.50.27]: Remote host closed connection in response to EHLO vps1068.tmdvps.com

2017-07-23 11:47:25 1dY8iS-0007Xc-NR == r.binns@rha.uk.net R=dkim_lookuphost T=dkim_remote_smtp defer (-18) H=mx2-eu1.ppe-hosted.com [62.209.50.27]: Remote host closed connection in response to EHLO vps1068.tmdvps.com

2017-07-23 11:47:25 cwd=/var/spool/exim 7 args: /usr/sbin/exim -t -oem -oi -f <> -E1dY8iS-0007Xc-NR

2017-07-23 11:47:25 1dZEQ1-0004Fl-QD <= <> R=1dY8iS-0007Xc-NR U=mailnull P=local S=2709 T="Warning: message 1dY8iS-0007Xc-NR delayed 72 hours" for raj@digway.co.uk

2017-07-23 11:53:08 1dZEVY-0004IW-FO <= raj@digway.co.uk H=host81-130-185-200.in-addr.btopenworld.com (xtremeitPC) [81.130.185.200]:56302 P=esmtpsa X=TLSv1:AES128-SHA:128 CV=no A=dovecot_login:raj@digway.co.uk S=3592 id=01a701d303a0$e6421ee0$b2c65ca0$@co.uk T="FW: Warning: message 1dY8iS-0007Xc-NR delayed 72 hours" for amir@immediately.tv

2017-07-23 17:14:23 1dZJWR-00077u-6a <= amir@immediately.tv H=(AmirHomePC) [2.29.226.199]:57537 P=esmtpsa X=TLSv1:AES128-SHA:128 CV=no A=dovecot_login:amir@immediately.tv S=4136 id=007101d303cd$c6a111e0$53e335a0$@immediately.tv T="RE: Warning: message 1dY8iS-0007Xc-NR delayed 72 hours" for raj@digway.co.uk

Additionally, we have changed the RDNS of your server and this should take effect in the next 24 hours, in case you are experiencing the same issues in the next 24 hours please update us via this ticket so we may review this further. Also, I would like to say that everything on the server is set properly and there are no blacklists on your IP address.

We remain 24/7 at your immediate disposal.

Best Regards,

Ned Johnson

Technical Support Team Lead

TMDHosting.com

Amir Azam

Client

23/07/2017 12:44 

HI need

WHAT DOES THIS MEAN: We have reviewed this and it seems that the issue with the email is related to EHLO

Also what will the RDNS change do. 

AS MENTIONED THIS DOMAIN AND ALL EMAIL ACCOUNTS IS REALLY VERY IMPORTANT.

CAN WE DO WHATEVER IS NEEDED SO THATTHEY DO NOT ENCOUNTER ANY MORE ISSUES; THEY HAVE HAD A LOT OF PROBLEMS IN THE LAST TEN DAYS.

Please let me know if we are doing anything wrong here.

Do they have enough disk space / bandwidth / email space allocation?

Thanks

Amir

Ned Johnson

Staff

23/07/2017 13:06  

How would you rate this reply?

Hello,

Thank you for the update!

We have reviewed this and EHLO and HELO is important and this is how SMTP Communication is being initiated this is the first response towards and from a server's SMTP service. The errors I provided you show that the EHLO connection was closed, which would mean that the SMTP communication for mail delivery was not even initiated, this may be caused due to one server unable to connect to the other.

Since this is the issue, we decided to change the Reverse DNS (RDNS) of your server which would make email authentication easier for EHLO and HELO.

As for the experienced issue, you should allow up to 24 hours for the new RDNS to start working, in case the issue is still concurrent you should have to update us via this ticket with the new bounce back if there is such so we may provide this to our System Administrators for further review.

Considering this, if we may assist you further on this matter, please do not hesitate to contact us again.

We remain 24/7 at your immediate disposal.

Best Regards,

Ned Johnson

Technical Support Team Lead

TMDHosting.com

Amir Azam

Client

26/07/2017 06:12 

Hi Ned

Can you please check this as follow up to the previous message.

Still getting 501 - particular email address I am concerned about is raj@digway.co.uk as that gary@ and barry@ are the most important (although they are all important for this domain.

-----Original Message-----

From: Mail Delivery System [mailto:Mailer-Daemon@vps1068.tmdvps.com]

Sent: 25 July 2017 10:50

To: info@digway.co.uk

Subject: Mail delivery failed: returning message to sender

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed:

GLASGOWCC.EMPLOYERDIRECT@DWP.GSI.GOV.UK

host cluster5.eu.messagelabs.com [195.245.230.51]

SMTP error from remote mail server after initial connection:

501 Connection rejected by policy [7.7] 3305, please visit www.messagelabs.com/support for more details about this error message.

-----Original Message-----

From: Mail Delivery System [mailto:Mailer-Daemon@vps1068.tmdvps.com]

Sent: 25 July 2017 10:51

To: info@digway.co.uk

Subject: Mail delivery failed: returning message to sender

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed:

GLASGOWCC.EMPLOYERDIRECT@DWP.GSI.GOV.UK

host cluster5.eu.messagelabs.com [85.158.136.83]

SMTP error from remote mail server after initial connection:

501 Connection rejected by policy [7.7] 3612, please visit www.messagelabs.com/support for more details about this error message.

-----Original Message-----

From: Mail Delivery System [mailto:Mailer-Daemon@vps1068.tmdvps.com]

Sent: 25 July 2017 11:15

To: info@digway.co.uk

Subject: Mail delivery failed: returning message to sender

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed:

GLASGOWCC.EMPLOYERDIRECT@DWP.GSI.GOV.UK

host cluster5.eu.messagelabs.com [85.158.138.179]

SMTP error from remote mail server after initial connection:

501 Connection rejected by policy [7.7] 16914, please visit www.messagelabs.com/support for more details about this error message.

Your assistance in rectifying these issues on this domain would be greatly appreciated.

If we need to do something on this side then please let us know. The message always seems to be from messagelabs and their link to our server.

Thanks

Dave

 

John Rogers

Staff

26/07/2017 06:35  

How would you rate this reply?

Hello,

Thank you for the update!

It appears that the IP address of the server has low reputation at Symantec. I have requested a delisting from the following tool:

http://ipremoval.sms.symantec.com/lookup/

In 24 hours the reputation of your IP address will be increased and this should be resolved. I have also checked your IP address from the following online tool:

http://mxtoolbox.com/blacklists.aspx

and I can confirm that there are no other issues.

Feel free to get back to us if you have any further questions or comments.

Best Regards,

John Rogers

Genius Support Team

TMDHosting.com

Amir Azam

Client

26/07/2017 06:47 

Hi John

Thank you for this, but why does it keep reverting to low reputation?

As for this: 

In 24 hours the reputation of your IP address will be increased and this should be resolved. I have also checked your IP address from the following online tool:

http://mxtoolbox.com/blacklists.aspx

Is this the IP of our office or the IP of the customer digway which is sending the email from the digway.co.uk domain. Do we need to delist their IP if this is the case. We are having no issues with anyone else just the digway domain.

Sorry for the hassle but please let me know.

Thank you.

Dave

John Rogers

Staff

26/07/2017 06:56  

How would you rate this reply?

Hello,

Thank you for the update!

This is not related to your or a customer's IP address. This is related to the server's IP address - 198.20.127.153. And indeed you are not having issues with other email providers as it has low reputation with them only. I am afraid that we would not be able to tell why it is reverting to low reputation. This might occur if you are sending too much email to them or if they find something suspicious in your emails. I would recommend to await some time and recheck if the IP reputation will be improved. Once improved, if the issue reoccurs we would recommend contacting them to check why this is happening.

Feel free to get back to us if you have any further questions or comments.

Best Regards,

John Rogers

Genius Support Team

TMDHosting.com

Amir Azam

Client

26/07/2017 07:44 

Hi John

Okay.

But just quickly as for too many emails.

Over the month the group as a whole has only sent a thousand or so over a month, maybe a touch more.

Anyway I'll monitor the situation and come back to you.

Thanks

Dave

John Rogers

Staff

26/07/2017 07:51  

How would you rate this reply?

Hello,

Thank you for the update!

Not a problem at all. Please review this and if you encounter anything suspicious or if we could be of any further assistance update us here.

Feel free to get back to us if you have any further questions or comments.

Best Regards,

John Rogers

Genius Support Team

TMDHosting.com

Amir Azam

Client

28/07/2017 07:44 

Hi John

PLEASE LOOK INTO THIS.

Same domain, email address raj@digway.co.uk

https://i.imgur.com/KfVSeBL.png

https://i.imgur.com/GoLizeq.png

It seems that the same Symantec shysters are blocking the domain / emails.

THIS IS VERY IMPORTANT CLIENT FOR US. CAN YOU PLEASE CHECK AND DOUBLE CHECK AND PLEASE RESOLVE ISSUE.

IT IS REALLY IMPORTANT. WHY ARE SYMANTEC CONTINUALLY BLOCKING THE SERVER???

PLEASE REPLY ASAP AS I NEED TO GET BACK TO THE CUSTOMER

Thank you.

Dave

John Rogers

Staff

28/07/2017 07:59  

How would you rate this reply?

Hello,

Thank you for the update!

The IP address of your server does not have a negative reputation. 

Please allow us some time to review this. Once we have any additional information available we will update you here.

Thank you for your patience in the meantime.

Best Regards,

John Rogers

Genius Support Team

TMDHosting.com

Frank Dodson

Staff

28/07/2017 08:29  

How would you rate this reply?

Hello Dave,

Thank you for your patience up to now!

We have reviewed your case once again and in order to rectify the issue, we have enabled DKIM and SPF records for your domain which will be fully active in the upcoming 24 hours. Considering this, please allow that time and if the issue still persists, please update with an email account to whom we could send a test email so we could recreate the issue.

Considering the information above, please do not hesitate to contact us again if we can assist with anything else!

We remain 24/7 at your immediate disposal! 

Kind Regards,

Frank Dodson

Genius Support Team

TMDHosting.com

Amir Azam

Client

28/07/2017 09:29 

Hi Frank

Thanks for the info.

Is it possible to updated everything that is needed at once for this domain, as it is very important to us.

You have RDNS which resolve EHLO and HELO and now this DKIM and SPF - 

TBH ALL THIS IS FLYING WAY ABOVE OUR HEADS.

At the moment of all the domains on our server this is the most crucial as potential of a new server on the back of this and at least 3 more websites.

The test email, most important one, is raj@digway.co.uk - issues are always with [messagelabs]. Is it possible that Symantec are blocking the server from different servers at their end so when unlisting certain part of the Symantec system does not synch???

SORRY FOR HASSLING BUT VERY IMPORTANTPLEASE DO BEST THAT YOU CAN OR ADVISE ACCORDINGLY AS EACH CHANGE ADDS 24 HOURS DURING WHICH ANOTHER EMAIL OR TWO GETS REJECTED, IRATING THE CUSTOMER!

Thanks

Dave

Frank Dodson

Staff

28/07/2017 09:53  

How would you rate this reply?

Hello,

Thank you for your update!

I will escalate this ticket to our System Administrators from which you will be updated with more detailed information on the matter. Please, allow them some time to review your case. Once they have more information on your case, you will be updated in this ticket.

Meanwhile, I would like to thank you for your patience and understanding in advance

Kind Regards,

Frank Dodson

Genius Support Team

TMDHosting.com

Steven Greene

Staff

28/07/2017 10:04  

How would you rate this reply?

Hello, 

Thank you for the patience.

I have checked and the IP address of your VPS is not present in any blacklist. Also the reputation of the IP address is neutral. You can verify that by accessing the following link: 

https://www.talosintelligence.com/reputation_center/lookup?search=198.20.127.153

As for the following error: 

501 Connection rejected by policy [7.7] 16914, please visit www.messagelabs.com/support for more details about this error message.

the same is indicating that your emails are being rejected due to policy reasons, which in most cases means that the IP address is blacklisted, but in your case the IP address of your VPS is not blacklisted. You can verify that via the following online checking tool: 

http://ipremoval.sms.symantec.com/lookup/

In order to locate the source of the issue, we would like to recommend you to contact the support team of "symantec.com" and ask them to provide you with more information on the matter. 

Feel free to contact us again if you need any further assistance.

Best regards,

Steven Greene

Genius Support Team

TMDHosting.com

Amir Azam

Client

28/07/2017 16:21 

Hi Steven

This seems to be a common problem with Symantec.

Are you experiencing this with any other customers of your.

There seems to be no solution as trying to connect to Symantec is nigh on impossible. And they are saying that their client has to tell our client to tell us to tell you what the issue maybe. This is bloody ridiculous. Does Symantec not know the issues they are creating for decent developers.

Please offer some guidance as our client had another rejection:

501 Connection rejected by policy [7.7] 20709

All the while it is affecting our relationship with the client.

If we get a another VPS which we are planning, will this again cause issues? 

Really baffled so help and guidance will be greatly appreciated and being you being major hosting company maybe you can get more joy from Symantec.

Please let us know

Amir

Could you please check the status of our server on your systems and let us know what the issue is.

For us to get your client to tell our client to tell us is a big issue,

we could do this on a one off but our messages are getting rejected on a daily basis and this simply is not practically possible.

This is having a profounf affect with our client and our business relationship wiuth them.

Can someone please reply to this message with a view to resolving this situation as soon as possible as it is affeting us badly

We know this is a common issue as there are forums with other developers experiencing the same issues.

Thanking you in advance.

Best Regards

Amir

+44 (0) 78 66 7777 44

+44 (0) 161 637 79 80

!mmediately

w: www.immediately.tv

e:  amir@immediately.tv

Hi All,

Many of our client rejected our email with bounced back email -553-Message filtered. 

We confirm,

1) we are not SPAM 

2) our IP is not on any SPAM black list

3) SPF setting is correct

Our domain is royaleinternational.com, appreciated if you could help to release us. 

Hi,

We are from Bankerbay ( https://www.bankerbay.com/ ). We got the below message when we sent an email from our Google Apps account on "bankerbay.com" to an email address on "eastspring.com" which is using MessageLabs as their mail server. 

===

553 Sorry, your email address <id>@bankerbay.com  has been blacklisted. Refer to the Troubleshooting page at http://www.symanteccloud.com/troubleshootingfor more information. (#5.7.1)

====

We are a VC funded tech company in Investment Banking space  https://www.bankerbay.com with 10K-50K users, our linkedin page : https://www.linkedin.com/company/bankerbay .

We have SPF record (below), DKIM keys set . We do not send any spam email . All other spam listing websites mark us good ( can be checked by you) 

Please delist us from SPAM db.

====

# dig bankerbay.com -t TXT

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.30.rc1.35.amzn1 <<>> bankerbay.com -t TXT

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34617

;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:

;bankerbay.com.            IN    TXT

;; ANSWER SECTION:

bankerbay.com.        60    IN    TXT    "v=spf1 a mx include:zcsend.net include:netcore.co.in include:amazonses.com include:_spf.google.com ~all"

bankerbay.com.        60    IN    TXT    "google-site-verification=t2xr9KIPGds3ZagQTh6oNypGmWAKPzhoqOQYUGuPpno"

;; Query time: 42 msec

;; SERVER: 172.31.0.2#53(172.31.0.2)

;; WHEN: Tue May  2 12:30:42 2017

;; MSG SIZE  rcvd: 228

=======

Thanks

Shankar.S

Hi,

I have a problem when I send mail to my clients if they use your system.

See this message

" connect to cluster8.eu.messagelabs.com[85.158.137.19]:25: Connection timed out"

My IP are 147.135.185.56, can you allow my adress?

Best regards

Hello

I'm asking here since I haven't found a an answer on other places.

Does the .Cloud solution has the Disarm feature like in the SMG?

Thanks

I can't connect to any of the IP addresses of cluster8.eu.messagelabs.com (e.g. 216.82.251.39) for mail delivery via port 25 for many days.

Postfix receives a timeout and any TCP connection times out.

The source IP of our mail server is 78.47.9.251 (mail.itbt.it)  and it is not listed on any blacklist nor has any bad reputation marks on http://ipremoval.sms.symantec.com/lookup/

TCP connections from IP addresses within the same subnet (e.g. 78.47.9.252) are possible for connecting port 25/tcp and ICMP ping response packets are replied with an ICMP reply.

Though it seems all IP addresses of cluster8.eu.messagelabs.com are blocking incoming connection to port 25 from 78.47.9.251.

Could you please help me, with this problem? Pretty please.

Kind regards,

Loris

Hi,

We have a customer who is trying to connect to a company with hosted Messagelabs email security via Forcepoint servers using TLS.

We can connect to the primary MX record fine but the secondary MX record gives the following:-

Trying Server cluster2a.eu.messagelabs.com
SMTP test:
A connection attempt from rly25a.srv.mailcontrol.com:8882 to cluster2a.eu.messagelabs.com on the SMTP port returns:
220 server-12.tower-555.messagelabs.com ESMTP
------------------------------------------------------------
Traceroute reports that the path to cluster2a.eu.messagelabs.com from this cluster is:
Hop Round-trip time Router
1   local router
2 0.411 ms ae0.659.rtr02a.frcpt.net (85.115.52.131)
3 0.782 ms ae0-408.rtr01j.frcpt.net (85.115.48.11)
4 1.452 ms xe-2-2-0.er1.london-ld4.symsaas.net (195.66.225.41)
5 13.700 ms unknown-46-226-55.bb.symantec.net (46.226.55.2)
6 13.662 ms unknown-46-226-55.bb.symantec.net (46.226.55.1)
7 107.602 ms unknown-63-245-207.bb.symantec.net (63.245.207.138)
8 162.482 ms xe-5-3-7.bcr1.lga1.us.bb.symantec.net (63.245.207.109)
9 163.037 ms ae-1-0.bar1.phx2.us.bb.symantec.net (63.245.207.29)
10 162.705 ms messagelabs-2.bar1.phx2.us.bb.symantec.net (63.245.207.190)
11 162.590 ms mail555.messagelabs.com (216.82.251.230)
------------------------------------------------------------
Security setting verification:
Checking server security option 'Verify'....ERROR
 sayTo: unacceptable return code TEMPFAIL, 421, Service Temporarily Unavailable
------------------------------------------------------------
Overall connection status. Connection failed

Would you be able to help please?

Thanks,

Richard.

We're looking to send email on the range 107.174.26.208/28 however our client is getting "Rejected by policy" errors for servers using messagelabs. This range is currently clean on all the public lists we can find but the error persists. Based on this forum we're assuming that this is a seperate list or service somewhere else and managed differently. Can you assist us with this?

The range is clean of blacklists and has a positive reputation on Talos (formerly SenderBase). Let us know if there's any additional action we need to take.

https://mxtoolbox.com/SuperTool.aspx?action=blacklist%3a107.174.26.210&run=toolpage

https://www.talosintelligence.com/reputation_center/lookup?search=107.174.26.208%2F28

Here's the log. In addition to this one, there is also a 550 denied by policy:

LOG: MAIN
  cwd=/usr/local/cpanel/whostmgr/docroot 4 args: /usr/sbin/exim -v -M 1df7Vy-00047U-O1
delivering 1df7Vy-00047U-O1
LOG: MAIN
  Unfrozen by forced delivery
Connecting to cluster8.us.messagelabs.com [216.82.251.39]:25 ... connected
  SMTP<< 501 Connection rejected by policy [7.7] 16411, please visit www.messagelabs.com/support for more details about this error message.
  SMTP>> QUIT
  SMTP(close)>>
Connecting to cluster8.us.messagelabs.com [216.82.249.147]:25 ... connected
  SMTP<< 501 Connection rejected by policy [7.7] 2915, please visit www.messagelabs.com/support for more details about this error message.
  SMTP>> QUIT
  SMTP(close)>>
LOG: MAIN
  == jefelix@segurosreservas.com<JEFelix@segurosreservas.com> R=dkim_lookuphost T=dkim_remote_smtp defer (-1): smtp transport process returned non-zero status 0x000b: terminated by signal 11
LOG: MAIN
  == ljmontas@segurosreservas.com<LJMontas@segurosreservas.com> R=dkim_lookuphost T=dkim_remote_smtp defer (-1): smtp transport process returned non-zero status 0x000b: terminated by signal 11
LOG: MAIN
  == msanz@segurosreservas.com<MSanz@segurosreservas.com> R=dkim_lookuphost T=dkim_remote_smtp defer (-1): smtp transport process returned non-zero status 0x000b: terminated by signal 11
LOG: MAIN
  == blora@segurosreservas.com<BLora@segurosreservas.com> R=dkim_lookuphost T=dkim_remote_smtp defer (-1): smtp transport process returned non-zero status 0x000b: terminated by signal 11
LOG: MAIN
  Frozen

A quote from our client as to why it's important

BTW, if relevant, about 90% of these domains blocking through symantec are local Banks or Insurance companies.  The other 10% are governmental institutions here in the Dominican Republic.  By that what I am trying to convey is that the communications getting lost here are pretty important and thus why this is a pretty relevant issue for me and my customers.

Dear Support Team,

We have moved our shared hosted server to new data center, new IP of the server is getting blocked by messages labs, our 173.212.215.196 is not listed blacklisted, symantec report of the IP is also clean.

Request to unblock our IP.

Error message as below

    host cluster8.eu.messagelabs.com [85.158.139.35]
    SMTP error from remote mail server after initial connection:
    501 Connection rejected by policy [7.7] 17906, please visit
www.messagelabs.com/support for more details about this error message.

Await your reply

Thanks & Regards

Sarles Anthony