Hello,
Since a few days ago, messages from the server correo.efismart.es (92.222.92.253) are not arriving to destinations managed by you. As an example, legitimate mails sent from xxxxx@montajesfiver.com to  xxxxx@abanca.com do not reach destination, the mails are accepted by destination servers but they not appear in the recipient mail, so I undertand that the mail is silently rejected. The domain montajesfiver.com is managed by the correo.efismart.es server.

I have revised the mail server logs of the last few days and I do not find any suspicious activity, only the usual mail movement. Also I have check the mail address agaisnt several reputation services and all of them return that the reputation is good or neutral, also the ip is no listed in any blacklist service but yours.

The IP of the server appears with negative reputation in https://ipremoval.sms.symantec.com/. I tried to send an investigation request but the form keeps show up again and again when I press the investigate submit button, so I am not sure that the request is sent.

Any help will be appreciated.

Many thanks,

Enrique

Hi Support

cluster5.eu.messagelabs.com throttling our mail servers.

We had issues on our mail queues and once we resolved it, a lot of mails were sent in the queues. Subsequently we are now being throttled. I have mailed, called Symantec Support to no avail. Please assist us urgently.

Date Received: 2019/03/25 13:56:19

Expiration Time: 2019/03/27 13:56:19

Last Error: 421 Service Temporarily Unavailable

196.214.76.171 External MX record mail.4cgroup.co.za

196.22.223.200 External MX record mail1.4cgroup.co.za

209.203.1.2 External MX record mail2.4cgroup.co.za

Kind Regards

Leo

I am having the same issue as everyone else in this forum where my domain has been inexplicably prevented from sending email to customers on your email security platform.

I am not on any blacklists including Symantec's IP reputation check.

Sending an email to support.cloud@symantec.com has the auto reply "support will no longer respond to emails sent to (support.cloud@symantec.com) as a means of creating your support case"

Sending an email to investigation@review.symantec.com bounces as the email does not exist. I'm serious. I even had one of the online chat agents try it and he confirmed it.

How do I resolve this when Symantec wont provide any avenues to? Businesses using this product are legitimately missing sales inquiries, invoices, etc. 

We have issues with our e-mails being delayed to servers using symantech and messagelabs.com. 

I found the previous post: https://www.symantec.com/connect/forums/emails-being-rejected-delayed-filtered-messagelabs

which suggests e-mailing investigation@review.symantec.com and submitting e-mails for investigation; however, this e-mail sends a kickback anytime I try sending samples. How do we get this issue corrected??

Hi  everyone,

I want Email security.cloud Admin guide. If anyone have plz Give me.

Regard ,

Mubashsir Shaikh

Similar to other requests about legitimate emails being blocked by MessageLabs, it looks like some of your MX hosts are blocking testing from CheckTLS.com (see below, 5 of 8 are blocked).  Either that or you have some failing MX hosts.

I understand why your automated systems may see testing from CheckTLS as a threat.

CheckTLS users, which include some of the largest financial institutions, health systems, insurers, and law offices world wide, do thorough testing of domains, some of which are protected by MessageLabs.  These tests probe every MX they can find looking at security.  No test ever actually sends an email (we have a strong abuse policy).

CheckTLS has been testing for 9 years, growing 50% per year, and is reaching critical mass in the industry.  We do over a million tests a month now.

But from MessageLab's viewpoint, you see more and more tests, targeting every one of your hosts, that never send an email.  I suspect this looks like an attack to you.

Let me assure you, these tests are not an attack.  They are not a threat.  In fact, they are good for MessageLabs and Symantec.  It means more and more people are checking you out.

These are either paying customers verifying that MessageLabs is doing what they say they do, or

outside companies who email MessageLabs paying customers who are verifying that MessageLabs is secure, or

potential MessageLabs customers who are looking at how MessageLabs works.

All this long message is to respectfully request that MessageLabs and Symantec white list CheckTLS.com.  In as many places as you can.  We do not send email, we do not spam, we are not a hacker site.  Our users only have access to the test we publish on our web site.

Please contact me personally if you have any questions or concerns.

Thank you.

--- Steve Shoemaker

Principal, CheckTLS

Hi All

We use Fusion who just bought Megapath and Apptix, they have their Exchange server using Symantec Message Labs.

We are having issue with anybody using ProofPoint and sending us email, for 6 months Fusion and Symantec blame the other party saying their are sending to the wrong IP address of the MX 216 and when the current one are 67, is right but after deep investigation we found out that one of our client have a high volume of email beetween proofpoint users, so they DNS query is realyl high due to the high volume of emails. We saw that when ProofPoint does a high volume of DNS query then they get a old IP address of that MX record and we think that's because Message Labs thinks is a DOS attack or something so it provide a wrong IP hoping it will not receive more request.

This need to be fix asap, due to really affect our business, if a moderator need to know our domain please DM cause I don't want to make that inforamtion public do to be big firm names.

Thank you!

Hi and Good day, have multiples errors from your email sever mail555.messagelabs.com, please see log:

2019-04-01T09:37:09.487Z,internet,08D6B54508926C5E,0,,52.59.133.150:25,*,SendRoutingHeaders,Set Session Permissions

2019-04-01T09:37:09.487Z,internet,08D6B54508926C5E,1,,52.59.133.150:25,*,,attempting to connect

2019-04-01T09:37:09.526Z,internet,08D6B54508926C5E,2,192.168.0.101:59851,52.59.133.150:25,+,,

2019-04-01T09:37:09.567Z,internet,08D6B54508926C5E,3,192.168.0.101:59851,52.59.133.150:25,<,"220 mail555.messagelabs.com ESMTP Mon, 01 Apr 2019 09:37:20 +0000",

2019-04-01T09:37:09.567Z,internet,08D6B54508926C5E,4,192.168.0.101:59851,52.59.133.150:25,>,EHLO recicladosstore.com,

2019-04-01T09:37:09.605Z,internet,08D6B54508926C5E,5,192.168.0.101:59851,52.59.133.150:25,<,250  mail555.messagelabs.com Hello ip-100-113-13-177.eu-central-1.aws.symcld.net [100.113.13.177] SIZE 52428800 8BITMIME PIPELINING CHUNKING PRDR HELP,

2019-04-01T09:37:09.605Z,internet,08D6B54508926C5E,6,192.168.0.101:59851,52.59.133.150:25,*,,sending message with RecordId 3410204033041 and InternetMessageId <db01b0f396cb4d70b02bf4be6667e08a@rscomunicaciones.es>

2019-04-01T09:37:09.606Z,internet,08D6B54508926C5E,7,192.168.0.101:59851,52.59.133.150:25,>,MAIL FROM:<yyyyyyy@rscomunicaciones.es> SIZE=31987,

2019-04-01T09:37:09.606Z,internet,08D6B54508926C5E,8,192.168.0.101:59851,52.59.133.150:25,>,RCPT TO:<xxxxx@ferrovial.com>,

2019-04-01T09:37:09.643Z,internet,08D6B54508926C5E,9,192.168.0.101:59851,52.59.133.150:25,<,250 OK,

2019-04-01T09:37:09.643Z,internet,08D6B54508926C5E,10,192.168.0.101:59851,52.59.133.150:25,<,421 Service Temporarily Unavailable,

2019-04-01T09:37:09.648Z,internet,08D6B54508926C5E,11,192.168.0.101:59851,52.59.133.150:25,>,QUIT,

2019-04-01T09:37:09.686Z,internet,08D6B54508926C5E,12,192.168.0.101:59851,52.59.133.150:25,<,221 mail555.messagelabs.com closing connection,

2019-04-01T09:37:09.686Z,internet,08D6B54508926C5E,13,192.168.0.101:59851,52.59.133.150:25,-,,Local

Both domais have error recicladosstore.com and rscomunicaciones.es

BEST REGARDS

Hi there

We are having emails from our domain blocked by several other companies using Symantec cloud.

I have checked the Symantec IP lookup tool and we're not coming up as having a bad reputation.

I've also checked our domain with all the spam databases I can find and we are coming up clean.

Would really appreciate some help from someone from Symantec

Hello,

I'm writing you as System Administrator of candidatis sro & co KG.

For 3 days our mail server (mail.candidatis.net) is refused to talk to several mail domains.

For example: bmf.gv.at (relay=mailx14.cna.at[85.158.228.23]), noel.gv.at (mail1.noel.gv.at 194.29.99.21), schig.com (host mailx14.cna.at[85.158.228.23])

I also tried blacklist tool http://ipremoval.sms.symantec.com/lookup/. After submitting the button "investigate" there is no reponse. I always get redirected to the same form.

candidatis sro & co kg is a company in austria locally in vienna. We write emails just to customers and send newsletter to our registrated users. We are not a spamming bot.

Please investigate our IP address 195.201.199.45 and remove our ip address from your blacklist.

Best regards,

Michel Winata

I have a number of clients who use MessageLabs and anytime we try to email them. I get these errors:

2019-04-03 15:13:12 1hBmFV-0000ld-6C H=cluster6.us.messagelabs.com [67.219.246.196] Connection timed out
2019-04-03 15:13:42 1hBmFV-0000ld-6C H=cluster6.us.messagelabs.com [67.219.251.52] Connection timed out
2019-04-03 15:14:12 1hBmFV-0000ld-6C H=cluster6.us.messagelabs.com [67.219.250.100] Connection timed out
2019-04-03 15:14:42 1hBmFV-0000ld-6C H=cluster6.us.messagelabs.com [67.219.250.196] Connection timed out
2019-04-03 15:15:12 1hBmFV-0000ld-6C H=cluster6.us.messagelabs.com [67.219.247.52] Connection timed out
2019-04-03 15:15:12 1hBmFV-0000ld-6C == ap@xx.com R=dnslookup T=remote_smtp defer (110): Connection timed out
2019-04-03 15:20:20 1hBmFV-0000ld-6C H=cluster6.us.messagelabs.com [67.219.246.100] Connection timed out
2019-04-03 15:20:50 1hBmFV-0000ld-6C H=cluster6.us.messagelabs.com [67.219.250.196] Connection timed out
2019-04-03 15:21:20 1hBmFV-0000ld-6C H=cluster6.us.messagelabs.com [67.219.250.100] Connection timed out
2019-04-03 15:21:50 1hBmFV-0000ld-6C H=cluster6.us.messagelabs.com [67.219.247.52] Connection timed out
2019-04-03 15:22:20 1hBmFV-0000ld-6C H=cluster6.us.messagelabs.com [67.219.246.196] Connection timed out
2019-04-03 15:22:20 1hBmFV-0000ld-6C == ap@xx.com R=dnslookup T=remote_smtp defer (110): Connection timed out
2019-04-03 15:30:20 1hBmFV-0000ld-6C H=cluster6.us.messagelabs.com [67.219.246.100] Connection timed out
2019-04-03 15:30:50 1hBmFV-0000ld-6C H=cluster6.us.messagelabs.com [67.219.251.52] Connection timed out
2019-04-03 15:31:20 1hBmFV-0000ld-6C H=cluster6.us.messagelabs.com [67.219.247.52] Connection timed out
2019-04-03 15:31:50 1hBmFV-0000ld-6C H=cluster6.us.messagelabs.com [67.219.250.196] Connection timed out
2019-04-03 15:32:20 1hBmFV-0000ld-6C H=cluster6.us.messagelabs.com [67.219.250.100] Connection timed out
2019-04-03 15:32:20 1hBmFV-0000ld-6C == ap@xx.com R=dnslookup T=remote_smtp defer (110): Connection timed out

Those just repeat over and over. Trying to telnet to cluster6.us.messagelabs.com on port 25 fails to connect as well.

$ telnet cluster6.us.messagelabs.com 25
Trying 67.219.246.100...
Trying 67.219.246.196...
Trying 67.219.250.196...

I have checked on https://ipremoval.sms.symantec.com/ipr/lookup and it shows my IPs as having no bad reputation. I have checked a number of spam blacklists and my IPs are not listed. I have tried to email investigation@review.symantec.com and I get a bounce back

investigation@review.symantec.com
Remote Server returned '554 5.1.2 < #5.1.2 smtp; 554 5.1.2 Recipient address rejected: User unknown>'

Doing a trace route to cluster6.us.messagelabs.com fails to reach the destination, so somewhere along the line it appears my IP address is being blocked and I cannot figure out why.

$ traceroute cluster6.us.messagelabs.com
traceroute to cluster6.us.messagelabs.com (67.219.251.52), 30 hops max, 60 byte packets
 1  10.100.160.254 (10.100.160.254)  0.530 ms  0.494 ms  0.613 ms
 2  network190-2.wctc.net (209.94.190.2)  1.646 ms  1.611 ms  1.602 ms
 3  network170-109.wctc.net (209.94.170.109)  1.175 ms  1.524 ms  1.492 ms
 4  network172-252.wctc.net (209.94.172.252)  1.883 ms  2.024 ms  1.993 ms
 5  new-firewall-eth-gw.airstreamcomm.net (64.33.156.189)  2.681 ms  2.935 ms  3.269 ms
 6  air-mpls-asr-to-cpdg.airstreamcomm.net (64.33.129.230)  10.404 ms  10.155 ms  10.119 ms
 7  xe-5-2-5.bcr1.sjc1.us.bb.symantec.net (206.223.116.178)  64.578 ms  64.291 ms  64.267 ms
 8  xe-5-0-0.bar1.ash1.us.bb.symantec.net (63.245.207.86)  69.884 ms  69.918 ms  69.831 ms
 9  ae-0-0.bcr2.lax1.us.bb.symantec.net (63.245.207.101)  69.530 ms  69.798 ms  69.498 ms
10  xe-4-3-7.bcr1.phx1.us.bb.symantec.net (63.245.207.10)  78.765 ms  78.752 ms  78.738 ms
11  148.64.31.89 (148.64.31.89)  81.502 ms  81.474 ms  81.309 ms
12  148.64.31.81 (148.64.31.81)  80.921 ms  81.346 ms  81.298 ms
13  * * *
14  unknown-63-245-206.us.bb.symantec.net (63.245.206.29)  81.260 ms  81.245 ms  81.613 ms
15  unknown-63-245-206.us.bb.symantec.net (63.245.206.29)  97.344 ms  97.329 ms  97.613 ms
16  * * *
17  * * *
18  * * *
19  * * *
20  * * *
21  * * *
22  * * *
23  * * *
24  * * *
25  * * *
26  * * *
27  * * *
28  * * *
29  * * *
30  * * *
 

I have a block of 5 IPs and I have tried to send from all 5 address through messagelabs and they all fail. The block is 209.94.190.138 - 209.94.190.142.

It seems hit or miss whether someone from Symantec responds to these posts, but I'm really hoping someone at Symantec can point me in the right direction.

Hi can you help....

I keep getting this when I try to email polly.mcdermott@realexpayments.com

Can you unblock for me?

Delivery has failed to these recipients or groups:

polly.mcdermott@realexpayments.com
A problem occurred while delivering this message to this email address. Try sending this message again. If the problem continues, please contact your helpdesk.

Diagnostic information for administrators:

Generating server: googlemail.com

polly.mcdermott@realexpayments.com
Remote Server returned '< #5.0.0>'

Original message headers:

X-Google-Smtp-Source: APXvYqzs/KmRSJcP746F7anHWiu+Rtzij/IvuXKswXffubnhwd/hzHYki9la30TMoYjKNkK52W7L

X-Received: by 2002:a62:ed05:: with SMTP id u5mr8321772pfh.63.1554800026738;

        Tue, 09 Apr 2019 01:53:46 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1554800026; cv=none;

        d=google.com; s=arc-20160816;

        b=cpeH9pPFy2oBSMpiAiPAuiTVacNtczxLtqZ9otjADH2QZk5GxrFMQV47jw6fnIo6pJ

         W84QTZaGqjo12/Ibrj6YOdoUauuPHX7AsaRr07HS10q1TeOhgOH7Km5Qj+mVPaCL1Qni

         GMNVIS+W7my47oxzXXssbViMAnrj86mNoKB0PHCv3OqTlZkbHWVG2Y1wk9cy735O+is/

         afG+ShQYm6bm9sNU5CMm05oTrPaWNXiAoET8tjVw9OtfEh6QPDeUbutT3iWT/a7QRMXw

         w+8suEDXp28pp2CPKHJE1tu/LDSSp+6B38dh0kxUCgmtahkMyzr3tpaz/0e6fuH3vynW

         TsWQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;

        h=mime-version:content-language:accept-language:in-reply-to

         :references:message-id:date:thread-index:thread-topic:subject:cc:to

         :from;

        bh=kbgfr8yI8Og81LYhOYFEVan1N00xxJpAz6YpMbwqHxQ=;

        b=AHoqpt3tIAcwe9xNQeE1X0XW8qIVFWfvFCNOy7282oomgCiKil3s2Cd7yYqcmCCTuP

         BPyIhY4LR0d6MMTYu2UoQd/+iHm515zocxWr+VAEe5yZTuFrVssbQgTLsueUTA1j+BUE

         Wg5Us7WDjE89sQbCBzKUbEdDmp+RW1al8YXD96lqJfICHgQ8XOi9UUvRPuNi9H1atOyq

         b7s7Efln+EwHkNGawF2l3gdjuVUWKVdI+38iGHjPJVNF0ZlGFmuTgtSDzq07Wz5iCoLb

         J7M88Zz2JAPS65vispMtHyjXCC3WtdY5cj+2/KzAhWEfE0qwZjgmyfrSUbHMfUXMJ29c

         H9Rw==

ARC-Authentication-Results: i=1; mx.google.com;

       spf=pass (google.com: best guess record for domain of prvs=1995195dcb=lee.stedman@nu-way.co.uk designates 217.46.240.45 as permitted sender) smtp.mailfrom="prvs=1995195dcb=Lee.Stedman@nu-way.co.uk"

Return-Path: <prvs=1995195dcb=Lee.Stedman@nu-way.co.uk>

Received: from mail6.bemta26.messagelabs.com (mail6.bemta26.messagelabs.com.

 [85.158.142.45])        by mx.google.com with ESMTPS id

 i26si29283117pfd.140.2019.04.09.01.53.44        for

<polly.mcdermott@realexpayments.com>        (version=TLS1_2

 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);        Tue, 09 Apr 2019

 01:53:46 -0700 (PDT)

Received-SPF: pass (google.com: best guess record for domain of prvs=1995195dcb=lee.stedman@nu-way.co.uk designates 217.46.240.45 as permitted sender) client-ip=217.46.240.45;

Authentication-Results: mx.google.com;

       spf=pass (google.com: best guess record for domain of prvs=1995195dcb=lee.stedman@nu-way.co.uk designates 217.46.240.45 as permitted sender) smtp.mailfrom="prvs=1995195dcb=Lee.Stedman@nu-way.co.uk"

Return-Path: <prvs=1995195dcb=Lee.Stedman@nu-way.co.uk>

Received: from [85.158.142.98] (using TLSv1.2 with cipher

 DHE-RSA-AES256-GCM-SHA384 (256 bits))        by

 server-5.bemta.az-a.eu-central-1.aws.symcld.net id 27/74-26874-59D5CAC5; Tue,

 09 Apr 2019 08:53:41 +0000

Authentication-Results: mx.messagelabs.com; spf=none (spf record not 

  found) smtp.mailfrom=nu-way.co.uk; dkim=none (message not signed); 

  dmarc=none (no record) header.from=nu-way.co.uk

X-Brightmail-Tracker: H4sIAAAAAAAAA21Ta0gUYRT1m5kdR3NjXC2/RIm2CFNncTPJIqj

  AQiqp/lSElmNOu1u7q+2spPUjIy1dH5luqJu2Zi9ToVw1e1CZmGkJpqClJLZpDxXtoShmRDM7

  zmbUn8u5555z7/nxfQQq++TqSzDJRsagp7Vy3B3rVXylKHNMdXRIzSgenvG4QLIJRJ59aXLdB

  fZLNPq4hORYibp0xo4mdmThyXfHq9FUYPkmMQF3QkZOAFiaY0eFJhOBJZ2zrkJTA2DGm4Y5WQ

  uAYwM/ucaNwMlgaGvswnjsTUbB2uEfOI9RMgA+SRtHeexFLodpIxmICRCcZgW0jroJ8vXQXJH

  rkGMcbWp+5ZBLyW2wYDod8FjG4fb0dw7sRm6H7+smEB4D0h9Onq5ChVM+sG/I6uAh6Q3tnS9x

  AS+Cw4O/JAL2h6cHrBifHyUzAHz8qAkXjnnCtuIhTBB5wpaWcSwPLLbM22uZ77HM8wgiHSyv+

  AIEHAzLHn7HBRwEb1wZRUXc3jiI/MtTsDCveY5fBi/dHAHCsWsAzkzWI+JSc3uOU2TOsruKfP

  H9N5jIP3/WPZf0KoD1RT0Sp3m6VvI/8wVbHS7ypZ09wGm+cd7OGQiHyPb61P+8vbeKgciXTWV

  jTu+X6mxMFM0O2f9KXQb8KkF4nEGjUht1tEZLKUNCKKUylFpNha1V0CcoWsEkUYcYvdFAc0MF

  fZxVsCm6Q9p4hZ4x2gD3uOOPIevugTvXVU1gCYHIF0lb06uiZQvjEuJT1DSrPmhI0jJsE/AjC

  DmUJkRXR8s8DYyKST6s0XI/RBxDwkPuLd3Aj6VsIq1jNSph9AJsIRrL7aUo0TbN19yaj1ytG+

  DrA77KMH2CnvH1kZp4M8mb1Ul652rx/3UBf18vKXBxcZF5JDIGncb493wE+BBA7iUN5bd4aPR

  GZ4IRLhzChTMHV/HhjPSfkW8qUJhiF5jTCp9tQHatirLgV4hWyjrbfDuG3bt7K2W9sOZpDRnZ

  vTaiw30o0KNv62WXtrcbrXtuK9OL3COP6mwR+Q0l7WfVJ/eYNlNHtk+db8XYM9mZYejKneXni

  nWfrX0HAvq/UbA2b2a1z9KxVSgcDOovCloQ+qFy38V828feMzvkGKumlYGogaV/A2b/ri56BA

  AA

X-Env-Sender: prvs=1995195dcb=Lee.Stedman@nu-way.co.uk

X-Msg-Ref: server-20.tower-223.messagelabs.com!1554800019!3902096!1

X-Originating-IP: [217.46.240.45]

X-SpamReason: No, hits=1.0 required=7.0 tests=newsletters: ,

  EXTRA_MPART_TYPE,HTML_90_100,HTML_MESSAGE

X-StarScan-Received:

X-StarScan-Version: 9.31.5; banners=-,-,-

X-VirusChecked: Checked

Received: (qmail 29480 invoked from network); 9 Apr 2019 08:53:39 -0000

Received: from mail.nu-way.co.uk (HELO SophosEMailAppliance.HQ.nu-way.co.uk)

 (217.46.240.45)  by server-20.tower-223.messagelabs.com with

 DHE-RSA-AES256-GCM-SHA384 encrypted SMTP; 9 Apr 2019 08:53:39 -0000

Received: from SophosEMailAppliance.HQ.nu-way.co.uk (localhost.localdomain

 [127.0.0.1])  by localhost (Email Security Appliance) with SMTP id

 0EB2F1D0048_CAC5D93B  for <polly.mcdermott@realexpayments.com>; Tue,  9 Apr

 2019 08:53:39 +0000 (GMT)

Received: from SVRExchange.HQ.Nu-way.co.uk (svrexchange.hq.nu-way.co.uk

 [10.0.0.5])   by SophosEMailAppliance.HQ.nu-way.co.uk (Sophos Email Appliance)

 with ESMTP id 959801D0047_CAC5D91F   for <polly.mcdermott@realexpayments.com>;

 Tue,  9 Apr 2019 08:53:37 +0000 (GMT)

Received: from SVRExchange.HQ.Nu-way.co.uk (10.0.0.5) by

 SVRExchange.HQ.Nu-way.co.uk (10.0.0.5) with Microsoft SMTP Server (TLS) id

 15.0.847.32; Tue, 9 Apr 2019 09:53:37 +0100

Received: from SVRExchange.HQ.Nu-way.co.uk ([fe80::318c:6120:8458:fbc0]) by

 SVRExchange.HQ.Nu-way.co.uk ([fe80::318c:6120:8458:fbc0%12]) with mapi id

 15.00.0847.030; Tue, 9 Apr 2019 09:53:37 +0100

From: Lee Stedman <Lee.Stedman@nu-way.co.uk>

To: "polly.mcdermott@realexpayments.com"<polly.mcdermott@realexpayments.com>

CC: Chris Page <Chris.Page@nu-way.co.uk>

Subject: FW: VT User Change Request

Thread-Topic: VT User Change Request

Thread-Index: AdQStcDg+GdBEIfLQ3mppTYDtizR4BkichowHdxSQ2A=

Date: Tue, 9 Apr 2019 08:53:36 +0000

Message-ID: <e8b265dea145428fa29855d43cf71651@SVRExchange.HQ.Nu-way.co.uk>

References: <8f9ed2cc98d649549773776ebecd17fd@SVRExchange.HQ.Nu-way.co.uk>

In-Reply-To: <8f9ed2cc98d649549773776ebecd17fd@SVRExchange.HQ.Nu-way.co.uk>

Accept-Language: en-GB, en-US

Content-Language: en-US

X-MS-Has-Attach: yes

X-MS-TNEF-Correlator:

x-originating-ip: [10.0.1.29]

Content-Type: multipart/related;

        boundary="_007_e8b265dea145428fa29855d43cf71651SVRExchangeHQNuwaycouk_";

        type="multipart/alternative"

MIME-Version: 1.0

X-SASI-RCODE: 200

Hi,

We have many clients using messagelabs.com services

In the past few days we are having trouble receiving emails, we are geting timeouts

Anyone else has this problem?

Can someone from symantec help me?

postfix/smtpd[45787]: timeout after DATA (0 bytes) from mail1.bemta26.messagelabs.com[85.158.142.1]
postfix/smtpd[45787]: disconnect from mail1.bemta26.messagelabs.com[85.158.142.1]

postfix/smtpd[19898]: timeout after DATA (0 bytes) from mail1.bemta25.messagelabs.com[195.245.230.131]
postfix/smtpd[19898]: disconnect from mail1.bemta25.messagelabs.com[195.245.230.131]

postfix/smtpd[15445]: timeout after DATA (0 bytes) from mail1.bemta26.messagelabs.com[85.158.142.2]
postfix/smtpd[15445]: disconnect from mail1.bemta26.messagelabs.com[85.158.142.2]

Hello,

For the past two weeks we've been unable to send emails out to clients using Symantec. I checked our IP using the https://ipremoval.sms.symantec.com/ tool on the website. It shows the IP has a bad reputation however this isn't so. I have scanned the server serverally and checked online as well for any spam content which there isn't.

To further the investigaton, I contacted the hosting provider which could attest that there is no issue with the server and thus I should contact Symantec on this.

I have sent multiple emails but yet there hasn't been any single reply from Symantec. This is quiet frustating.. Is there anything than can be done about this?

The server has two IPs which one is currectly assigned to the domains:

Ns1.3rdfloorlimited.com (162.241.243.209) – all domains
Ns2.3rdfloorlimtied.com (162.241.243.211) - unassigned

Please investigate our IP address 162.241.243.209 / 162.241.243.211 and remove our ip address from your blacklist.

Emails are queued on our e-mail server outbound to all companies / domains that seem to use messagelabs clusters - are we somehow being blocked?

I have already reached out to investigation@review.symantec.com several times and have been given what feels like a brush-off.

Many of our customers/clients are MessageLabs customers and for the past few weeks we have been encountering serious deliverability issues with those clients.  The problem isn't that our emails are being filtered, it's what looks like a MessageLabs configuration issue or something else unrelated to us but support has yet to even acknowledge the problem.

I have uploaded a PDF of the SMTP Diag utility results as well as telnet sessions to the two MessageLabs MTAs (one that shows connections are accepted and one that shows "service temporarily unavailable" - except it always returns that message).  It is always server5.inboundmx.com that is the problem.

Sent: Monday, April 15, 2019 8:15 AM
To:'investigation@review.symantec.com'<investigation@review.symantec.com>
Subject: FW: Investigation Results
Importance: High

Good morning,

We continue to have problems sending to MessageLabs customers when our email servers try to connect to server5.inboundmx.com.  This is affecting our customers, who believe we are not being responsive to them.  We are a financial company and some of our emails, depending on the customer, may contain trade execution data that needs to be received in a timely manner.  We need to get this issue resolved ASAP.

Please see all of the below, including the follow up email I sent on 04/09/2018 and still have not received a reply to.

Delivery is delayed to these recipients or groups:

dpark@nettworth.us

bschwartz@nettworth.us

Subject: Dan Murphy | First Trust

This message hasn't been delivered yet. Delivery will continue to be attempted.

Diagnostic information for administrators:

Generating server: mx0a-00398b01.pphosted.com

dpark@nettworth.us
server5.inboundmx.com
Remote Server returned '<server5.inboundmx.com #4.4.1>'

bschwartz@nettworth.us
server5.inboundmx.com
Remote Server returned '<server5.inboundmx.com #4.4.1>'

Original message headers:

Return-Path: <SStoczynski@xxx.com>
Received: from pps.filterd (m0180415.ppops.net [127.0.0.1])
            by mx0a-00398b01.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x3CHTeZs028437;
            Fri, 12 Apr 2019 12:32:38 -0500
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ftportfolios.com; h=from : to :
subject : sender : date : message-id : content-type : mime-version;
s=dkim-ftportfolios; bh=62RbTxGsOMsu/gHJl7PH0eXr7eF/de9Ih2TIYKG++vQ=;
b=tNVyhtSxo/LDr+IdwsMFHZBaT3VaGeh8OuXij0qF5s921qDHQU4ECOkJNc07x2G0Pfl9
t5NiNz/Y/ZTc3UiGHopHvzCRx2LJFletUK3Y5f9nydconMIRwIPM+vQhEdwSe0q0l3hg
i0eMA8BeWFKekyTiZAlr7JfmBobyY2+MNMQF3VS69Wf23O9kiHMNZpfIHTgtvfGjPwcn
NjMPMXCoLA3RViLnutPF/oSMWq4dfjsCulDKPUUAYbGKGCLH0hP0tC9/prOftBMj6skn
MzyowVFD3Y4dpsGJwS/oFdlZxSwsKzL01NSLc6t3zhJq/BUJpz0fvVHShwtjilkWQHq0 Pw==
Received: from mail.ftportfolios.com (exchmbx02.ftportfolios.com [198.199.191.211])
            by mx0a-00398b01.pphosted.com with ESMTP id 2rtrtx0ajx-15
            (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT);
            Fri, 12 Apr 2019 12:32:38 -0500
Received: from MbxArc01.ftportfolios.com (10.1.0.228) by ExchMbx02.ftportfolios.com
(10.1.0.98) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 12 Apr 2019
12:32:42 -0500
Received: from ExchMbx01.ftportfolios.com (10.1.0.97) by MbxArc01.ftportfolios.com
(10.1.0.228) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 12 Apr
2019 12:32:36 -0500
Received: from ExchMbx01.ftportfolios.com ([fe80::dded:1736:e4bd:59fc]) by
ExchMbx01.ftportfolios.com ([fe80::dded:1736:e4bd:59fc%17]) with mapi id
15.00.1473.003; Fri, 12 Apr 2019 12:32:36 -0500
From: "Murphy, Dan"<DMurphy@xxx.com>
To: "dpark@nettworth.us"<dpark@nettworth.us>, "bschwartz@nettworth.us"
            <bschwartz@nettworth.us>
Subject: Dan Murphy | First Trust
Thread-Topic: Dan Murphy | First Trust
Thread-Index: AdTxVZsxowgZPeI7RripI5lnagqF2wAABwkA
Sender: "Stoczynski, Scott"<SStoczynski@xxx.com>
Date: Fri, 12 Apr 2019 17:32:36 +0000
Message-ID: <073a44f6ca9345e38280304c2f63c21d@ExchMbx01.ftportfolios.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ms-exchange-messagesentrepresentingtype: 2
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [10.1.0.90]
Content-Type: multipart/alternative;
            boundary="_000_073a44f6ca9345e38280304c2f63c21dExchMbx01nikeseclpcom_"
MIME-Version: 1.0
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:,, definitions=2019-04-12_10:,,
signatures=0
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501
malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0
clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0
mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx
scancount=1 engine=8.0.1-1810050000 definitions=main-1904120117

Sent: Tuesday, April 9, 2019 1:54 PM
To:'Symantec Brightmail Investigations'<investigation@review.symantec.com>
Subject: RE: Investigation Results
Importance: High

Thank you for the reply – I appreciate it.  I would disagree with the result however.  I’m not sure if you reviewed the delayed delivery attachment along with the samples I included (also attached here), because they indicate it is the MessageLabs MTAs that are responding with 4.4.1 and causing delayed delivery.

If it was our server causing the delay, there would be no server5.inboundmx.com Remote Server returned '<server5.inboundmx.com #4.4.1>'response.  Please also see the below screen capture, which illustrates the results of using a tool called smtpdiag to simulate an SMTP conversation from one of our MTAs to MessageLabs, using MX record lookup.  There is either a configuration problem with server5.inboundmx.com or we are being filtered/delayed/throttled by that server.  Connections to server4.inboundmx.com are properly accepted, which also reinforces there is an issue on the MessageLabs side and not ours.

Please also see the results of a telnet session, both to server5.inboundmx.com (first screen capture) and server4.inboundmx.com.  MessageLabs recipients are the only users we are currently having consistent issues sending to.

From: Symantec Brightmail Investigations <investigation@review.symantec.com>
Sent: Tuesday, April 9, 2019 12:53 PM

Subject: Investigation Results

Dear,

We received your sample message and found no Symantec filter sidelining it, which leads us to believe that Symantec Brightmail is not doing the filtering against your company's messages.

Best Regards,

Symantec Investigation Team

It seems there is large problems with messagelabs server. We get timeouts on delivering, online checks get timeouts.

I tried sending email to 'investigation@review.symantec.com' but the email does not exist.

Is there a way to fix the problem?

Hello,

  My name is Gordon Glover and I am a Systems Administrator at PIETech. I was informed by my users certain domains are not allowing emails to go from pietech.com or moneyguidepro.com to reach their clients. I talked to office365 and Symantec to resolve the issue. I was referred to the article - https://support.symantec.com/en_US/article.TECH82881.html

Which this article informed to send an email to verify we are not spamming and we are legitimate. However, the email - 'investigation@review.symantec.com' is no longer valid. I need these domains whitelisted please. 

Thank you.

The emails that we are sending to cluster9.us.messagelabs.com are being blocked, and or deferred with the following messages :

 Deferred: connect to cluster9.us.messagelabs.com[67.219.247.54]:25: Connection timed out