Given you are the service provider, the best place to look is in your abuse queue. Look for complaints about mail from that IP (and surrounding IPs) going back for a while. Typically, the consumer ISPs will put mail in the bulk folder for a while before escalating to a block. When the mail is going to bulk you will not see complaints as users cannot send FBL messages related to mail in the bulk folder. This means low complaint rates immediately before a block Do Not Mean that the mail is fine. In fact, it often means that the mail is already identified as spam. You need to go back further, to before MS was putting the messages in the bulk folder, in order to see complaints about it.
Going back over time will give you some information about what customer and what mail streams were causing problems. That should give you some insight into which customers you need to address to get the block lifted. The other place to look is your outbound logs. What are your customers doing and what types of mail are they sending? Did any customer have an unexpected spike in volume? This can often indicate a system may have been compromised and being used to send spam / malware. Sometimes it just means someone got the idea that sending ‘cold outreach mail’ was a good idea. Those are the two places I’d start my investigation in your situation. laura > On 11 May 2021, at 12:54, Benoit Panizzon via mailop <mailop@mailop.org> > wrote: > > Dear List > > One of our main smtp outbound ip addresses is blocked by microsoft. > > host outlook-com.olc.protection.outlook.com[104.47.10.33] said: 550 5.7.1 > Unfortunately, messages from [157.161.12.84] weren't sent. Please > contact > your Internet service provider since part of their network is on our > block > list (S3150). You can also refer your provider to > http://mail.live.com/mail/troubleshooting.aspx#errors. > [DB5EUR03FT006.eop-EUR03.prod.protection.outlook.com] (in reply to MAIL > FROM command) > > I checked our JMRP entries. This IP is listed as one of our > mailservers. The complaint rate is < 0.1% but it had 2 'trap' hits and > is in status red. > > Our abuse desk email address is registered for the ARF feedback loop > for the ip range in question. > > We usually get a lot of feedback loop emails, mostly false positives of > Mirosoft users mixing up 'junk' with their trash folder or similar, or > moving all their old mail to 'junk' causing an avalanche of complaints > being sent. I opened several cases with Microsoft about this, but never > got any solution offered (as a sidenote rant) > > But no, there were no complaints about: 157.161.12.84 received. > > Does anyone know, how to get hold of the emails that caused this > blocking? > > Mit freundlichen Grüssen > > -Benoît Panizzon- > -- > I m p r o W a r e A G - Leiter Commerce Kunden > ______________________________________________________ > > Zurlindenstrasse 29 Tel +41 61 826 93 00 > CH-4133 Pratteln Fax +41 61 826 93 01 > Schweiz Web http://www.imp.ch > ______________________________________________________ > _______________________________________________ > mailop mailing list > mailop@mailop.org > https://list.mailop.org/listinfo/mailop -- Having an Email Crisis? We can help! 800 823-9674 Laura Atkins Word to the Wise la...@wordtothewise.com (650) 437-0741 Email Delivery Blog: https://wordtothewise.com/blog
_______________________________________________ mailop mailing list mailop@mailop.org https://list.mailop.org/listinfo/mailop
