date:20160205

Re: [mailop] Spike in "554 Transaction failed" from Microsoft properties

2016-02-05 Thread frnkblk

Thanks for the additional data points -- so it isn't just me.

What's nasty is that the messages are kicked back to the sender, not just 
delayed.

Frank

-Original Message-
From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Frank Bulk
Sent: Friday, February 05, 2016 5:27 PM
To: mailop@mailop.org
Subject: [mailop] Spike in "554 Transaction failed" from Microsoft properties

Today we had an abnormal number of messages that failed to deliver to
Microsoft properties due to "554 Transaction failed".

We had 31 today, but only 6 over the previous 7 days.

Now some are email blasts from churches, so perhaps they are emailing
specific content, but I don't know what the "554 Transaction failed" means.

Frank

Here's a sanitized list from today:

 5 08:52:28.00 [104824074] Failed 
 18208 <000501d16024$d63bafa0$82b30ee0$@net> "Site
hotmail.com (207.46.8.167) said in response to MAIL FROM (554 Transaction
failed)"
 5 08:55:19.00 [104824142] Failed  
183286 <56B4B7C3.49.03428@GERRIT-PC> "Site msn.com (207.46.8.167) said
in response to MAIL FROM (554 Transaction failed)"
 5 09:07:09.00 [104825044] Failed  "[127.0.0.1]
Site hotmail.com (207.46.8.199) said in response to MAIL FROM (554
Transaction failed)"
 5 12:05:35.00 [104837331] Failed 
"[199.120.69.25] Site live.com (207.46.8.167) said in response to MAIL FROM
(554 Transaction failed)"
 5 14:37:36.00 [104845849] Failed  "[127.0.0.1]
Site hotmail.com (65.55.33.135) said in response to MAIL FROM (554
Transaction failed)"
 5 14:37:36.00 [104845849] Failed  "[127.0.0.1]
Site hotmail.com (65.55.33.135) said in response to MAIL FROM (554
Transaction failed)"
 5 14:37:36.00 [104845849] Failed  "[127.0.0.1]
Site hotmail.com (65.55.33.135) said in response to MAIL FROM (554
Transaction failed)"
 5 14:37:36.00 [104845849] Failed  "[127.0.0.1]
Site hotmail.com (65.55.33.135) said in response to MAIL FROM (554
Transaction failed)"
 5 14:37:36.00 [104845849] Failed  "[127.0.0.1]
Site hotmail.com (65.55.33.135) said in response to MAIL FROM (554
Transaction failed)"
 5 14:37:36.00 [104845849] Failed  "[127.0.0.1]
Site hotmail.com (65.55.33.135) said in response to MAIL FROM (554
Transaction failed)"
 5 14:37:36.00 [104845849] Failed  "[127.0.0.1]
Site hotmail.com (65.55.33.135) said in response to MAIL FROM (554
Transaction failed)"
 5 15:22:22.00 [104848164] Failed  "[127.0.0.1] Site
hotmail.com (207.46.8.167) said in response to MAIL FROM (554 Transaction
failed)"
 5 15:22:22.00 [104848164] Failed  "[127.0.0.1] Site
hotmail.com (207.46.8.167) said in response to MAIL FROM (554 Transaction
failed)"
 5 15:22:22.00 [104848164] Failed  "[127.0.0.1] Site
hotmail.com (207.46.8.167) said in response to MAIL FROM (554 Transaction
failed)"
 5 16:05:03.00 [104849737] Failed 
 14868
<002e01d16061$42762bf0$c76283d0$@siebrechtcpas.com> "Site hotmail.com
(207.46.8.167) said in response to MAIL FROM (554 Transaction failed)"
 5 16:36:01.00 [104850620] Failed  
30429  "Site msn.com (207.46.8.167)
said in response to MAIL FROM (554 Transaction failed)"
 5 16:36:01.00 [104850620] Failed  
30429  "Site msn.com (207.46.8.167)
said in response to MAIL FROM (554 Transaction failed)"
 5 16:36:01.00 [104850620] Failed  
30429  "Site msn.com (207.46.8.167)
said in response to MAIL FROM (554 Transaction failed)"
 5 16:36:01.00 [104850620] Failed  
30429  "Site msn.com (207.46.8.167)
said in response to MAIL FROM (554 Transaction failed)"
 5 16:36:01.00 [104850620] Failed  
30429  "Site msn.com (207.46.8.167)
said in response to MAIL FROM (554 Transaction failed)"
 5 16:36:01.00 [104850620] Failed  
30429  "Site msn.com (207.46.8.167)
said in response to MAIL FROM (554 Transaction failed)"
 5 16:36:01.00 [104850620] Failed  
30429  "Site msn.com (207.46.8.167)
said in response to MAIL FROM (554 Transaction failed)"
 5 16:36:01.00 [104850620] Failed  
30429  "Site msn.com (207.46.8.167)
said in response to MAIL FROM

Re: [mailop] Gmail throttles anyway

2016-02-05 Thread Matthias Leisi


> Am 04.02.2016 um 22:41 schrieb Brandon Long :
> That's what I think is the case, indeed. Hetzner is the provider.
> 
> It is a netblock quota you're hitting, yes.  As we see more and larger hit 
> and run spam jobs from previously unknown or low volume IPs and netblocks, 
> the low volume senders are caught in the cross fire.

At dnswl.org  we’ve seen an increased number of spam sources 
at Hetzner over the past few weeks. We do not see mail content, just DNS 
lookups (other than through a couple of spamtraps), but there seems to be a 
pattern to it: „new“ IP, using Hetzner’s default rDNS, starting with large 
volumes per IP right away, IPs scattered around Hetzner netblocks „randomly“. 

> I'll ping the spam team about the messaging again, saying IP is definitely 
> wrong there.  And I can ping them about better handling about this, they've 
> made some improvements recently, but it's a hard problem.

Reputation by AS is indeed non-trivial. It works well for most ASes, but for 
"tightly packed" ASes such as for large hosters, it’s usefulness is limited.

— Matthias


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

[mailop] Anyone from Proofpoint around?

2016-02-05 Thread Michael Ellis

I have a client that gets bounces saying they are blocked but when you check
it says they are not

 

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Anyone from Proofpoint around?

2016-02-05 Thread Jaren Angerbauer

Replied off list.

--Jaren

On Fri, Feb 5, 2016 at 2:41 PM, Michael Ellis  wrote:

> I have a client that gets bounces saying they are blocked but when you
> check it says they are not
>
>
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Spike in "554 Transaction failed" from Microsoft properties

2016-02-05 Thread Gilles Chehade

Hi,

FWIW, I observed the same today while exhanging quite low volumes

Gilles

Le 6 févr. 2016 12:27 AM, Frank Bulk  a écrit :
>
> Today we had an abnormal number of messages that failed to deliver to
> Microsoft properties due to "554 Transaction failed".
>
> We had 31 today, but only 6 over the previous 7 days.
>
> Now some are email blasts from churches, so perhaps they are emailing
> specific content, but I don't know what the "554 Transaction failed" means.
>
> Frank
>
> Here's a sanitized list from today:
>
> 5 08:52:28.00 [104824074] Failed 
>  18208 <000501d16024$d63bafa0$82b30ee0$@net> "Site
> hotmail.com (207.46.8.167) said in response to MAIL FROM (554 Transaction
> failed)"
> 5 08:55:19.00 [104824142] Failed  
> 183286 <56B4B7C3.49.03428@GERRIT-PC> "Site msn.com (207.46.8.167) said
> in response to MAIL FROM (554 Transaction failed)"
> 5 09:07:09.00 [104825044] Failed  "[127.0.0.1]
> Site hotmail.com (207.46.8.199) said in response to MAIL FROM (554
> Transaction failed)"
> 5 12:05:35.00 [104837331] Failed 
> "[199.120.69.25] Site live.com (207.46.8.167) said in response to MAIL FROM
> (554 Transaction failed)"
> 5 14:37:36.00 [104845849] Failed  "[127.0.0.1]
> Site hotmail.com (65.55.33.135) said in response to MAIL FROM (554
> Transaction failed)"
> 5 14:37:36.00 [104845849] Failed  "[127.0.0.1]
> Site hotmail.com (65.55.33.135) said in response to MAIL FROM (554
> Transaction failed)"
> 5 14:37:36.00 [104845849] Failed  "[127.0.0.1]
> Site hotmail.com (65.55.33.135) said in response to MAIL FROM (554
> Transaction failed)"
> 5 14:37:36.00 [104845849] Failed  "[127.0.0.1]
> Site hotmail.com (65.55.33.135) said in response to MAIL FROM (554
> Transaction failed)"
> 5 14:37:36.00 [104845849] Failed  "[127.0.0.1]
> Site hotmail.com (65.55.33.135) said in response to MAIL FROM (554
> Transaction failed)"
> 5 14:37:36.00 [104845849] Failed  "[127.0.0.1]
> Site hotmail.com (65.55.33.135) said in response to MAIL FROM (554
> Transaction failed)"
> 5 14:37:36.00 [104845849] Failed  "[127.0.0.1]
> Site hotmail.com (65.55.33.135) said in response to MAIL FROM (554
> Transaction failed)"
> 5 15:22:22.00 [104848164] Failed  "[127.0.0.1] Site
> hotmail.com (207.46.8.167) said in response to MAIL FROM (554 Transaction
> failed)"
> 5 15:22:22.00 [104848164] Failed  "[127.0.0.1] Site
> hotmail.com (207.46.8.167) said in response to MAIL FROM (554 Transaction
> failed)"
> 5 15:22:22.00 [104848164] Failed  "[127.0.0.1] Site
> hotmail.com (207.46.8.167) said in response to MAIL FROM (554 Transaction
> failed)"
> 5 16:05:03.00 [104849737] Failed 
>  14868
> <002e01d16061$42762bf0$c76283d0$@siebrechtcpas.com> "Site hotmail.com
> (207.46.8.167) said in response to MAIL FROM (554 Transaction failed)"
> 5 16:36:01.00 [104850620] Failed  
> 30429  "Site msn.com (207.46.8.167)
> said in response to MAIL FROM (554 Transaction failed)"
> 5 16:36:01.00 [104850620] Failed  
> 30429  "Site msn.com (207.46.8.167)
> said in response to MAIL FROM (554 Transaction failed)"
> 5 16:36:01.00 [104850620] Failed  
> 30429  "Site msn.com (207.46.8.167)
> said in response to MAIL FROM (554 Transaction failed)"
> 5 16:36:01.00 [104850620] Failed  
> 30429  "Site msn.com (207.46.8.167)
> said in response to MAIL FROM (554 Transaction failed)"
> 5 16:36:01.00 [104850620] Failed  
> 30429  "Site msn.com (207.46.8.167)
> said in response to MAIL FROM (554 Transaction failed)"
> 5 16:36:01.00 [104850620] Failed  
> 30429  "Site msn.com (207.46.8.167)
> said in response to MAIL FROM (554 Transaction failed)"
> 5 16:36:01.00 [104850620] Failed  
> 30429  "Site msn.com (207.46.8.167)
> said in response to MAIL FROM (554 Transaction failed)"
> 5 16:36:01.00 [104850620] Failed  
> 30429  "Site msn.com (207.46.8.167)
> said in response to MAIL FROM (554 Transaction failed)"
> 5 16:39:21.00 [104851087] Failed  "Site hotmail.com
>

Re: [mailop] Spike in "554 Transaction failed" from Microsoft properties

2016-02-05 Thread Chris Vervais

On Feb 5, 2016, at 3:27 PM, Frank Bulk  wrote:

> Today we had an abnormal number of messages that failed to deliver to
> Microsoft properties due to "554 Transaction failed".
> 
> We had 31 today, but only 6 over the previous 7 days.
> 
> Now some are email blasts from churches, so perhaps they are emailing
> specific content, but I don't know what the "554 Transaction failed" means.
> 
> Frank

We saw a small (and I mean small on our scale) spike as well. Looks like it 
started around 3am pacific and is still going on but, it’s really really small.
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

[mailop] Barracuda false positives

2016-02-05 Thread Joe Evans


Hi guys,

I was notified there were some false positives occurring on the 
Barracuda Blacklist at b.barracudacentral.org. Unfortunately, I wasn't a 
member of this list until recently and I can't seem to find an archive 
of the mails. If have you experienced false positives on our list, could 
you please send me details off-list so I can investigate and get the 
problem fixed?


Thanks.
--

*Joe Evans*
/Technical Manager, Barracuda Central Content/
3175 S. Winchester Blvd • Campbell, CA 95008
Connect with us: barracuda.com/connect 


===


Considering Office 365?  Barracuda security and storage solutions can help. 
Learn more about Barracuda solutions for Office 365 at 
http://barracuda.com/office365.

DISCLAIMER:
This e-mail and any attachments to it contain confidential and proprietary 
material of Barracuda, its affiliates or agents, and is solely for the use of 
the intended recipient. Any review, use, disclosure, distribution or copying of 
this transmittal is prohibited except by or on behalf of the intended 
recipient. If you have received this transmittal in error, please notify the 
sender and destroy this e-mail and any attachments and all copies, whether 
electronic or printed.

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Anyone from Proofpoint around?

2016-02-05 Thread Michelle Sullivan

I'll leave you to it then :P

Jaren Angerbauer wrote:
> Replied off list.
>
> --Jaren
>
> On Fri, Feb 5, 2016 at 2:41 PM, Michael Ellis  > wrote:
>
> I have a client that gets bounces saying they are blocked but when
> you check it says they are not
>
>  
>
>
> ___
> mailop mailing list
> mailop@mailop.org 
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
>
> 
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>   


-- 
Michelle Sullivan
http://www.mhix.org/


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

[mailop] Spike in "554 Transaction failed" from Microsoft properties

2016-02-05 Thread Frank Bulk

Today we had an abnormal number of messages that failed to deliver to
Microsoft properties due to "554 Transaction failed".

We had 31 today, but only 6 over the previous 7 days.

Now some are email blasts from churches, so perhaps they are emailing
specific content, but I don't know what the "554 Transaction failed" means.

Frank

Here's a sanitized list from today:

 5 08:52:28.00 [104824074] Failed 
 18208 <000501d16024$d63bafa0$82b30ee0$@net> "Site
hotmail.com (207.46.8.167) said in response to MAIL FROM (554 Transaction
failed)"
 5 08:55:19.00 [104824142] Failed  
183286 <56B4B7C3.49.03428@GERRIT-PC> "Site msn.com (207.46.8.167) said
in response to MAIL FROM (554 Transaction failed)"
 5 09:07:09.00 [104825044] Failed  "[127.0.0.1]
Site hotmail.com (207.46.8.199) said in response to MAIL FROM (554
Transaction failed)"
 5 12:05:35.00 [104837331] Failed 
"[199.120.69.25] Site live.com (207.46.8.167) said in response to MAIL FROM
(554 Transaction failed)"
 5 14:37:36.00 [104845849] Failed  "[127.0.0.1]
Site hotmail.com (65.55.33.135) said in response to MAIL FROM (554
Transaction failed)"
 5 14:37:36.00 [104845849] Failed  "[127.0.0.1]
Site hotmail.com (65.55.33.135) said in response to MAIL FROM (554
Transaction failed)"
 5 14:37:36.00 [104845849] Failed  "[127.0.0.1]
Site hotmail.com (65.55.33.135) said in response to MAIL FROM (554
Transaction failed)"
 5 14:37:36.00 [104845849] Failed  "[127.0.0.1]
Site hotmail.com (65.55.33.135) said in response to MAIL FROM (554
Transaction failed)"
 5 14:37:36.00 [104845849] Failed  "[127.0.0.1]
Site hotmail.com (65.55.33.135) said in response to MAIL FROM (554
Transaction failed)"
 5 14:37:36.00 [104845849] Failed  "[127.0.0.1]
Site hotmail.com (65.55.33.135) said in response to MAIL FROM (554
Transaction failed)"
 5 14:37:36.00 [104845849] Failed  "[127.0.0.1]
Site hotmail.com (65.55.33.135) said in response to MAIL FROM (554
Transaction failed)"
 5 15:22:22.00 [104848164] Failed  "[127.0.0.1] Site
hotmail.com (207.46.8.167) said in response to MAIL FROM (554 Transaction
failed)"
 5 15:22:22.00 [104848164] Failed  "[127.0.0.1] Site
hotmail.com (207.46.8.167) said in response to MAIL FROM (554 Transaction
failed)"
 5 15:22:22.00 [104848164] Failed  "[127.0.0.1] Site
hotmail.com (207.46.8.167) said in response to MAIL FROM (554 Transaction
failed)"
 5 16:05:03.00 [104849737] Failed 
 14868
<002e01d16061$42762bf0$c76283d0$@siebrechtcpas.com> "Site hotmail.com
(207.46.8.167) said in response to MAIL FROM (554 Transaction failed)"
 5 16:36:01.00 [104850620] Failed  
30429  "Site msn.com (207.46.8.167)
said in response to MAIL FROM (554 Transaction failed)"
 5 16:36:01.00 [104850620] Failed  
30429  "Site msn.com (207.46.8.167)
said in response to MAIL FROM (554 Transaction failed)"
 5 16:36:01.00 [104850620] Failed  
30429  "Site msn.com (207.46.8.167)
said in response to MAIL FROM (554 Transaction failed)"
 5 16:36:01.00 [104850620] Failed  
30429  "Site msn.com (207.46.8.167)
said in response to MAIL FROM (554 Transaction failed)"
 5 16:36:01.00 [104850620] Failed  
30429  "Site msn.com (207.46.8.167)
said in response to MAIL FROM (554 Transaction failed)"
 5 16:36:01.00 [104850620] Failed  
30429  "Site msn.com (207.46.8.167)
said in response to MAIL FROM (554 Transaction failed)"
 5 16:36:01.00 [104850620] Failed  
30429  "Site msn.com (207.46.8.167)
said in response to MAIL FROM (554 Transaction failed)"
 5 16:36:01.00 [104850620] Failed  
30429  "Site msn.com (207.46.8.167)
said in response to MAIL FROM (554 Transaction failed)"
 5 16:39:21.00 [104851087] Failed  "Site hotmail.com
(65.55.33.119) said in response to MAIL FROM (554 Transaction failed)"
 5 07:03:14.00 [77653425] Failed  "Site
hotmail.com (207.46.8.167) said in response to MAIL FROM (554 Transaction
failed)"
 5 07:40:00.00 [77656936] Failed

Re: [mailop] Gmail throttles anyway

2016-02-05 Thread SM


Hi Michael,
At 17:27 04-02-2016, Michael Wise wrote:
If you're going to do something that will break the DKIM signature 
as a matter of course,

You should remove the DKIM signature, and maybe re-sign it with your own.

You shouldn't break the signature and then forward what was once 
goodmail with a now busted signature.


The issue with removing a DKIM signature which would get broken is 
that it is not easy to reverse the removal in future.  It is better 
[1] to treat the "broken" DKIM signature as unsigned.


Regards,
-sm

1. This depends on the receivers you are sending mail to. 



___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Spike in "554 Transaction failed" from Microsoft properties

Re: [mailop] Gmail throttles anyway

[mailop] Anyone from Proofpoint around?

Re: [mailop] Anyone from Proofpoint around?

Re: [mailop] Spike in "554 Transaction failed" from Microsoft properties

Re: [mailop] Spike in "554 Transaction failed" from Microsoft properties

[mailop] Barracuda false positives

Re: [mailop] Anyone from Proofpoint around?

[mailop] Spike in "554 Transaction failed" from Microsoft properties

Re: [mailop] Gmail throttles anyway

10 matches

Site Navigation

Mail list logo

Footer information