Re: [mailop] Barracuda false positives

[Joe Evans]

Thanks to everyone who responded off-list.

Has anyone noticed any new questionable false-positives from the 
b.barracudacentral.org blacklist over the past few days? We have 
implemented better logging to provide better insight on why these false 
positives are occurring and I'd greatly appreciate any feedback on this.


*Joe Evans*
/Technical Manager, Barracuda Central Content/
3175 S. Winchester Blvd • Campbell, CA 95008
Connect with us: barracuda.com/connect 

On 02/05/2016 05:12 PM, Joe Evans wrote:

Hi guys,

I was notified there were some false positives occurring on the 
Barracuda Blacklist at b.barracudacentral.org. Unfortunately, I wasn't 
a member of this list until recently and I can't seem to find an 
archive of the mails. If have you experienced false positives on our 
list, could you please send me details off-list so I can investigate 
and get the problem fixed?


Thanks.
--

*Joe Evans*
/Technical Manager, Barracuda Central Content/
3175 S. Winchester Blvd • Campbell, CA 95008
Connect with us: barracuda.com/connect 


==

Considering Office 365? Barracuda security and storage solutions can 
help. Learn more about Barracuda solutions for Office 365 at 
*http://barracuda.com/office365*.



*DISCLAIMER:* This e-mail and any attachments to it contain 
confidential and proprietary material of Barracuda, its affiliates or 
agents, and is solely for the use of the intended recipient. Any 
review, use, disclosure, distribution or copying of this transmittal 
is prohibited except by or on behalf of the intended recipient. If you 
have received this transmittal in error, please notify the sender and 
destroy this e-mail and any attachments and all copies, whether 
electronic or printed.


==
  ­­ 



===


Considering Office 365?  Barracuda security and storage solutions can help. 
Learn more about Barracuda solutions for Office 365 at 
http://barracuda.com/office365.

DISCLAIMER:
This e-mail and any attachments to it contain confidential and proprietary 
material of Barracuda, its affiliates or agents, and is solely for the use of 
the intended recipient. Any review, use, disclosure, distribution or copying of 
this transmittal is prohibited except by or on behalf of the intended 
recipient. If you have received this transmittal in error, please notify the 
sender and destroy this e-mail and any attachments and all copies, whether 
electronic or printed.

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] DKIM issues with mails from outbound.protection.outlook.com

[Franck Martin via mailop]

Email forwarded within Office365 may have DKIM breakage, Microsoft has been
addressing the issue, I believe.

Mimecast is a known to me to break DKIM when forwarding.

On Thu, Feb 11, 2016 at 3:53 AM, Chris Burton  wrote:

> Hi,
>
> > Did anyone notice DKIM issues (mails failing signature verification or
> body
> > hash not matching) with mails coming from these servers?
>
> We're also using exim and seeing signature_incorrect and
> bodyhash_mismatch issues via
>
> emea01-am1-obe.outbound.protection.outlook.com
> emea01-db3-obe.outbound.protection.outlook.com
> EUR01-HE1-obe.outbound.protection.outlook.com
> EUR01-VE1-obe.outbound.protection.outlook.com
> na01-bl2-obe.outbound.protection.outlook.com
> na01-bn1-obe.outbound.protection.outlook.com
>
> And some being relayed out via mimecast.com that show errors
> validating DKIM on a *.onmicrosoft.com sender.
>
> Could this be a similar issue to
> https://bergs.biz/blog/2014/04/10/outlook-com-breaks-dkim-signatures/
> ?
>
> I've only got an outlook.com account to test with (which doesn't use
> DKIM) but relaying an email via smtp-mail.outlook.com without quotes
> on the Content-Type charset they are added in by the time the mail
> reaches our exim server.
>
> Chris.
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] What to do with Amazon SES?

[Steve Atkins]

> On Feb 11, 2016, at 9:17 AM, Petar Bogdanovic  wrote:
> 
> How should one handle Amazon SES abuse?  I'm seeing more and more junk
> from them but I also don't remember my abuse reports getting far.

~ ∙ whois -h whois.abuse.net amazonses.com
email-ab...@amazon.com (for amazonses.com)

That gets the reports in front of the right eyeballs.

I have seen spammers using amazonses who have stopped mailing from amazonses, 
moving to less abuse-hostile providers (gmail, typically) after reports to 
email-ab...@amazon.com so while you won’t get any response, they do take action 
sometimes.

Cheers,
  Steve 
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] What to do with Amazon SES?

[Paul Kincaid-Smith via mailop]

Hi Petar,

Amazon has an email-specific abuse address: email-ab...@amazon.com. Let me
know if you need to escalate, and I'll make off-list introductions to the
good folks on Amazon's email anti-spam team.

Cheers,

Paul Kincaid-Smith
VP of Email Delivery

SendGrid -- Email Delivery. Simplified.

On Thu, Feb 11, 2016 at 10:17 AM, Petar Bogdanovic  wrote:

> How should one handle Amazon SES abuse?  I'm seeing more and more junk
> from them but I also don't remember my abuse reports getting far.
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Spike in "554 Transaction failed" from Microsoft properties

[Michael Wise]

Forwarded it on, thanks!

Aloha,
Michael.
-- 
Michael J Wise | Microsoft | Spam Analysis | "Your Spam Specimen Has Been 
Processed." | Got the Junk Mail Reporting Tool ?

-Original Message-
From: David Hofstee [mailto:da...@mailplus.nl] 
Sent: Thursday, February 11, 2016 1:18 AM
To: Michael Wise ; mailop@mailop.org
Subject: RE: [mailop] Spike in "554 Transaction failed" from Microsoft 
properties

Not yet...

x...@live.nl:2016-02-10 20:00:05+0100,ret-uid-...@bounces.mailplus.nl,smtp;554 
Transaction 
failed,https://na01.safelinks.protection.outlook.com/?url=mx2.hotmail.com&data=01%7c01%7cMichael.Wise%40microsoft.com%7c846bc3920e894b1f156208d332c4499f%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=jT8zIBvFdy64%2bvrPjLNc3U%2bKQeCSj7zqH0ODdNce6yg%3d
 (207.46.8.199),46.31.52.5,207.46.8.199
x...@live.nl:2016-02-10 20:04:42+0100,ret-uid-...@bounces.mailplus.nl,smtp;554 
Transaction 
failed,https://na01.safelinks.protection.outlook.com/?url=mx2.hotmail.com&data=01%7c01%7cMichael.Wise%40microsoft.com%7c846bc3920e894b1f156208d332c4499f%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=jT8zIBvFdy64%2bvrPjLNc3U%2bKQeCSj7zqH0ODdNce6yg%3d
 (207.46.8.199),46.31.52.5,207.46.8.199
x...@hotmail.com:2016-02-10 
20:57:35+0100,ret-uid-...@bounces.mailplus.nl,smtp;554 Transaction 
failed,https://na01.safelinks.protection.outlook.com/?url=mx2.hotmail.com&data=01%7c01%7cMichael.Wise%40microsoft.com%7c846bc3920e894b1f156208d332c4499f%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=jT8zIBvFdy64%2bvrPjLNc3U%2bKQeCSj7zqH0ODdNce6yg%3d
 (207.46.8.199),46.31.53.6,207.46.8.199
x...@hotmail.com:2016-02-11 03:51:27+0100,fm-...@return.flowmailer.net,smtp;554 
Transaction 
failed,https://na01.safelinks.protection.outlook.com/?url=mx1.hotmail.com&data=01%7c01%7cMichael.Wise%40microsoft.com%7c846bc3920e894b1f156208d332c4499f%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=uBbI5GMwB4JkF53zVSy%2bQzgedqVjptajWv84b%2f8hupA%3d
 (207.46.8.199),46.31.52.130,207.46.8.199
x...@hotmail.com:2016-02-11 
04:06:50+0100,ret-uid-...@bounces.mailplus.nl,smtp;554 Transaction 
failed,https://na01.safelinks.protection.outlook.com/?url=mx1.hotmail.com&data=01%7c01%7cMichael.Wise%40microsoft.com%7c846bc3920e894b1f156208d332c4499f%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=uBbI5GMwB4JkF53zVSy%2bQzgedqVjptajWv84b%2f8hupA%3d
 (207.46.8.199),46.31.52.14,207.46.8.199
x...@hotmail.com:2016-02-11 08:31:47+0100,fm-...@return.flowmailer.net,smtp;554 
Transaction 
failed,https://na01.safelinks.protection.outlook.com/?url=mx4.hotmail.com&data=01%7c01%7cMichael.Wise%40microsoft.com%7c846bc3920e894b1f156208d332c4499f%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=cG2kgPKyDVfD9SJhz3grOq3YhEnnkxu36ryxUNB9UlE%3d
 (207.46.8.199),46.31.52.130,207.46.8.199
x...@hotmail.com:2016-02-11 09:02:41+0100,fm-...@return.flowmailer.net,smtp;554 
Transaction 
failed,https://na01.safelinks.protection.outlook.com/?url=mx4.hotmail.com&data=01%7c01%7cMichael.Wise%40microsoft.com%7c846bc3920e894b1f156208d332c4499f%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=cG2kgPKyDVfD9SJhz3grOq3YhEnnkxu36ryxUNB9UlE%3d
 (207.46.8.199),46.31.52.133,207.46.8.199
x...@hotmail.com:2016-02-11 09:07:09+0100,fm-...@return.flowmailer.net,smtp;554 
Transaction 
failed,https://na01.safelinks.protection.outlook.com/?url=mx4.hotmail.com&data=01%7c01%7cMichael.Wise%40microsoft.com%7c846bc3920e894b1f156208d332c4499f%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=cG2kgPKyDVfD9SJhz3grOq3YhEnnkxu36ryxUNB9UlE%3d
 (207.46.8.199),46.31.52.130,207.46.8.199
x...@hotmail.com:2016-02-11 09:18:09+0100,fm-...@return.flowmailer.net,smtp;554 
Transaction 
failed,https://na01.safelinks.protection.outlook.com/?url=mx4.hotmail.com&data=01%7c01%7cMichael.Wise%40microsoft.com%7c846bc3920e894b1f156208d332c4499f%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=cG2kgPKyDVfD9SJhz3grOq3YhEnnkxu36ryxUNB9UlE%3d
 (207.46.8.199),46.31.52.133,207.46.8.199
x...@hotmail.com:2016-02-11 09:21:13+0100,fm-...@return.flowmailer.net,smtp;554 
Transaction 
failed,https://na01.safelinks.protection.outlook.com/?url=mx4.hotmail.com&data=01%7c01%7cMichael.Wise%40microsoft.com%7c846bc3920e894b1f156208d332c4499f%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=cG2kgPKyDVfD9SJhz3grOq3YhEnnkxu36ryxUNB9UlE%3d
 (207.46.8.199),46.31.52.133,207.46.8.199


Met vriendelijke groet,


David Hofstee

Deliverability Management
MailPlus B.V. Netherlands

-Oorspronkelijk bericht-
Van: Michael Wise [mailto:michael.w...@microsoft.com]
Verzonden: woensdag 10 februari 2016 20:32
Aan: David Hofstee; mailop@mailop.org
Onderwerp: RE: [mailop] Spike in "554 Transaction failed" from Microsoft 
properties

The number should be tending towards 0.0% shortly if not already.

Aloha,
Michael.
--
Michael J Wise | Microsoft | Spam Analysis | "Your Spam Specimen Has Been 
Processed." | Got the Junk Mail Reporting Tool ?

-Original Message-
From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of David Hofstee
Sent: Tuesday, February 9, 2016 11:50 PM
To: mailop@mailop.org
Subject: Re: [mailop] Spi

[mailop] What to do with Amazon SES?

[Petar Bogdanovic]

How should one handle Amazon SES abuse?  I'm seeing more and more junk
from them but I also don't remember my abuse reports getting far.

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

[mailop] Anybody here familiar with setting up authentication on Windows (particularly Exchange Server)?

[Anne Mitchell]

Is anybody here familiar with setting up authentication (particularly DKIM) on 
Windows products (particularly Exchange Server)?

If so, please contact me offlist at amitch...@isipp.com.

Thanks!

Anne

Anne P. Mitchell, 
Attorney at Law
CEO/President, 
SuretyMail Email Reputation Certification
Is Email You Send Being Junked? Get to the Inbox Using Your Own Mail System!
http://www.SuretyMail.com/
http://www.SuretyMail.eu/

"Email marketing is the one place where it's better to ask permission than 
forgiveness." - Me

Author: Section 6 of the CAN-SPAM Act of 2003 (the Federal anti-spam law)
Member, California Bar Cyberspace Law Committee
Member, Colorado Cybersecurity Consortium
Ret. Professor of Law, Lincoln Law School of San Jose
303-731-2121 | amitch...@isipp.com | @AnnePMitchell
Facebook/AnnePMitchell  | LinkedIn/in/annemitchell


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] DKIM issues with mails from outbound.protection.outlook.com

[Chris Burton]

Hi,

> Did anyone notice DKIM issues (mails failing signature verification or body
> hash not matching) with mails coming from these servers?

We're also using exim and seeing signature_incorrect and
bodyhash_mismatch issues via

emea01-am1-obe.outbound.protection.outlook.com
emea01-db3-obe.outbound.protection.outlook.com
EUR01-HE1-obe.outbound.protection.outlook.com
EUR01-VE1-obe.outbound.protection.outlook.com
na01-bl2-obe.outbound.protection.outlook.com
na01-bn1-obe.outbound.protection.outlook.com

And some being relayed out via mimecast.com that show errors
validating DKIM on a *.onmicrosoft.com sender.

Could this be a similar issue to
https://bergs.biz/blog/2014/04/10/outlook-com-breaks-dkim-signatures/
?

I've only got an outlook.com account to test with (which doesn't use
DKIM) but relaying an email via smtp-mail.outlook.com without quotes
on the Content-Type charset they are added in by the time the mail
reaches our exim server.

Chris.

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Spike in "554 Transaction failed" from Microsoft properties

[David Hofstee]

Not yet...

x...@live.nl:2016-02-10 20:00:05+0100,ret-uid-...@bounces.mailplus.nl,smtp;554 
Transaction failed,mx2.hotmail.com (207.46.8.199),46.31.52.5,207.46.8.199
x...@live.nl:2016-02-10 20:04:42+0100,ret-uid-...@bounces.mailplus.nl,smtp;554 
Transaction failed,mx2.hotmail.com (207.46.8.199),46.31.52.5,207.46.8.199
x...@hotmail.com:2016-02-10 
20:57:35+0100,ret-uid-...@bounces.mailplus.nl,smtp;554 Transaction 
failed,mx2.hotmail.com (207.46.8.199),46.31.53.6,207.46.8.199
x...@hotmail.com:2016-02-11 03:51:27+0100,fm-...@return.flowmailer.net,smtp;554 
Transaction failed,mx1.hotmail.com (207.46.8.199),46.31.52.130,207.46.8.199
x...@hotmail.com:2016-02-11 
04:06:50+0100,ret-uid-...@bounces.mailplus.nl,smtp;554 Transaction 
failed,mx1.hotmail.com (207.46.8.199),46.31.52.14,207.46.8.199
x...@hotmail.com:2016-02-11 08:31:47+0100,fm-...@return.flowmailer.net,smtp;554 
Transaction failed,mx4.hotmail.com (207.46.8.199),46.31.52.130,207.46.8.199
x...@hotmail.com:2016-02-11 09:02:41+0100,fm-...@return.flowmailer.net,smtp;554 
Transaction failed,mx4.hotmail.com (207.46.8.199),46.31.52.133,207.46.8.199
x...@hotmail.com:2016-02-11 09:07:09+0100,fm-...@return.flowmailer.net,smtp;554 
Transaction failed,mx4.hotmail.com (207.46.8.199),46.31.52.130,207.46.8.199
x...@hotmail.com:2016-02-11 09:18:09+0100,fm-...@return.flowmailer.net,smtp;554 
Transaction failed,mx4.hotmail.com (207.46.8.199),46.31.52.133,207.46.8.199
x...@hotmail.com:2016-02-11 09:21:13+0100,fm-...@return.flowmailer.net,smtp;554 
Transaction failed,mx4.hotmail.com (207.46.8.199),46.31.52.133,207.46.8.199


Met vriendelijke groet,


David Hofstee

Deliverability Management
MailPlus B.V. Netherlands

-Oorspronkelijk bericht-
Van: Michael Wise [mailto:michael.w...@microsoft.com]
Verzonden: woensdag 10 februari 2016 20:32
Aan: David Hofstee; mailop@mailop.org
Onderwerp: RE: [mailop] Spike in "554 Transaction failed" from Microsoft 
properties

The number should be tending towards 0.0% shortly if not already.

Aloha,
Michael.
--
Michael J Wise | Microsoft | Spam Analysis | "Your Spam Specimen Has Been 
Processed." | Got the Junk Mail Reporting Tool ?

-Original Message-
From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of David Hofstee
Sent: Tuesday, February 9, 2016 11:50 PM
To: mailop@mailop.org
Subject: Re: [mailop] Spike in "554 Transaction failed" from Microsoft 
properties

Hi Michael,

To put a number on small: From my side, 0.2% is not arriving. Yours sincerely,


David Hofstee

Deliverability Management
MailPlus B.V. Netherlands
-Oorspronkelijk bericht-
Van: mailop [mailto:mailop-boun...@mailop.org] Namens Michael Wise
Verzonden: woensdag 10 februari 2016 02:49
Aan: frnk...@iname.com; mailop@mailop.org
Onderwerp: Re: [mailop] Spike in "554 Transaction failed" from Microsoft 
properties

It's Not Just You.
It's being actively investigated, and it appears the impact is small...
But rest assured it is most certainly being looked at.

Aloha,
Michael.
--
Michael J Wise | Microsoft | Spam Analysis | "Your Spam Specimen Has Been 
Processed." | Got the Junk Mail Reporting Tool ?


-Original Message-
From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of frnk...@iname.com
Sent: Friday, February 5, 2016 10:36 PM
To: mailop@mailop.org
Subject: Re: [mailop] Spike in "554 Transaction failed" from Microsoft 
properties

Thanks for the additional data points -- so it isn't just me.

What's nasty is that the messages are kicked back to the sender, not just 
delayed.

Frank

-Original Message-
From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Frank Bulk
Sent: Friday, February 05, 2016 5:27 PM
To: mailop@mailop.org
Subject: [mailop] Spike in "554 Transaction failed" from Microsoft properties

Today we had an abnormal number of messages that failed to deliver to Microsoft 
properties due to "554 Transaction failed".

We had 31 today, but only 6 over the previous 7 days.

Now some are email blasts from churches, so perhaps they are emailing specific 
content, but I don't know what the "554 Transaction failed" means.

Frank

Here's a sanitized list from today:

 5 08:52:28.00 [104824074] Failed   
18208 <000501d16024$d63bafa0$82b30ee0$@net> "Site 
https://na01.safelinks.protection.outlook.com/?url=hotmail.com&data=01%7c01%7cmichael.wise%40microsoft.com%7c01a56ea54d96445b8b0708d32ec123d0%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=Zz%2bIzRcOA5l%2bjALWkM%2f6ldcrVwviqIzHxoWI97c7oAI%3d
 (207.46.8.167) said in response to MAIL FROM (554 Transaction failed)"
 5 08:55:19.00 [104824142] Failed  
183286 <56B4B7C3.49.03428@GERRIT-PC> "Site 
https://na01.safelinks.protection.outlook.com/?url=msn.com&data=01%7c01%7cmichael.wise%40microsoft.com%7c01a56ea54d96445b8b0708d32ec123d0%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=yeET3nRGkfNKjqnW6xQh2p%2b66plN%2fw%2bdEHSUSFMP5Ys%3d
 (207.46.8.167) said in response to MAIL FROM (554 Transaction failed)"
 5 09:07:09.00 [104825044] Failed  "[127.0.0.1] 
Site 
https://na01.safe