Re: [mailop] Gmail forwarding blowback

[Brandon Long via mailop]

On Wed, Nov 8, 2017, 1:29 PM Charles McKean 
wrote:

> > 2017-11-08 21:46 GMT+02:00 Brandon Long via mailop :
> >> GSuite users can also denote a host as an inbound gateway to get around
> this problem, but I was never able to get the resources to have gmail users
> have the same ability.  It's possible this is something we could use arc
> for.
>
> I humbly suggest that this is a problem that perhaps does not need to
> be solved. If it's spam, don't forward it. Isn't this essentially what
> Gmail does today, if a user sets up forwarding? Any mail trapped in
> the spam folder will not be forwarded, if I recall correctly.
>

You can forward the spam if you use a forward filter rule, I recently
debugged an issue with an escape due to that as the starting point.

Fundamentally, at the lower end of the spam spectrum, people disagree on
what's spam and our rules make mistakes, the spam label is fundamental to
knowing that.  Not forwarding spam, if the user never checks the spam
folder, means data loss and lack of learning.

It is a balancing act against the spammers who are happy to get the
.001% rate of a spam folder, but that's the mail space.

Brandon

>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Gmail forwarding blowback

[Charles McKean]

> 2017-11-08 21:46 GMT+02:00 Brandon Long via mailop :
>> GSuite users can also denote a host as an inbound gateway to get around this 
>> problem, but I was never able to get the resources to have gmail users have 
>> the same ability.  It's possible this is something we could use arc for.

I humbly suggest that this is a problem that perhaps does not need to
be solved. If it's spam, don't forward it. Isn't this essentially what
Gmail does today, if a user sets up forwarding? Any mail trapped in
the spam folder will not be forwarded, if I recall correctly.

There was discussion around this in the past where AOL's forwarding
servers (I think) would add an x-spam tag, and the consensus from the
community at the time seemed to be, if you know that it's garbage, why
would you send it to me? The intent was good -- it was meant to help
the receiving site decide how to route the mail based on how the
forwarding site felt about it. But again, this is only useful if you
buy the argument that this particular email message should have been
forwarded to begin with.

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Gmail forwarding blowback

[Vladimir Dubrovin via mailop]

Address space for IPv6 is so huge, that it's almost impossible to keep
IPv6 reputation data, and sender authentication is usually required. for
IPv6 host Under normal conditions, SPF and DKIM are used to authenticate
sender, but if you forward messages without address rewrite, all
forwarded messages fail SPF authentication and only DKIM-signed messages
are authenticated. You can try to:

1. Implement SRS to provide SPF authentication for forwarded messages
(you will share SRS domain's reputation with forwarded messages).
2. Switch to IPv4 to have IP reputation

both cases can dramatically affect deliverability of direct mail from
your server, because quality of forwarded messages will affect
reputation of your domain in (1) and IP in (2). You should only do it if
you have good protection against fake/spam messages and you do not
forward any spam.

If you still want to use forwarding, consider using dedicated domain for
(1) and dedicated IPv4 for (2). But if you forward spam, expect the same
issue again.

08.11.2017 22:20, Warren Volz пишет:
>
> All,
>
> One of my users has their account setup to forward mail to Gmail.
> Recently I've started to see lots of rejects that look like the following:
>
>  (expanded from ): host
> gmail-smtp-in.l.google.com[2607:f8b0:400e:c04::1a] said: 550-5.7.1
> [ipv6 address 18] Our system has detected that
> 550-5.7.1 this message is likely suspicious due to the very low reputation
> of 550-5.7.1 the sending IP address. To best protect our users from spam,
> the 550-5.7.1 message has been blocked. Please visit 550 5.7.1
> https://support.google.com/mail/answer/188131 for more information.
> p26si2014836pli.781 - gsmtp (in reply to end of DATA command)
>
> I've looked over the forwarding best practices provided by google and
> we are not modifying the envelope sender. I'd rather not start
> throwing away what our filter marks as spam since I leave that up to
> the user, but is that the only way to stop the bounces? Also, is the
> "18]" an artifact or some kind of error?
>
> Thanks for the help.
>
> -Warren
>
>
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop


-- 
Vladimir Dubrovin
@Mail.Ru

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Gmail forwarding blowback

[Bryan Vest]

I designed a similar system to what Andris Reinman mentioned for our
outbound mail system which hosts about 80k email accounts. This is a 4 tier
system; low spam probability, medium spam probability, high spam
probability, blatant spam. After the message is scored we use postfix
header routing to route delivery to the correct outbound servers. We have 2
VM's that handle good mail, 1 for medium and one for high scoring spam, the
blatantly marked spam is held in a quarantine queue for 5 days then
discarded.

With this setup we rarely have problems with forwards to any providers. The
scoring system uses MailScanner which heavily depends on SpamAssassin so it
took about 4 months to adjust rules since outbound mail is not quite like
inbound mail which SpamAssassin was designed for. After the initial
adjustment and training it now takes a few hours per week to maintain the
system.

It works very well, we had a lot of outbound mail problems before we
implemented this solution in mid 2016.

--Bryan

On Wed, Nov 8, 2017 at 3:18 PM, Andris Reinman 
wrote:

> We at Zone.ee handle redirects to Gmail (or to any target actually) in 3
> steps:
>
> 1. If the message does not get any spam points (we use Rspamd) then we
> forward the message through our normal redirect IP range (3 IPs that
> equally share the messages)
> 2. If the message gets spam points but not enough to discard it, then we
> route this message through a dedicated spam IP, the rDNS name for it even
> includes "spam" in it. if this IP gets blocked then we do not care too much
> about it.
> 3. If the redirected message gets a lot of spam points then we just
> discard it with no action (no bounce messages etc.)
>
> Regards,
> Andris Reinman
>
> 2017-11-08 21:46 GMT+02:00 Brandon Long via mailop :
>
>> Yes, forwarding spam to us is generally a really poor idea, especially
>> over ipv6 [image: ].
>>
>> The 18 is more of a source code, ie the source of the rejection, not
>> really a specific error code.  They're not generally useful to end users.
>>
>> We've discussed before that one thing that may work best is to forward
>> the non-spam, and have the user use pop3 to fetch the spam.
>>
>> GSuite users can also denote a host as an inbound gateway to get around
>> this problem, but I was never able to get the resources to have gmail users
>> have the same ability.  It's possible this is something we could use arc
>> for.
>>
>> Brandon
>>
>>
>> On Wed, Nov 8, 2017 at 11:41 AM Alan Hodgson 
>> wrote:
>>
>>> On Wed, 2017-11-08 at 12:20 -0700, Warren Volz wrote:
>>>
>>> All,
>>>
>>> One of my users has their account setup to forward mail to Gmail.
>>> Recently I've started to see lots of rejects that look like the following:
>>>
>>>  (expanded from ): host
>>> gmail-smtp-in.l.google.com[2607:f8b0:400e:c04::1a] said: 550-5.7.1
>>> [ipv6 address 18] Our system has detected that
>>> 550-5.7.1 this message is likely suspicious due to the very low
>>> reputation
>>> of 550-5.7.1 the sending IP address. To best protect our users from spam,
>>> the 550-5.7.1 message has been blocked. Please visit 550 5.7.1
>>> https://support.google.com/mail/answer/188131 for more information.
>>> p26si2014836pli.781 - gsmtp (in reply to end of DATA command)
>>>
>>> I've looked over the forwarding best practices provided by google and we
>>> are not modifying the envelope sender. I'd rather not start throwing away
>>> what our filter marks as spam since I leave that up to the user, but is
>>> that the only way to stop the bounces? Also, is the "18]" an artifact or
>>> some kind of error?
>>>
>>> Thanks for the help.
>>>
>>>
>>> IMO, you really can't forward mail to Gmail; they will block you if you
>>> forward any spam at all.
>>>
>>> Gmail accounts can be setup to pull mail in via POP-3, that's a far
>>> better way for them to get their mail.
>>> ___
>>> mailop mailing list
>>> mailop@mailop.org
>>> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>>>
>>
>> ___
>> mailop mailing list
>> mailop@mailop.org
>> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>>
>>
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Gmail forwarding blowback

[Andris Reinman]

We at Zone.ee handle redirects to Gmail (or to any target actually) in 3
steps:

1. If the message does not get any spam points (we use Rspamd) then we
forward the message through our normal redirect IP range (3 IPs that
equally share the messages)
2. If the message gets spam points but not enough to discard it, then we
route this message through a dedicated spam IP, the rDNS name for it even
includes "spam" in it. if this IP gets blocked then we do not care too much
about it.
3. If the redirected message gets a lot of spam points then we just discard
it with no action (no bounce messages etc.)

Regards,
Andris Reinman

2017-11-08 21:46 GMT+02:00 Brandon Long via mailop :

> Yes, forwarding spam to us is generally a really poor idea, especially
> over ipv6 [image: ].
>
> The 18 is more of a source code, ie the source of the rejection, not
> really a specific error code.  They're not generally useful to end users.
>
> We've discussed before that one thing that may work best is to forward the
> non-spam, and have the user use pop3 to fetch the spam.
>
> GSuite users can also denote a host as an inbound gateway to get around
> this problem, but I was never able to get the resources to have gmail users
> have the same ability.  It's possible this is something we could use arc
> for.
>
> Brandon
>
>
> On Wed, Nov 8, 2017 at 11:41 AM Alan Hodgson 
> wrote:
>
>> On Wed, 2017-11-08 at 12:20 -0700, Warren Volz wrote:
>>
>> All,
>>
>> One of my users has their account setup to forward mail to Gmail.
>> Recently I've started to see lots of rejects that look like the following:
>>
>>  (expanded from ): host
>> gmail-smtp-in.l.google.com[2607:f8b0:400e:c04::1a] said: 550-5.7.1
>> [ipv6 address 18] Our system has detected that
>> 550-5.7.1 this message is likely suspicious due to the very low reputation
>> of 550-5.7.1 the sending IP address. To best protect our users from spam,
>> the 550-5.7.1 message has been blocked. Please visit 550 5.7.1
>> https://support.google.com/mail/answer/188131 for more information.
>> p26si2014836pli.781 - gsmtp (in reply to end of DATA command)
>>
>> I've looked over the forwarding best practices provided by google and we
>> are not modifying the envelope sender. I'd rather not start throwing away
>> what our filter marks as spam since I leave that up to the user, but is
>> that the only way to stop the bounces? Also, is the "18]" an artifact or
>> some kind of error?
>>
>> Thanks for the help.
>>
>>
>> IMO, you really can't forward mail to Gmail; they will block you if you
>> forward any spam at all.
>>
>> Gmail accounts can be setup to pull mail in via POP-3, that's a far
>> better way for them to get their mail.
>> ___
>> mailop mailing list
>> mailop@mailop.org
>> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>>
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Gmail forwarding blowback

[John Levine]

In article <0c09bad3-14bc-cd51-9bc8-25a205273...@lscg.ucsb.edu> you write:
>I wonder if it would ever work to allow a server to forward a message 
>while including headers that indicate the message had signs of spam.  It 
>would only work in the negative direction (this message is spam, but not 
>this message is ham).

It's been tried, it doesn't work because bad guys try to use it to
game the system.  Even if the spam tagged stuff shows up in the spam
folder, 0.001% of users will retrieve it and that's good enough.

I've had pretty good results with forwarding squeaky clean non-spam,
POP3 the rest.

R's,
John

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Gmail forwarding blowback

[valdis . kletnieks]

On Wed, 08 Nov 2017 11:42:41 -0800, Michael Peddemors said:

> Besides, you want to keep the customer, not make him a gmail customer ;)

If the mail service is bundled with something else that's a profit center, 
unbundling
the cost center part and handing that to Google will improve your bottom line.. 
;)


pgp8awhZxd04o.pgp
Description: PGP signature
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Gmail forwarding blowback

[Ted Cabeen]

I wonder if it would ever work to allow a server to forward a message 
while including headers that indicate the message had signs of spam.  It 
would only work in the negative direction (this message is spam, but not 
this message is ham).


I kind of think of in the way the courts do with declarations against 
interest.  They're admissible because the statement is so prejudicial, 
no one would make it falsely.  Likewise, no sender would have an 
interest in sending an email with spam headers attached, so they had to 
have been truthfully added by a forwarding server.


--Ted

On 11/8/2017 11:46 AM, Brandon Long via mailop wrote:
GSuite users can also denote a host as an inbound gateway to get around 
this problem, but I was never able to get the resources to have gmail 
users have the same ability.  It's possible this is something we could 
use arc for.


Brandon


On Wed, Nov 8, 2017 at 11:41 AM Alan Hodgson > wrote:


On Wed, 2017-11-08 at 12:20 -0700, Warren Volz wrote:


All,

One of my users has their account setup to forward mail to Gmail.
Recently I've started to see lots of rejects that look like the
following:

> (expanded from
>): host
gmail-smtp-in.l.google.com
[2607:f8b0:400e:c04::1a] said:
550-5.7.1
[ipv6 address 18] Our system has detected that
550-5.7.1 this message is likely suspicious due to the very low
reputation
of 550-5.7.1 the sending IP address. To best protect our users
from spam,
the 550-5.7.1 message has been blocked. Please visit 550 5.7.1
https://support.google.com/mail/answer/188131 for more information.
p26si2014836pli.781 - gsmtp (in reply to end of DATA command)

I've looked over the forwarding best practices provided by google
and we are not modifying the envelope sender. I'd rather not start
throwing away what our filter marks as spam since I leave that up
to the user, but is that the only way to stop the bounces? Also,
is the "18]" an artifact or some kind of error?

Thanks for the help.



IMO, you really can't forward mail to Gmail; they will block you if
you forward any spam at all.

Gmail accounts can be setup to pull mail in via POP-3, that's a far
better way for them to get their mail.
___
mailop mailing list
mailop@mailop.org 
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop



___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop



___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Gmail forwarding blowback

[Robert Rubenking]

Users will find a way to circumvent regardless...
Is the mail being redirected or being sent on via store and forward?   If the 
latter then just adding himself to the address book may be enough to let them 
mail through at Gmail.

Bob

-Original Message-
From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Michael Peddemors
Sent: Wednesday, November 08, 2017 1:43 PM
To: mailop@mailop.org
Subject: Re: [mailop] Gmail forwarding blowback

Do what we do, if you mark a message as 'Spam' deliver it to a 'local' 
IMAP folder called spam, and only forward the non-spam emails.

If they want to see it, they can log into your server to check that account.. 
(and don't let them turn spam protection off)

But really, you should 'stop forwarding remote', that is the direction the 
industry is taking, since every email client can check multiple mailboxes..

Besides, you want to keep the customer, not make him a gmail customer ;)



On 17-11-08 11:20 AM, Warren Volz wrote:
> All,
> 
> One of my users has their account setup to forward mail to Gmail. 
> Recently I've started to see lots of rejects that look like the following:
> 
>  (expanded from ): host 
> gmail-smtp-in.l.google.com[2607:f8b0:400e:c04::1a] said: 550-5.7.1
> [ipv6 address 18] Our system has detected that
> 550-5.7.1 this message is likely suspicious due to the very low 
> reputation of 550-5.7.1 the sending IP address. To best protect our 
> users from spam, the 550-5.7.1 message has been blocked. Please visit 
> 550 5.7.1
> https://support.google.com/mail/answer/188131 for more information.
> p26si2014836pli.781 - gsmtp (in reply to end of DATA command)
> 
> I've looked over the forwarding best practices provided by google and 
> we are not modifying the envelope sender. I'd rather not start 
> throwing away what our filter marks as spam since I leave that up to 
> the user, but is that the only way to stop the bounces? Also, is the 
> "18]" an artifact or some kind of error?
> 
> Thanks for the help.
> 
> -Warren
> 
> 
> 
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
> 



--
"Catch the Magic of Linux..."

Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic

A Wizard IT Company - For More Info http://www.wizard.ca "LinuxMagic" a 
Registered TradeMark of Wizard Tower TechnoServices Ltd.

604-682-0300 Beautiful British Columbia, Canada

This email and any electronic data contained are confidential and intended 
solely for the use of the individual or entity to which they are addressed.
Please note that any views or opinions presented in this email are solely those 
of the author and are not intended to represent those of the company.

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Gmail forwarding blowback

[Warren Volz]

Ah thats a good idea. 

My issue is more with the messages that Google mis-categorizes as spam
but the local catch would fix that. 

And you are right, I need to disable the forward to others option... 

-Warren 

On 11/08/2017 12:42 pm, Michael Peddemors wrote:

> Do what we do, if you mark a message as 'Spam' deliver it to a 'local' IMAP 
> folder called spam, and only forward the non-spam emails.
> 
> If they want to see it, they can log into your server to check that account.. 
> (and don't let them turn spam protection off)
> 
> But really, you should 'stop forwarding remote', that is the direction the 
> industry is taking, since every email client can check multiple mailboxes..
> 
> Besides, you want to keep the customer, not make him a gmail customer ;)
> 
> On 17-11-08 11:20 AM, Warren Volz wrote: 
> 
>> All,
>> 
>> One of my users has their account setup to forward mail to Gmail. Recently 
>> I've started to see lots of rejects that look like the following:
>> 
>>  (expanded from ): host
>> gmail-smtp-in.l.google.com[2607:f8b0:400e:c04::1a] said: 550-5.7.1
>> [ipv6 address 18] Our system has detected that
>> 550-5.7.1 this message is likely suspicious due to the very low reputation
>> of 550-5.7.1 the sending IP address. To best protect our users from spam,
>> the 550-5.7.1 message has been blocked. Please visit 550 5.7.1
>> https://support.google.com/mail/answer/188131 for more information.
>> p26si2014836pli.781 - gsmtp (in reply to end of DATA command)
>> 
>> I've looked over the forwarding best practices provided by google and we are 
>> not modifying the envelope sender. I'd rather not start throwing away what 
>> our filter marks as spam since I leave that up to the user, but is that the 
>> only way to stop the bounces? Also, is the "18]" an artifact or some kind of 
>> error?
>> 
>> Thanks for the help.
>> 
>> -Warren
>> 
>> ___
>> mailop mailing list
>> mailop@mailop.org
>> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
> 
> -- 
> "Catch the Magic of Linux..."
> 
> Michael Peddemors, President/CEO LinuxMagic Inc.
> Visit us at http://www.linuxmagic.com @linuxmagic
> 
> A Wizard IT Company - For More Info http://www.wizard.ca
> "LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd.
> 
> 604-682-0300 Beautiful British Columbia, Canada
> 
> This email and any electronic data contained are confidential and intended
> solely for the use of the individual or entity to which they are addressed.
> Please note that any views or opinions presented in this email are solely
> those of the author and are not intended to represent those of the company.
> 
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Gmail forwarding blowback

[Brandon Long via mailop]

Yes, forwarding spam to us is generally a really poor idea, especially over
ipv6 [image: ].

The 18 is more of a source code, ie the source of the rejection, not really
a specific error code.  They're not generally useful to end users.

We've discussed before that one thing that may work best is to forward the
non-spam, and have the user use pop3 to fetch the spam.

GSuite users can also denote a host as an inbound gateway to get around
this problem, but I was never able to get the resources to have gmail users
have the same ability.  It's possible this is something we could use arc
for.

Brandon


On Wed, Nov 8, 2017 at 11:41 AM Alan Hodgson 
wrote:

> On Wed, 2017-11-08 at 12:20 -0700, Warren Volz wrote:
>
> All,
>
> One of my users has their account setup to forward mail to Gmail. Recently
> I've started to see lots of rejects that look like the following:
>
>  (expanded from ): host
> gmail-smtp-in.l.google.com[2607:f8b0:400e:c04::1a] said: 550-5.7.1
> [ipv6 address 18] Our system has detected that
> 550-5.7.1 this message is likely suspicious due to the very low reputation
> of 550-5.7.1 the sending IP address. To best protect our users from spam,
> the 550-5.7.1 message has been blocked. Please visit 550 5.7.1
> https://support.google.com/mail/answer/188131 for more information.
> p26si2014836pli.781 - gsmtp (in reply to end of DATA command)
>
> I've looked over the forwarding best practices provided by google and we
> are not modifying the envelope sender. I'd rather not start throwing away
> what our filter marks as spam since I leave that up to the user, but is
> that the only way to stop the bounces? Also, is the "18]" an artifact or
> some kind of error?
>
> Thanks for the help.
>
>
> IMO, you really can't forward mail to Gmail; they will block you if you
> forward any spam at all.
>
> Gmail accounts can be setup to pull mail in via POP-3, that's a far better
> way for them to get their mail.
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Gmail forwarding blowback

[Michael Peddemors]

Do what we do, if you mark a message as 'Spam' deliver it to a 'local' 
IMAP folder called spam, and only forward the non-spam emails.


If they want to see it, they can log into your server to check that 
account.. (and don't let them turn spam protection off)


But really, you should 'stop forwarding remote', that is the direction 
the industry is taking, since every email client can check multiple 
mailboxes..


Besides, you want to keep the customer, not make him a gmail customer ;)



On 17-11-08 11:20 AM, Warren Volz wrote:

All,

One of my users has their account setup to forward mail to Gmail. 
Recently I've started to see lots of rejects that look like the following:


 (expanded from ): host
gmail-smtp-in.l.google.com[2607:f8b0:400e:c04::1a] said: 550-5.7.1
[ipv6 address 18] Our system has detected that
550-5.7.1 this message is likely suspicious due to the very low reputation
of 550-5.7.1 the sending IP address. To best protect our users from spam,
the 550-5.7.1 message has been blocked. Please visit 550 5.7.1
https://support.google.com/mail/answer/188131 for more information.
p26si2014836pli.781 - gsmtp (in reply to end of DATA command)

I've looked over the forwarding best practices provided by google and we 
are not modifying the envelope sender. I'd rather not start throwing 
away what our filter marks as spam since I leave that up to the user, 
but is that the only way to stop the bounces? Also, is the "18]" an 
artifact or some kind of error?


Thanks for the help.

-Warren



___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop





--
"Catch the Magic of Linux..."

Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic

A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd.

604-682-0300 Beautiful British Columbia, Canada

This email and any electronic data contained are confidential and intended
solely for the use of the individual or entity to which they are addressed.
Please note that any views or opinions presented in this email are solely
those of the author and are not intended to represent those of the company.

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Gmail forwarding blowback

[Warren Volz]

On 11/08/2017 12:35 pm, Alan Hodgson wrote:

> IMO, you really can't forward mail to Gmail; they will block you if you 
> forward any spam at all.  
> 
> Gmail accounts can be setup to pull mail in via POP-3, that's a far better 
> way for them to get their mail.

It's not my preference for sure. I'm hoping to move this user to exactly
what you suggested in the next few days. 

-Warren___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Gmail forwarding blowback

[Michael Wise via mailop]

This is to be expected if you let your users forward spam.
Some systems may be able to automatically notice, but.

Aloha,
Michael.
--
Michael J Wise
Microsoft Corporation| Spam Analysis
"Your Spam Specimen Has Been Processed."
Got the Junk Mail Reporting 
Tool ?

From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Warren Volz
Sent: Wednesday, November 8, 2017 11:21 AM
To: Mailop 
Subject: [mailop] Gmail forwarding blowback


All,

One of my users has their account setup to forward mail to Gmail. Recently I've 
started to see lots of rejects that look like the following:

> (expanded from 
>): host
gmail-smtp-in.l.google.com[2607:f8b0:400e:c04::1a] said: 550-5.7.1
[ipv6 address 18] Our system has detected that
550-5.7.1 this message is likely suspicious due to the very low reputation
of 550-5.7.1 the sending IP address. To best protect our users from spam,
the 550-5.7.1 message has been blocked. Please visit 550 5.7.1
https://support.google.com/mail/answer/188131 for more information.
p26si2014836pli.781 - gsmtp (in reply to end of DATA command)

I've looked over the forwarding best practices provided by google and we are 
not modifying the envelope sender. I'd rather not start throwing away what our 
filter marks as spam since I leave that up to the user, but is that the only 
way to stop the bounces? Also, is the "18]" an artifact or some kind of error?

Thanks for the help.

-Warren
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Gmail forwarding blowback

[Alan Hodgson]

On Wed, 2017-11-08 at 12:20 -0700, Warren Volz wrote:
> All,
> 
> One of my users has their account setup to forward mail to Gmail.
> Recently I've started to see lots of rejects that look like the
> following:
> 
>  (expanded from ): host
> gmail-smtp-in.l.google.com[2607:f8b0:400e:c04::1a] said: 550-5.7.1
> [ipv6 address 18] Our system has detected that
> 550-5.7.1 this message is likely suspicious due to the very low
> reputation
> of 550-5.7.1 the sending IP address. To best protect our users from
> spam,
> the 550-5.7.1 message has been blocked. Please visit 550 5.7.1
> https://support.google.com/mail/answer/188131 for more information.
> p26si2014836pli.781 - gsmtp (in reply to end of DATA command)
> 
> I've looked over the forwarding best practices provided by google and
> we are not modifying the envelope sender. I'd rather not start
> throwing away what our filter marks as spam since I leave that up to
> the user, but is that the only way to stop the bounces? Also, is the
> "18]" an artifact or some kind of error?
> 
> Thanks for the help.

IMO, you really can't forward mail to Gmail; they will block you if you
forward any spam at all. 

Gmail accounts can be setup to pull mail in via POP-3, that's a far
better way for them to get their mail.___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

[mailop] Gmail forwarding blowback

[Warren Volz]

All, 

One of my users has their account setup to forward mail to Gmail.
Recently I've started to see lots of rejects that look like the
following: 

 (expanded from ): host
gmail-smtp-in.l.google.com[2607:f8b0:400e:c04::1a] said: 550-5.7.1
[ipv6 address 18] Our system has detected that
550-5.7.1 this message is likely suspicious due to the very low
reputation
of 550-5.7.1 the sending IP address. To best protect our users from
spam,
the 550-5.7.1 message has been blocked. Please visit 550 5.7.1
https://support.google.com/mail/answer/188131 for more information.
p26si2014836pli.781 - gsmtp (in reply to end of DATA command) 

I've looked over the forwarding best practices provided by google and we
are not modifying the envelope sender. I'd rather not start throwing
away what our filter marks as spam since I leave that up to the user,
but is that the only way to stop the bounces? Also, is the "18]" an
artifact or some kind of error? 

Thanks for the help. 

-Warren___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Comcast Feedback Loop emails that look legitimate

[timrutherford]

Thanks Alex, good to know.

 

Tim

 

From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Brotman,
Alexander
Sent: Wednesday, November 8, 2017 9:23 AM
To: timrutherf...@c4.net; mailop@mailop.org
Subject: Re: [mailop] Comcast Feedback Loop emails that look legitimate

 

Tim,

 

Yes-ish.  We do treat the action of moving a message to the spam folder the
same as clicking the "Spam" button.  This is fairly common.  It can make for
mistakes if someone is dragging a message and accidentally drops the message
in the wrong place.  We've seen instances where someone attempts a bulk move
and accidentally files hundreds of messages into Spam, and a few minutes
later refiles them elsewhere.  Another type of incident we've seen is
sometimes a user has switched clients and the new client decides that
messages previously in the Inbox are now spam, and refiles them to the Spam
folder.  This could also generate a spam report in certain scenarios.  

 

And I'm sure we've all seen that users can (and do) treat the "Spam" button
as delete.

 

--

Alex Brotman

Sr. Engineer, Anti-Abuse

Comcast

 

From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of
timrutherf...@c4.net  
Sent: Tuesday, November 07, 2017 10:28 AM
To: mailop@mailop.org  
Subject: [mailop] Comcast Feedback Loop emails that look legitimate

 

Hello all,

 

We are on the Comcast FBL and occasionally get abuse reports from Comcast
through that service.  It is my understanding that these reports are
generated automatically when the customer reports an email as spam.

 

However, we have seen several occasions where the messages are clearly not
spam.  In some cases they are a reservation confirmations (something the
customer just purchased), invoices from companies they deal with on a
regular basis, or even general email correspondences.

 

I'm wondering if there are any other actions that trigger a spam report and
consequently a FBL report.   IP reputation, message content, 3rd party
antivirus actions, etc. ?

 

The messages come from feedbackl...@comcastfbl.senderscore.net
 , which makes me wonder if
they have some algorithms in place. 

 

Thanks in advance for any input!

Tim

 

 

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

[mailop] Anyone from Responsys available to hit me offlist..

[Michael Peddemors]

Just wanted to pass some reports of 'dirty' lists noted in this weeks 
reports from the auditors..  that should be reviewed..


Time to do a fall cleaning..

--
"Catch the Magic of Linux..."

Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic

A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd.

604-682-0300 Beautiful British Columbia, Canada

This email and any electronic data contained are confidential and intended
solely for the use of the individual or entity to which they are addressed.
Please note that any views or opinions presented in this email are solely
those of the author and are not intended to represent those of the company.

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Comcast Feedback Loop emails that look legitimate

[Bryan Vest]

We see these kind of false positives all of the time from the AOL FBL. Our
front line technicians have been trained in spamfu so they generally take
care of these when they come in. But it is annoying that so many users will
mark legitimate mail as spam.


On Wed, Nov 8, 2017 at 9:22 AM, Brotman, Alexander <
alexander_brot...@comcast.com> wrote:

> Tim,
>
>
>
> Yes-ish.  We do treat the action of moving a message to the spam folder
> the same as clicking the “Spam” button.  This is fairly common.  It can
> make for mistakes if someone is dragging a message and accidentally drops
> the message in the wrong place.  We’ve seen instances where someone
> attempts a bulk move and accidentally files hundreds of messages into Spam,
> and a few minutes later refiles them elsewhere.  Another type of incident
> we’ve seen is sometimes a user has switched clients and the new client
> decides that messages previously in the Inbox are now spam, and refiles
> them to the Spam folder.  This could also generate a spam report in certain
> scenarios.
>
>
>
> And I’m sure we’ve all seen that users can (and do) treat the “Spam”
> button as delete.
>
>
>
> --
>
> Alex Brotman
>
> Sr. Engineer, Anti-Abuse
>
> Comcast
>
>
>
> *From:* mailop [mailto:mailop-boun...@mailop.org] *On Behalf Of *
> timrutherf...@c4.net
> *Sent:* Tuesday, November 07, 2017 10:28 AM
> *To:* mailop@mailop.org
> *Subject:* [mailop] Comcast Feedback Loop emails that look legitimate
>
>
>
> Hello all,
>
>
>
> We are on the Comcast FBL and occasionally get abuse reports from Comcast
> through that service.  It is my understanding that these reports are
> generated automatically when the customer reports an email as spam.
>
>
>
> However, we have seen several occasions where the messages are clearly not
> spam.  In some cases they are a reservation confirmations (something the
> customer just purchased), invoices from companies they deal with on a
> regular basis, or even general email correspondences.
>
>
>
> I’m wondering if there are any other actions that trigger a spam report
> and consequently a FBL report.   IP reputation, message content, 3rd
> party antivirus actions, etc. ?
>
>
>
> The messages come from feedbackl...@comcastfbl.senderscore.net, which
> makes me wonder if they have some algorithms in place.
>
>
>
> Thanks in advance for any input!
>
> Tim
>
>
>
>
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Comcast Feedback Loop emails that look legitimate

[Brotman, Alexander]

Tim,

Yes-ish.  We do treat the action of moving a message to the spam folder the 
same as clicking the "Spam" button.  This is fairly common.  It can make for 
mistakes if someone is dragging a message and accidentally drops the message in 
the wrong place.  We've seen instances where someone attempts a bulk move and 
accidentally files hundreds of messages into Spam, and a few minutes later 
refiles them elsewhere.  Another type of incident we've seen is sometimes a 
user has switched clients and the new client decides that messages previously 
in the Inbox are now spam, and refiles them to the Spam folder.  This could 
also generate a spam report in certain scenarios.

And I'm sure we've all seen that users can (and do) treat the "Spam" button as 
delete.

--
Alex Brotman
Sr. Engineer, Anti-Abuse
Comcast

From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of 
timrutherf...@c4.net
Sent: Tuesday, November 07, 2017 10:28 AM
To: mailop@mailop.org
Subject: [mailop] Comcast Feedback Loop emails that look legitimate

Hello all,

We are on the Comcast FBL and occasionally get abuse reports from Comcast 
through that service.  It is my understanding that these reports are generated 
automatically when the customer reports an email as spam.

However, we have seen several occasions where the messages are clearly not 
spam.  In some cases they are a reservation confirmations (something the 
customer just purchased), invoices from companies they deal with on a regular 
basis, or even general email correspondences.

I'm wondering if there are any other actions that trigger a spam report and 
consequently a FBL report.   IP reputation, message content, 3rd party 
antivirus actions, etc. ?

The messages come from 
feedbackl...@comcastfbl.senderscore.net,
 which makes me wonder if they have some algorithms in place.

Thanks in advance for any input!
Tim


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

[mailop] Anyone from Onet Poczta on this list?

[Marco Franceschetti via mailop]

Hello, 

I am looking for a contact person at Onet Poczta for mitigation request on 

Op.pl
Poczta.onet.pl
Vp.pl
Onet.pl
Etc. 

I am having difficulties in finding a contact form for online request. 

Thanks

Marco Franceschetti
Head of Deliverability | ContactLab
M. +39 331 1717 978 | T. +39 0228311887
marco.francesche...@contactlab.com

Via Natale Battaglia, 12 | Milano
contactlab.com/it 


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop