Re: [mailop] Outlook/Hotmail Blacklist

[Scott Mutter]

Just to be clear - all of my issues are resolved at this time.  I'm just 
replying back here because I think it's important to learn from mistakes and 
how improvements can be made.  I don't imagine my opinion counts for much, but 
in case it does...

> If you respond to the second email detailing the mitigation, or the lack 
> thereof, and don't receive an email from a live human (they'll use 
> boilerplate; they're required to), or you don't receive that second email 
> with the details of the machine mitigation...

Well, the issue was - they kept telling me that they didn't see anything that 
would be blocking mail from that IP.  Which, again, I don't necessarily doubt 
them... but the end result was still the same: my IP was being blocked.  They 
would not mitigate anything because to them, there was nothing to mitigate.

So I don't know what their procedures are for this.  I kind of suspect that 
they just copy and paste an IP into a tool that spits something out for them 
and if that tool was returning nothing, then that's a problem with the tool.  
It's either not getting valid information or isn't checking deep enough.

Secondly, if the human being that I'm talking to can't see why my IP is being 
blocked - and when I'm showing clear evidence that it being blocked - then that 
human needs to escalate the ticket up to a more knowledgeable human and it 
needs to keep going up until it finds a human that can see why my IP is being 
blocked.  That does not appear to be what happened.

I get that we all make mistakes.  To be honest, I've actually been that human 
in this.  I once had a client that told me he couldn't reach his website, I 
didn't see a block.  He kept writing back saying he was blocked.  It took a few 
emails back and forth, but I did find that his IP was part of a larger block 
and we were actually blocking him.  It didn't take a full week to solve, it 
took a few hours, but those are hours that the client really deserved to be 
unblocked or have an explanation for.  I learned from this.  My hope is that 
Microsoft/Outlook/Hotmail might learn from this.

Regarding the tickets being closed.  I was told in a direct message from 
@Outlook on twitter that my tickets had been closed and that's why I wasn't 
getting any response.  I don't know which tickets they were referring to.  I'm 
sure I opened too many tickets on this.  I'm sure I showed out a little bit in 
some of the tickets.  I'm sorry about that.  But under the circumstances... 
being told I wasn't blocked when I was blocked... that will get under your skin 
a little bit.  Especially when we have clients screaming at us because they 
can't send to hotmail - and they all believe that Microsoft/Outlook/Hotmail can 
do no wrong, so it has to be on our end.

So again, just to reiterate, my issue with this is resolved at this time.  
There's no need to spend time working on this.  If you want to look at 
something, look at how the tools and procedures for handling situations like 
this are done with Outlook/Hotmail support and perhaps how those can be 
improved.

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mailing list with From header munging... and Outlook

[Neil Jenkins]

On Tue, 12 Mar 2019, at 09:26, Jesse Thompson via mailop wrote:
> When someone reply-alls to a munged message it only composes a message to the 
> Reply-to and the Cc, but ignores the From (the list address is munged into 
> the From header).

That sounds exactly what I would expect for "Reply All"; it's certainly what's 
implemented at FastMail.
 * Reply => message is "to" either the Reply-To address if specified, otherwise 
the From address.
 * Reply All => Contents of To/Cc of message being replied to are also added to 
the new email (except for your address).

I would be very surprised to see a client add both the From and Reply-To 
address as recipients on reply-all. Let's see what RFC5322 says 
:

   When a message is a reply to another message, the mailboxes of the
   authors of the original message (the mailboxes in the "From:" field)
   or mailboxes specified in the "Reply-To:" field (if it exists) MAY
   appear in the "To:" field of the reply since these would normally be
   the primary recipients of the reply.  If a reply is sent to a message
   that has destination fields, it is often desirable to send a copy of
   the reply to all of the recipients of the message, in addition to the
   author.  When such a reply is formed, addresses in the "To:" and
   "Cc:" fields of the original message MAY appear in the "Cc:" field of
   the reply, since these are normally secondary recipients of the
   reply.

Yes, that sounds about right.

Neil.___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

[mailop] Mailing list with From header munging... and Outlook

[Jesse Thompson via mailop]

Hi all,

We're making a push to get mailing lists to implement header munging because of 
gov domains adopting DMARC p=reject.

Does anyone know what's up with Outlook (Office 365 Pro Plus) when "Reply All" 
is used?  When someone reply-alls to a munged message it only composes a 
message to the Reply-to and the Cc, but ignores the From (the list address is 
munged into the From header).  So, people need to manually add the list address 
back if they want to reply-all back to the list.  Outlook on the Web seems to 
currently work as expected (event though I have a recollection that I triggered 
the problematic behavior last week.)

Is there anything that can be done to trick Outlook into acting in the way 
someone would expect with "Reply All"?  Munge the list address into an 
additional Reply-to (I'm fairly certain that multiple Reply-to headers are 
allowed)?  Munge it into the Cc header?

[cid:61087ee7-0af8-4ce1-96a9-9e87d092fb64]

Thanks,
Jesse
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Outlook/Hotmail Blacklist

[Michael Wise via mailop]

Just...

One...

Caveat.



If you respond to the second email detailing the mitigation, or the lack 
thereof, and don't receive an email from a live human (they'll use boilerplate; 
they're required to), or you don't receive that second email with the details 
of the machine mitigation...



Then by all means do open another ticket, and say that you're opening another 
ticket because no mitigation detail, or no human response.



It does seem that this is required from time to time.

We’re working that issue.

Aloha,
Michael.
--
Michael J Wise
Microsoft Corporation| Spam Analysis
"Your Spam Specimen Has Been Processed."
Got the Junk Mail Reporting 
Tool ?



-Original Message-
From: mailop  On Behalf Of Ángel
Sent: Saturday, March 9, 2019 2:49 PM
To: mailop@mailop.org
Subject: Re: [mailop] Outlook/Hotmail Blacklist



Good it got fixed.



Something that caught my eye on your email is that you said you "opened ticket 
after ticket after ticket". You should not open a new ticket, but reply to the 
closed ticket, stating that it is not fixed. Ask for escalation if they still 
do not provide a satisfactory answer.

If you open a new ticket, you get another low level tech repeating exactly the 
same steps as the prior one and thus leading to the same answer.



(Maybe that's what you were doing, but it wasn't clear from your mail, so it 
seemed worth stating explicitly)



Best regards





___

mailop mailing list

mailop@mailop.org

https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fchilli.nosignal.org%2Fcgi-bin%2Fmailman%2Flistinfo%2Fmailopdata=02%7C01%7Cmichael.wise%40microsoft.com%7Ce6c842da1c6e4357111c08d6a4e2a173%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636877690613389441sdata=%2FivVAs6Wc3Nfx%2BXrCeVETHj3MNenlWYVFUCa%2BYqsZdU%3Dreserved=0
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Certain addresses from G Suite going straight to O365 spam

[Michael Wise via mailop]

Send me the full headers of a sample Junk’d email, and you won’t have to guess.
Sorry, was a bit under the weather over the weekend.

Aloha,
Michael.
--
Michael J Wise
Microsoft Corporation| Spam Analysis
"Your Spam Specimen Has Been Processed."
Got the Junk Mail Reporting 
Tool ?

From: mailop  On Behalf Of Nick Stallman
Sent: Monday, March 11, 2019 11:04 AM
To: Laura Atkins 
Cc: mailop@mailop.org
Subject: Re: [mailop] Certain addresses from G Suite going straight to O365 spam


Nope this is 100% manual email sent to people who have specifically asked to be 
contacted (either via website form, phone or email).
No templates, cold emails or other nonsense like that at all.

The three main people affected was a sales person, someone who does a little 
bit of sales but not the majority (these two both had Hubspot) and a project 
manager who's never used any kind of tracking at any point.

I'm with you, it would make perfect sense for Office 365 to block automated or 
semi-automated email like that.
That's why it's so puzzling that regular human B2B email would be blocked like 
this.
On 11/3/19 8:18 pm, Laura Atkins wrote:
What type of mail are they sending?

These wouldn’t happen to be part of your sales team who are sending cold emails 
to addresses they’ve … acquired through different pathways, would it?

Given they’re inserting tracking links from Hubspot, it seems there is some 
level of outbound cold email going out. And, frankly, good on Office365 for 
blocking it. I have yet to find a business person who enjoys getting dozens of 
“hey, we think our product is Just Right For YOU! Schedule a call today! Here’s 
the link.”

If that’s what they’re sending, be happy that Office365 is carefully blocking 
just their mail, rather than all the mail from your domain.

laura


On 11 Mar 2019, at 04:35, Nick Stallman 
mailto:n...@agentpoint.com>> wrote:

Thanks Richelo.
I did examine some emails that were being blocked and yep two staff were using 
Hubspot's email tracking.
So that very much is a possibility as being the culprit or a contributing 
factor.
A few weeks ago I told them to disable that tracking however with no 
improvement.
The odd thing is other affected staff haven't used link tracking at all, and 
there are a lot of staff not affected all on the same domain.
On 11/3/19 3:21 pm, Richelo Killian wrote:
I have seen something similar for some of our clients, and it turned out to be 
a Gmail Chrome plugin they used for tracking.

I can’t remember the exact plugin, but, it was changing all links in the email 
to the plugin tracking domain, and that domain was blacklisted at Microsoft.

So, first thing is to check if those users have any kind of Chrome plugin for 
Gmail active and disable them and test again.

Not saying this IS the problem, but, it’s a place to start looking ;-)

Kind Regards,

Richelo Killian

From: Nick Stallman 
Reply: Nick Stallman 
Date: March 11, 2019 at 01:16:19
To: mailop@mailop.org 

Subject:  [mailop] Certain addresses from G Suite going straight to O365 spam


Has anyone come across a strange issue with O365's spam filter, where some 
addresses on a domain go straight to spam but other addresses don't, when they 
are all G Suite addresses?
We've noticed 3 of our staff have their emails reliably going straight to spam 
for O365 destinations, but everyone else can send emails just fine.
The affected users are all using Gmail directly (no email clients), nothing 
fancy at all and I can't see any reason why they would have been affected.
I'm at a bit of a loss as to where to go from here:
- DKIM, DMARC and SPF are all set up correctly
- G Suite support wasn't much help as the emails are being delivered correctly, 
and they verified DKIM, DMARC and SPF.
- We've got SNDS for our mail server (for our servers) of course, but these 
emails are being delivered directly through GMail not our own servers.
- I can't use the form to open a ticket for 
Outlook.com
 delivery issues as our servers aren't doing the sending, and there aren't any 
logged errors (the emails aren't being rejected).
- No bulk marketing or anything has been sent from the affected users, so I 
can't imagine anyone would have manually marked emails as spam.
- This issue occurs to all client O365 domains, I've looked at about a dozen 
different destination O365 domains.
It's all a very weird scenario. Any suggestions would be appreciated.
--
Nick Stallman

TECHNICAL DIRECTOR

[Image removed by sender. Email]

n...@agentpoint.com

[Image removed by sender. 

Re: [mailop] Hey Yahoo! Mind line wrapping your DKIM?

[Alessandro Vesely]

On Mon 11/Mar/2019 13:39:14 +0100 John Levine wrote:

> In article  you write:
>>DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.co.uk; 
>>s=s2048; t=1552218309; bh=g57fG3sVY8VJp5C0XX298lF8prrXAX2lkZMD2FVQd8o=; 
>>h=Date:From:Reply-To:Subject:References:From:Subject; 
>>b=QZ3oPoH9n7DnHGUK7Ebo6Iw51a7MLIXBgK4MjXJH7R5NIgDGbz/lCQQUXm4oubM7xF7SWFA8smaBqrgvqOoRtq4E+aH9T6vW9tft5biBXvyibfoa8F59ycbs0UkUVGhkSr1k5ArcCgJZwLNrDf8pjjoc6ALsXrzLVVYdiX6JghPTL1Re0/PJltp/koqBcRHvU4g8dKkiiLZwnoyS4kNgjRG6cwCBWHkAHFu/NPNY+7vC8ido9xcbhCDSPPsqOct6r5Rga0Ic2TcTU4pP7ZxIs0t3M3Mrr/USv5TbCPC4LltFrMB7AoRjpagphRAw7RwysbWJtsQjNMAhV1DpsmcMkw==
>>
>>Kind of a pain for our auditing team and automated programs when it is 
>>all in one line in the headers..
> 
> I think you should fix your tools.  The length limit for message
> headers has been 998 characters for a very long time.


Many tools lag behind, actually.  For example, using an 8 point font you need
8*998 = 7984 pixels, but even the Wide Hexadecatuple Ultra Extended Graphics
Array can only support a resolution up to 7680 × 4800.


Best
Ale
-- 








___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Certain addresses from G Suite going straight to O365 spam

[Nick Stallman]

Nope this is 100% manual email sent to people who have specifically 
asked to be contacted (either via website form, phone or email).

No templates, cold emails or other nonsense like that at all.

The three main people affected was a sales person, someone who does a 
little bit of sales but not the majority (these two both had Hubspot) 
and a project manager who's never used any kind of tracking at any point.


I'm with you, it would make perfect sense for Office 365 to block 
automated or semi-automated email like that.
That's why it's so puzzling that regular human B2B email would be 
blocked like this.


On 11/3/19 8:18 pm, Laura Atkins wrote:

What type of mail are they sending?

These wouldn’t happen to be part of your sales team who are sending 
cold emails to addresses they’ve … acquired through different 
pathways, would it?


Given they’re inserting tracking links from Hubspot, it seems there is 
some level of outbound cold email going out. And, frankly, good on 
Office365 for blocking it. I have yet to find a business person who 
enjoys getting dozens of “hey, we think our product is Just Right For 
YOU! Schedule a call today! Here’s the link.”


If that’s what they’re sending, be happy that Office365 is carefully 
blocking just their mail, rather than all the mail from your domain.


laura


On 11 Mar 2019, at 04:35, Nick Stallman > wrote:


Thanks Richelo.

I did examine some emails that were being blocked and yep two staff 
were using Hubspot's email tracking.
So that very much is a possibility as being the culprit or a 
contributing factor.


A few weeks ago I told them to disable that tracking however with no 
improvement.
The odd thing is other affected staff haven't used link tracking at 
all, and there are a lot of staff not affected all on the same domain.


On 11/3/19 3:21 pm, Richelo Killian wrote:
I have seen something similar for some of our clients, and it turned 
out to be a Gmail Chrome plugin they used for tracking.


I can’t remember the exact plugin, but, it was changing all links in 
the email to the plugin tracking domain, and that domain was 
blacklisted at Microsoft.


So, first thing is to check if those users have any kind of Chrome 
plugin for Gmail active and disable them and test again.


Not saying this IS the problem, but, it’s a place to start looking ;-)

Kind Regards,

Richelo Killian

From: Nick Stallman 
Reply: Nick Stallman 
Date: March 11, 2019 at 01:16:19
To: mailop@mailop.org  

Subject: [mailop] Certain addresses from G Suite going straight to 
O365 spam


Has anyone come across a strange issue with O365's spam filter, 
where some addresses on a domain go straight to spam but other 
addresses don't, when they are all G Suite addresses?


We've noticed 3 of our staff have their emails reliably going 
straight to spam for O365 destinations, but everyone else can send 
emails just fine.
The affected users are all using Gmail directly (no email clients), 
nothing fancy at all and I can't see any reason why they would have 
been affected.


I'm at a bit of a loss as to where to go from here:
- DKIM, DMARC and SPF are all set up correctly
- G Suite support wasn't much help as the emails are being 
delivered correctly, and they verified DKIM, DMARC and SPF.
- We've got SNDS for our mail server (for our servers) of course, 
but these emails are being delivered directly through GMail not our 
own servers.
- I can't use the form to open a ticket forOutlook.com 
delivery issues as our servers aren't doing 
the sending, and there aren't any logged errors (the emails aren't 
being rejected).
- No bulk marketing or anything has been sent from the affected 
users, so I can't imagine anyone would have manually marked emails 
as spam.
- This issue occurs to all client O365 domains, I've looked at 
about a dozen different destination O365 domains.


It's all a very weird scenario. Any suggestions would be appreciated.

--
Nick Stallman
TECHNICAL DIRECTOR
Email   n...@agentpoint.com 
Phone   02 8039 6820 
Website www.agentpoint.com.au 


Agentpoint 
Netpoint 

Level 3, 100 Harris Street, Pyrmont NSW 2009 	Facebook 
Twitter 
Instagram 
Linkedin 



___
mailop mailing list
mailop@mailop.org 
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

--
Nick Stallman
TECHNICAL DIRECTOR
Email   n...@agentpoint.com 

Re: [mailop] Hey Yahoo! Mind line wrapping your DKIM?

[John Levine]

In article  you write:
>DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.co.uk; 
>s=s2048; t=1552218309; bh=g57fG3sVY8VJp5C0XX298lF8prrXAX2lkZMD2FVQd8o=; 
>h=Date:From:Reply-To:Subject:References:From:Subject; 
>b=QZ3oPoH9n7DnHGUK7Ebo6Iw51a7MLIXBgK4MjXJH7R5NIgDGbz/lCQQUXm4oubM7xF7SWFA8smaBqrgvqOoRtq4E+aH9T6vW9tft5biBXvyibfoa8F59ycbs0UkUVGhkSr1k5ArcCgJZwLNrDf8pjjoc6ALsXrzLVVYdiX6JghPTL1Re0/PJltp/koqBcRHvU4g8dKkiiLZwnoyS4kNgjRG6cwCBWHkAHFu/NPNY+7vC8ido9xcbhCDSPPsqOct6r5Rga0Ic2TcTU4pP7ZxIs0t3M3Mrr/USv5TbCPC4LltFrMB7AoRjpagphRAw7RwysbWJtsQjNMAhV1DpsmcMkw==
>
>Kind of a pain for our auditing team and automated programs when it is 
>all in one line in the headers..

I think you should fix your tools.  The length limit for message
headers has been 998 characters for a very long time.


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Certain addresses from G Suite going straight to O365 spam

[Laura Atkins]

What type of mail are they sending? 

These wouldn’t happen to be part of your sales team who are sending cold emails 
to addresses they’ve … acquired through different pathways, would it?

Given they’re inserting tracking links from Hubspot, it seems there is some 
level of outbound cold email going out. And, frankly, good on Office365 for 
blocking it. I have yet to find a business person who enjoys getting dozens of 
“hey, we think our product is Just Right For YOU! Schedule a call today! Here’s 
the link.” 

If that’s what they’re sending, be happy that Office365 is carefully blocking 
just their mail, rather than all the mail from your domain.

laura 


> On 11 Mar 2019, at 04:35, Nick Stallman  wrote:
> 
> Thanks Richelo.
> 
> I did examine some emails that were being blocked and yep two staff were 
> using Hubspot's email tracking.
> So that very much is a possibility as being the culprit or a contributing 
> factor.
> 
> A few weeks ago I told them to disable that tracking however with no 
> improvement.
> The odd thing is other affected staff haven't used link tracking at all, and 
> there are a lot of staff not affected all on the same domain.
> 
> On 11/3/19 3:21 pm, Richelo Killian wrote:
>> I have seen something similar for some of our clients, and it turned out to 
>> be a Gmail Chrome plugin they used for tracking.
>> 
>> I can’t remember the exact plugin, but, it was changing all links in the 
>> email to the plugin tracking domain, and that domain was blacklisted at 
>> Microsoft.
>> 
>> So, first thing is to check if those users have any kind of Chrome plugin 
>> for Gmail active and disable them and test again.
>> 
>> Not saying this IS the problem, but, it’s a place to start looking ;-)
>> 
>> Kind Regards,
>> 
>> Richelo Killian
>> 
>> From: Nick Stallman  
>> Reply: Nick Stallman  
>> Date: March 11, 2019 at 01:16:19
>> To: mailop@mailop.org   
>> 
>> Subject:  [mailop] Certain addresses from G Suite going straight to O365 
>> spam 
>> 
>>> Has anyone come across a strange issue with O365's spam filter, where some 
>>> addresses on a domain go straight to spam but other addresses don't, when 
>>> they are all G Suite addresses?
>>> 
>>> We've noticed 3 of our staff have their emails reliably going straight to 
>>> spam for O365 destinations, but everyone else can send emails just fine.
>>> The affected users are all using Gmail directly (no email clients), nothing 
>>> fancy at all and I can't see any reason why they would have been affected.
>>> 
>>> I'm at a bit of a loss as to where to go from here:
>>> - DKIM, DMARC and SPF are all set up correctly
>>> - G Suite support wasn't much help as the emails are being delivered 
>>> correctly, and they verified DKIM, DMARC and SPF.
>>> - We've got SNDS for our mail server (for our servers) of course, but these 
>>> emails are being delivered directly through GMail not our own servers.
>>> - I can't use the form to open a ticket for Outlook.com 
>>>  delivery issues as our servers aren't doing the 
>>> sending, and there aren't any logged errors (the emails aren't being 
>>> rejected).
>>> - No bulk marketing or anything has been sent from the affected users, so I 
>>> can't imagine anyone would have manually marked emails as spam.
>>> - This issue occurs to all client O365 domains, I've looked at about a 
>>> dozen different destination O365 domains.
>>> 
>>> It's all a very weird scenario. Any suggestions would be appreciated.
>>> 
>>> --
>>> Nick Stallman
>>> TECHNICAL DIRECTOR
>>> n...@agentpoint.com 
>>> 02 8039 6820 
>>> www.agentpoint.com.au   
>>>  
>>>  
>>> Level 3, 100 Harris Street, Pyrmont NSW 2009 
>>>     
>>>   
>>> ___
>>> mailop mailing list
>>> mailop@mailop.org 
>>> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop 
>>> 
>> 
>> 
>> ___
>> mailop mailing list
>> mailop@mailop.org 
>> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop 
>> 
> -- 
> Nick Stallman
> TECHNICAL DIRECTOR
>   n...@agentpoint.com 
>   02 8039 6820 
>   www.agentpoint.com.au   
>  
>  
> Level 3, 100 Harris Street, Pyrmont NSW 2009   
>     
>