Hello everybody
Since yesterday, we see a lot of bounced messages to bluewin addresses with SMTP code 554, for example: relay=mxbw-bluewin-ch.hdb-cs04.ellb.ch[195.186.227.50]:25, delay=0.16, delays=0/0.01/0.09/0.05, dsn=5.2.0, status=bounced (host mxbw-bluewin-ch.hdb-cs04.ellb.ch[195.186.227.50] said: 554 5.2.0 sc976: Rejected due to policy reasons - https://support.bluewin.ch/provider/bounce/XXXXXXXXXXXXXXXXX%5Bredacted%5D== (in reply to end of DATA command)) Unfortunately, sc976 is not documented on https://postmaster.bluewin.ch/content/de/technical-details/ We can't see any general pattern behind those rejections (hosts trough our entire IP range are affected), switching to a different IP address for delivery works in most cases.
Do you see the same and have any insight what is going on here?
Greetings Peter
Yup, seen the same!
with a shared hosting server which is not on a blacklist at all.
Silvan
----- Ursprüngliche Mail ----- Von: "Peter Rohrer" Peter.Rohrer@gmx.ch An: "swinog" swinog@lists.swinog.ch Gesendet: Sonntag, 28. März 2021 08:40:41 Betreff: [swinog] Mail rejection at bluewin
Hello everybody
Since yesterday, we see a lot of bounced messages to bluewin addresses with SMTP code 554, for example: relay=mxbw-bluewin-ch.hdb-cs04.ellb.ch[195.186.227.50]:25, delay=0.16, delays=0/0.01/0.09/0.05, dsn=5.2.0, status=bounced (host mxbw-bluewin-ch.hdb-cs04.ellb.ch[195.186.227.50] said: 554 5.2.0 sc976: Rejected due to policy reasons - https://support.bluewin.ch/provider/bounce/XXXXXXXXXXXXXXXXX%5Bredacted%5D== (in reply to end of DATA command)) Unfortunately, sc976 is not documented on https://postmaster.bluewin.ch/content/de/technical-details/ We can't see any general pattern behind those rejections (hosts trough our entire IP range are affected), switching to a different IP address for delivery works in most cases.
Do you see the same and have any insight what is going on here?
Greetings Peter
_______________________________________________ swinog mailing list swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog
We're seeing the same issue since 28th March. Looks like their new reputation system needs some fine tuning by a big hammer :-) Maybe they bought the same reputation system as 1&1 did not long ago.
451 4.2.0 sc965: IP reputation ratelimit in effect
On 3/28/21 4:16 PM, Silvan M. Gebhardt wrote:
Yup, seen the same!
with a shared hosting server which is not on a blacklist at all.
Silvan
----- Ursprüngliche Mail ----- Von: "Peter Rohrer" Peter.Rohrer@gmx.ch An: "swinog" swinog@lists.swinog.ch Gesendet: Sonntag, 28. März 2021 08:40:41 Betreff: [swinog] Mail rejection at bluewin
Hello everybody
Since yesterday, we see a lot of bounced messages to bluewin addresses with SMTP code 554, for example: relay=mxbw-bluewin-ch.hdb-cs04.ellb.ch[195.186.227.50]:25, delay=0.16, delays=0/0.01/0.09/0.05, dsn=5.2.0, status=bounced (host mxbw-bluewin-ch.hdb-cs04.ellb.ch[195.186.227.50] said: 554 5.2.0 sc976: Rejected due to policy reasons - https://support.bluewin.ch/provider/bounce/XXXXXXXXXXXXXXXXX%5Bredacted%5D== (in reply to end of DATA command)) Unfortunately, sc976 is not documented on https://postmaster.bluewin.ch/content/de/technical-details/ We can't see any general pattern behind those rejections (hosts trough our entire IP range are affected), switching to a different IP address for delivery works in most cases.
Do you see the same and have any insight what is going on here?
Greetings Peter
swinog mailing list swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog
swinog mailing list swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog
On Wed, Mar 31, 2021 at 02:06:24PM +0200, Tobi wrote:
We're seeing the same issue since 28th March. Looks like their new reputation system needs some fine tuning by a big hammer :-) Maybe they bought the same reputation system as 1&1 did not long ago.
They communicated as follows:
"Due to a heavy spam wave before and over the weekend around the 27th of March, Bluewin Mail was forced to temporarily tighten up its policy for large senders. As of today, these rules have been lifted and sending to Bluewin Mail should not lead to rejects or defers anymore.
If you still experience issues sending to Bluewin Mail as of today [tuesday], please open up another ticket on our support portal (support.bluewin.ch). "
I concur there were more spams last week-end than usual, the catched-up list was about twice as long, and 2 phishing attempts went through on my mail server.
Hello Swinog,
All our customer e-mails to bluewin mails are delayed with "451 4.2.0 sc965: IP reputation ratelimit in effect" until it finally gives up (some of them never get through) We have currently a lot of support tickets and complaints from our customers because of this.
It's the 3rd time it happens in two weeks and we found evidence of unusual SPAM activity from our servers that would justify such a ratelimiting/rejecting.
We spend a lot of resources on keeping our servers clean. They aren't listed in any blacklist. The overall reputation is good (senderscore, talos intelligence, abusix....) Also we're far from having the same outgoing volume as would have big players (and common source of spam) like gmail, outlook, etc. and they don't seems to be affected by the same issue when sending to bluewin ??
Could it be there some kind of whitelisting for these senders at bluewin? If yes, can our servers also be whitelisted from this ?
Of course, I understand the need to protect servers from SPAM but actually it is also affecting legit senders and causing a lot of trouble.
Kind regards,
Sébastien RICCIO SYSTEM ADMINISTRATOR P +41 840 888 888 F +41 840 888 000 M sriccio@swisscenter.com
-----Message d'origine----- De : swinog-bounces@lists.swinog.ch swinog-bounces@lists.swinog.ch De la part de Marc SCHAEFER Envoyé : mercredi, 31 mars 2021 14:44 À : swinog@lists.swinog.ch Objet : Re: [swinog] Mail rejection at bluewin
On Wed, Mar 31, 2021 at 02:06:24PM +0200, Tobi wrote:
We're seeing the same issue since 28th March. Looks like their new reputation system needs some fine tuning by a big hammer :-) Maybe they bought the same reputation system as 1&1 did not long ago.
They communicated as follows:
"Due to a heavy spam wave before and over the weekend around the 27th of March, Bluewin Mail was forced to temporarily tighten up its policy for large senders. As of today, these rules have been lifted and sending to Bluewin Mail should not lead to rejects or defers anymore.
If you still experience issues sending to Bluewin Mail as of today [tuesday], please open up another ticket on our support portal (support.bluewin.ch). "
I concur there were more spams last week-end than usual, the catched-up list was about twice as long, and 2 phishing attempts went through on my mail server.
_______________________________________________ swinog mailing list swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog
Hi Sébastien,
Just wanted to let you know that you’re not the only one affected. We’re on the same boat.
On our side, while we wait for an answer to our ticket (opened Friday), we’re rotating the IP used for outgoing mails to bluewin/bluemail so that our customers don’t have to wait too long for a delivery. Before the changes at bluewin, everything was going thorough a single outgoing IP with no trouble.
Maybe the big players are not affected because they already have pools of outgoing IPs and switch automatically between them.
Or maybe the new spam filter is not really well tuned for senders of our size (Our volume of emails to bluewin is on the order of 1000-3000/day, are you in that range as well ?).
I hope you/we find a solution soon!
Kind regards, Florian -- TiZoo Sàrl - AlpHosting
Le 7 avr. 2021 à 09:50, Sébastien Riccio sr@swisscenter.com a écrit :
Hello Swinog,
All our customer e-mails to bluewin mails are delayed with "451 4.2.0 sc965: IP reputation ratelimit in effect" until it finally gives up (some of them never get through) We have currently a lot of support tickets and complaints from our customers because of this.
It's the 3rd time it happens in two weeks and we found evidence of unusual SPAM activity from our servers that would justify such a ratelimiting/rejecting.
We spend a lot of resources on keeping our servers clean. They aren't listed in any blacklist. The overall reputation is good (senderscore, talos intelligence, abusix....) Also we're far from having the same outgoing volume as would have big players (and common source of spam) like gmail, outlook, etc. and they don't seems to be affected by the same issue when sending to bluewin ??
Could it be there some kind of whitelisting for these senders at bluewin? If yes, can our servers also be whitelisted from this ?
Of course, I understand the need to protect servers from SPAM but actually it is also affecting legit senders and causing a lot of trouble.
Kind regards,
Sébastien RICCIO SYSTEM ADMINISTRATOR P +41 840 888 888 F +41 840 888 000 M sriccio@swisscenter.com
-----Message d'origine----- De : swinog-bounces@lists.swinog.ch swinog-bounces@lists.swinog.ch De la part de Marc SCHAEFER Envoyé : mercredi, 31 mars 2021 14:44 À : swinog@lists.swinog.ch Objet : Re: [swinog] Mail rejection at bluewin
On Wed, Mar 31, 2021 at 02:06:24PM +0200, Tobi wrote:
We're seeing the same issue since 28th March. Looks like their new reputation system needs some fine tuning by a big hammer :-) Maybe they bought the same reputation system as 1&1 did not long ago.
They communicated as follows:
"Due to a heavy spam wave before and over the weekend around the 27th of March, Bluewin Mail was forced to temporarily tighten up its policy for large senders. As of today, these rules have been lifted and sending to Bluewin Mail should not lead to rejects or defers anymore.
If you still experience issues sending to Bluewin Mail as of today [tuesday], please open up another ticket on our support portal (support.bluewin.ch). "
I concur there were more spams last week-end than usual, the catched-up list was about twice as long, and 2 phishing attempts went through on my mail server.
swinog mailing list swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog
swinog mailing list swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog
Hello Florian,
We also rotated IPs since two days, but all three are already blacklisted.. The new one added yesterday lasted until this afternoon. Its been years we're running on the same single IP with backup IPs in case of trouble but rarely used them. Now to deliver to bluwin it requires that we add new virgin IPs every 24/48h to the outgoing gateway since they made changes.
As the server retries non-delivered messages with increasing delay between the retries, I suspect these retries are also taken into account in the counters for the rate limit they've added, so in the end the rate limit never expires.
I think we're in the 1500-2000 messages per day to bluwin range.
In the meantime I can send a mail from gmail to bluwin without issue. Are they whitelisted ? I would really need to know what's going on here ?
Kind regards,
Sébastien RICCIO SYSTEM ADMINISTRATOR P +41 840 888 888 F +41 840 888 000 M sriccio@swisscenter.com
-----Message d'origine----- De : Florian Blaser florian.blaser@tizoo.com Envoyé : mercredi, 7 avril 2021 13:11 À : swinog@lists.swinog.ch Cc : Sébastien Riccio sr@swisscenter.com Objet : Re: [swinog] Mail rejection at bluewin
Hi Sébastien,
Just wanted to let you know that you’re not the only one affected. We’re on the same boat.
On our side, while we wait for an answer to our ticket (opened Friday), we’re rotating the IP used for outgoing mails to bluewin/bluemail so that our customers don’t have to wait too long for a delivery. Before the changes at bluewin, everything was going thorough a single outgoing IP with no trouble.
Maybe the big players are not affected because they already have pools of outgoing IPs and switch automatically between them.
Or maybe the new spam filter is not really well tuned for senders of our size (Our volume of emails to bluewin is on the order of 1000-3000/day, are you in that range as well ?).
I hope you/we find a solution soon!
Kind regards, Florian -- TiZoo Sàrl - AlpHosting
Le 7 avr. 2021 à 09:50, Sébastien Riccio sr@swisscenter.com a écrit :
Hello Swinog,
All our customer e-mails to bluewin mails are delayed with "451 4.2.0 sc965: IP reputation ratelimit in effect" until it finally gives up (some of them never get through) We have currently a lot of support tickets and complaints from our customers because of this.
It's the 3rd time it happens in two weeks and we found evidence of unusual SPAM activity from our servers that would justify such a ratelimiting/rejecting.
We spend a lot of resources on keeping our servers clean. They aren't listed in any blacklist. The overall reputation is good (senderscore, talos intelligence, abusix....) Also we're far from having the same outgoing volume as would have big players (and common source of spam) like gmail, outlook, etc. and they don't seems to be affected by the same issue when sending to bluewin ??
Could it be there some kind of whitelisting for these senders at bluewin? If yes, can our servers also be whitelisted from this ?
Of course, I understand the need to protect servers from SPAM but actually it is also affecting legit senders and causing a lot of trouble.
Kind regards,
Sébastien RICCIO SYSTEM ADMINISTRATOR P +41 840 888 888 F +41 840 888 000 M sriccio@swisscenter.com
-----Message d'origine----- De : swinog-bounces@lists.swinog.ch swinog-bounces@lists.swinog.ch De la part de Marc SCHAEFER Envoyé : mercredi, 31 mars 2021 14:44 À : swinog@lists.swinog.ch Objet : Re: [swinog] Mail rejection at bluewin
On Wed, Mar 31, 2021 at 02:06:24PM +0200, Tobi wrote:
We're seeing the same issue since 28th March. Looks like their new reputation system needs some fine tuning by a big hammer :-) Maybe they bought the same reputation system as 1&1 did not long ago.
They communicated as follows:
"Due to a heavy spam wave before and over the weekend around the 27th of March, Bluewin Mail was forced to temporarily tighten up its policy for large senders. As of today, these rules have been lifted and sending to Bluewin Mail should not lead to rejects or defers anymore.
If you still experience issues sending to Bluewin Mail as of today [tuesday], please open up another ticket on our support portal (support.bluewin.ch). "
I concur there were more spams last week-end than usual, the catched-up list was about twice as long, and 2 phishing attempts went through on my mail server.
swinog mailing list swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog
swinog mailing list swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog
-
Florian Blaser -
Marc SCHAEFER -
Markus -
Peter Rohrer -
Silvan M. Gebhardt -
Sébastien Riccio -
Tobi