Hi all,

I hope I've found the correct sub forum, there were quite a few and we're not a user of your product currently, but I found a few posts similar to my issues.

We're a small software company, we host mails for some of our customers, one of our customers in particular are not receiving emails from some of their customers, all these customers have one thing in common when I look up their MX records, they are all using *.eu.messagelabs.com.

I found this http://ipremoval.sms.symantec.com/lookup/ and checked the customers IP and received this : The IP address you submitted, IP Address, does not have a negative reputation and therefore cannot be submitted for investigation.

This problem has been happening for a couple of weeks, I've told our client they need to speak to their customers, but most of these people are single person companies who've bought packages products and our customer is getting frustrated.

Is there anyway I can try and progress this for them, the customer receives 1000's of mails a day, only issues we have are the messagelabs ones. The emails in question don't get as far as their mail server and I don't have access to the remote customer to get any more information.

Can give MX records / IP's if helps, but thought best not to post them openly :)

Hope you can help and let me know if you need information.

Regards

Andy

Hi,

We start using new IPs provided by OVH to host web sites and they seems to be blocked by many email filters and MessageLabs refuse any connection from them. Theses IPs seems to be used to send spam some month ago. The IPs are 54.36.200.48/28.

Some logs :

6B566A215     88331 Wed Feb 21 18:22:57  ***@cook-and-gift.com
(connect to cluster4.us.messagelabs.com[216.82.251.34]:25: Connection timed out)
                                         ***@hudsonjeans.com

67769A214     87713 Wed Feb 21 18:22:57  ***@cook-and-gift.com
(connect to cluster4.us.messagelabs.com[216.82.242.179]:25: Connection timed out)
                                         ***@hudsonjeans.com

The removal lookup page (http://ipremoval.sms.symantec.com/lookup/) see no problem. It may be a network issue (some firewall blocking any connection).

Some know who to contact to remove this restriction?

Regards,

Hello, really need assistance. Whenever we message any one of our customer or client using messagelabs as their spam filter we are getting NDRs.

We use Office365 to send and this issue just started yesterday. SPF and DKIM configured and working. Not in any blacklist. Please help. This is hindering our business productivity. I have sent an email to investigation#review.symantec.com and cloudfeedback@feedback-87.brightmail.com with an attachment for the error.

Can anyone help? Calling Messagelabs gets me nowhere, since we are not using messagelabs.

Thanks,

Mike

Hi,

We have domain in G-Suite for mail purpose. we are sending mail to few client and get's bounce back to us.

Its Saying Symantec mail filter error. We suspect our domain get's blocklisted by symantec but still we are not doing any spaming activity.

We couldn't get ipaddress because its in Google cloud.

So could you please advise how to send delist request by Domain Address.

-Thanks

Ricardo Landim

Hello, emails from some of our addresses are apparently being blocked by MessageLabs. Messages sent by people over here are never delivered to recipients and just disappear.

As far as we know we are not blacklisted and our IP has no negative reputation in http://ipremoval.sms.symantec.com/lookup/.

Message Flow utility for our Exchange 365 server shows that messages stop at cluster5.eu.messagelabs.com at IP 85.158.142.193 and never go ahead.

Sender domain: @milleri.it

Sender IP: 93.62.140.24

Recipients domain: @luxottica.com

Could you please help us or suggest any action ?

Thanks

Pierangelo Repetti

Hi,

We have a requirement to rewite the headers on inbound mail from a specific email address. Is this possible? It's a business requirement for a service desk project we have (external supplier needs to look like they are coming from an internal email address).

Outbound is fine (just set the forwardingSMPTAddress atribute on the mailbox).

Inbound needs to rewrite the From: and Return-Path: headers such that servicedesk@serviceprovider.com is changed to servicedesk@customer.com

The Symantec on-prem gateway solution calls this masquerading and there is KB article describing it here:

https://support.symantec.com/en_US/article.HOWTO92...

But I can't find an equivalent for security.cloud.

Thanks!

People,

Some of my users who regularly send out the email to the customer suddenly got this email NDR:

Reason: 554 5.4.7 [internal] exceeded max time without delivery

I wonder why MessageLabs block it?

Message Body

This is the mail delivery agent at Symantec Email Security.cloud.

I was unable to deliver your message to the following addresses:

Friend@apnoutdoor.com

Reason: 554 5.4.7 [internal] exceeded max time without delivery

The message subject was: Thank you
The message date was: Thu, 22 Feb 2018 04:54:20 +0000
The message identifier was: B0/5A-19486-20D4E8A5
The message reference was: server-12.tower-164.messagelabs.com!1519275264!53903131!1

Please do not reply to this email as it is sent from an unattended mailbox.
Contact your email administrator if you need more information, or
instructions for resolving this issue.

Test to understand why my post was not published

Hello !

We cannot send email to some domains...

We keep getting the following error connect to cluster6.us.messagelabs.com:

2018-03-05 20:36:54 1esvuo-0004bq-O7 <= (myemail) H=(79.124.76.164) [::1]:45446 P=esmtpa A=dovecot_login:myemail S=575 id=5f58ff3c27affbdabde39d90edaaa17e@mydomain T="TEST EMAIL3" for dest_email
2018-03-05 20:36:54 1esvuo-0004bq-O7 Sender identification U=asssof D=mydomain S=myemail
2018-03-05 20:36:54 1esvuo-0004bq-O7 SMTP connection outbound 1520278614 1esvuo-0004bq-O7 my domain dest_email
2018-03-05 20:37:57 1esvuo-0004bq-O7 H=CLUSTER6.US.MESSAGELABS.COM [216.82.242.36] Connection timed out
2018-03-05 20:39:00 1esvuo-0004bq-O7 H=CLUSTER6.US.MESSAGELABS.COM [216.82.249.212] Connection timed out
2018-03-05 20:40:03 1esvuo-0004bq-O7 H=CLUSTER6.US.MESSAGELABS.COM [216.82.241.100] Connection timed out
2018-03-05 20:41:06 1esvuo-0004bq-O7 H=CLUSTER6.US.MESSAGELABS.COM [216.82.242.46] Connection timed out
2018-03-05 20:42:09 1esvuo-0004bq-O7 H=CLUSTER6.US.MESSAGELABS.COM [216.82.251.38] Connection timed out

Our IP's are not blacklisted and I have check the symantec blacklist and it says we do not have a negative reputation so we can not be investogated: 

The IP address you submitted, 217.174.149.20, does not have a negative reputation and therefore cannot be submitted for investigation.

The IP address you submitted, 79.124.76.164, does not have a negative reputation and therefore cannot be submitted for investigation.

We need to be able to send emails to these destinations.

Our mail servers ip address are 79.124.76.164 and 217.174.149.20

Please could you fix it for both IP's?

Thank you very much.

Regards,

Xavi.

Our mail server with IP addresses 217.174.149.20 and  79.124.76.164 (are not blacklisted and with good reputation)  can not send email to our customers and suppliers who use messagelabs.com
It maybe block by messagelabs.com 
Please help us.

2018-03-05 20:37:57 1esvuo-0004bq-O7 H=CLUSTER6.US.MESSAGELABS.COM [216.82.242.36] Connection timed out
2018-03-05 20:39:00 1esvuo-0004bq-O7 H=CLUSTER6.US.MESSAGELABS.COM [216.82.249.212] Connection timed out
2018-03-05 20:40:03 1esvuo-0004bq-O7 H=CLUSTER6.US.MESSAGELABS.COM [216.82.241.100] Connection timed out

etc...

Thank you !
Regards,

Xavi.

Hi,

We are a email service provider. Suddenly all of our customer having problem in sending email to messagelabs. Below is the bouncing message. Could you advise how to fix this? Our email sending IP is 203.194.220.41. This is different from the  website server IP 203.194.220.53. Thanks.

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its

recipients. This is a permanent error. The following address(es) failed:

 xxxxxx@tokiomarineasia.com

    all hosts for 'tokiomarineasia.com' have been failing for a long time (and retry time not reached)

Reporting-MTA: dns; jumphk3.net

Action: failed

Final-Recipient: rfc822;xxxxxxxxx@tokiomarineasia.com

Status: 5.0.0

=============

Mail delivery failed: returning message to sender

Message Body

This message was created automatically by mail delivery software. A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed:   xxxxxxx@hkfi.org.hk     all hosts for 'hkfi.org.hk' have been failing for a long time (and retry time not reached)  xxxxxxx@hkfi.org.hk     all hosts for 'hkfi.org.hk' have been failing for a long time (and retry time not reached)   xxxxxx@hkfi.org.hk     all hosts for 'hkfi.org.hk' have been failing for a long time (and retry time not reached)   selina@hkfi.org.hk     all hosts for 'hkfi.org.hk' have been failing for a long time (and retry time not reached)   xxxxxx@hkfi.org.hk     all hosts for 'hkfi.org.hk' have been failing for a long time (and retry time not reached)

Reporting-MTA: dns; jumphk3.net Action: failed Final-Recipient: rfc822;xxxxxx@hkfi.org.hk Status: 5.0.0

Hi:

We're a small ESP and it seems that the following IPs are blocked by message labs. They do not appear here, but there's no bounce message b/c the connection is failing.

Per Richard Brittain here https://www.symantec.com/connect/forums/ip-blacklist-removal starting a separate thread.

Affected IPs are:

74.208.221.191 
74.208.8.75 
74.208.14.106 
74.208.8.174 
74.208.13.17 
74.208.147.114 
216.250.117.210
74.208.144.46
74.208.68.249
74.208.68.144
74.208.68.181
74.208.65.157
74.208.47.126
74.208.47.60
74.208.144.49 

Happy to discuss offline at my forum address if we have to. All these IPs have sender scores of 97 or better; this makes no sense to me.

Hi All,

We have run into an issue regarding bouncebacks when sending emails to clients. 

This has never been an issue before, but it is increasing day by day.

Our sales team sends out offers for their products. However, recently more and more bouncebacks are happening. We have searched through our exchange logs and have found no such correlation of why this issue keeps occuring. 

Any ideas of why this keeps happening more and more frequently now would be much appreciated.

HI,

We are unable to send mail to actuaries.ch domain, which use the Messages labs services.

We receive this in return :

Delivery has failed to these recipients or groups:

sekretariat@actuaries.ch
A problem occurred while delivering this message to this email address. Try sending this message again. If the problem continues, please contact your helpdesk.

The following organization rejected your message: cluster8.eu.messagelabs.com.

Diagnostic information for administrators:

Generating server: tundra.swiss-support.net

sekretariat@actuaries.ch
cluster8.eu.messagelabs.com
Remote Server returned '<cluster8.eu.messagelabs.com #5.0.0 smtp; 553-SPF (Sender Policy Framework) domain authentication 553-fail. Refer to the Troubleshooting page at 553-http://www.symanteccloud.com/troubleshooting for more 553 information. (#5.7.1)>'

Original message headers:

Return-Path: <fbuton@groupemutuel.ch>
Received: from localhost (localhost.localdomain [127.0.0.1])
        by tundra.swiss-support.net (Postfix) with ESMTP id 05B741224006
        for <schweizerische_aktuarvereinigung@swissre.com>; Mon, 12 Mar 2018 13:14:14 +0100 (CET)
Received: from tundra.swiss-support.net ([127.0.0.1])
        by localhost (tundra.swiss-support.net [127.0.0.1]) (amavisd-new, port 10024)
        with ESMTP id 3xK54uARPGh1
        for <schweizerische_aktuarvereinigung@swissre.com>;
        Mon, 12 Mar 2018 13:14:09 +0100 (CET)
Received: from mail4.groupemutuel.ch (mail4.groupemutuel.ch [195.65.93.115])
        by tundra.swiss-support.net (Postfix) with ESMTPS id 2AE131224004
        for <sekretariat@actuaries.ch>; Mon, 12 Mar 2018 13:14:09 +0100 (CET)
X-Virus-Scanned: amavisd-new at tundra.swiss-support.net
IronPort-PHdr: =?us-ascii?q?9a23=3AEfppFxec7ztQ3vna6fmjQnh2lGMj4u6mDksu8pMi?=
=?us-ascii?q?zoh2WeGdxcS+bR7h7PlgxGXEQZ/co6odzbaO6Oa4ASQp2tWoiDg6aptCVhsI24?=
=?us-ascii?q?09vjcLJ4q7M3D9N+PgdCcgHc5PBxdP9nC/NlVJSo6lPwWB6nK94iQPFRrhKAF7?=
=?us-ascii?q?Ovr6GpLIj8Swyuu+54Dfbx9HiTahb75+Ngm6oRnMvcQKnIVuLbo8xAHUqXVSYe?=
=?us-ascii?q?RWwm1oJVOXnxni48q74YBu/SdNtf8/7sBMSar1cbg2QrxeFzQmLns65Nb3uhnZ?=
=?us-ascii?q?TAuA/WUTX2MLmRdVGQfF7RX6XpDssivms+d2xSeXMdHqQb0yRD+v6bpgRh31hy?=
=?us-ascii?q?cdLzM38H/ZhNFsjKxVoxyhpgBwzIHPbY6PKPZyYrnQcc8GSWZcWMtaSixPApm7?=
=?us-ascii?q?b4sKF+cPPfxYoJfgqFQQtxu+BBWjD/7yxz9Vmn/22qs62PkmHAHIxwMgAs4OsH?=
=?us-ascii?q?PSrNjuO6cSS+e1zLTQzTrdavNWxCv96JXWfRAlu/2DQbJwfNPXxEIyFA3Flk2d?=
=?us-ascii?q?pZHnMj+LzOgBrmmW4/BiWO6ykWIrtgB8riCyysoulIXFnJ8Zx1He+Slnzos5P9?=
=?us-ascii?q?K1RFZ1YdG6E5ZcqySXOo54Qs4hQmxnpCM3xqMdtpGgYCQHzYgoyh3eZvCadoWF?=
=?us-ascii?q?4BzuWPueLDp+mXlrYqiwhwyo/kil0uD8U86030tUoSddidnMs2wN1wTU6siaVv?=
=?us-ascii?q?tx5keh1iiL1wDU8uxKIEc6mLbBJZAm37A+l4YfvVnZEi/5gkX2i7KWdl069eit?=
=?us-ascii?q?9uTnfqjmqYGYN4Nulg7+Mrwims25AesmLggDR3WX9Oai2LH54EH0Qa9Gg/8rnq?=
=?us-ascii?q?XDrZzXJNwXpqujDA9U1oYj5Qy/DzCj0NkAk3kIN09FeA6Aj4jvIFzOL+r4DfCi?=
=?us-ascii?q?g1S0jjhrwu3GPqH8AprTKnjPiqvufbZl505G1AUz1cxf545TCrwZO/L8REzxtM?=
=?us-ascii?q?bGAR8lKQO02efnB89h1o4FQ22AHrOZML7Ivl+S5+IgPfKMaJUJtzb9eLAZ4Kuk?=
=?us-ascii?q?lnI6g1IBdLOo1Ic/YXukA/18IkiCJ3HsyJ9VCmoJpAciRfbrgUGqWDVPen+oXq?=
=?us-ascii?q?8noDo7XtGIF4DGE663jbCMxiawVrdLemdAQgSCG2r0cIOsVO0LdTqfJ9J9jzEA?=
=?us-ascii?q?E7OhHdxynSqyvRP3nuI0ZtHf/TcV4Mru?=
X-IPAS-Result: =?us-ascii?q?A2GbAgCObqZa/xBHEKxdGwEBAQEDAQEBCQEBAYJagVyBIZ5?=
=?us-ascii?q?wjxCHNwoTiEs4FAECAQEBAQEBAgECgQQLgjgigl0hXgEMCWsmAQQbhCyucSGIP?=
=?us-ascii?q?IIahTWEBIZmiTkEji6FC4cdCYEBj1iJKYVCkUiBLDWBdDMaCDCCfoRGjVSBGAE?=
=?us-ascii?q?BAQ?=
X-IronPort-AV: E=Sophos;i="5.47,461,1515452400";
   d="scan'208,217";a="28976107"
DISC: True
From: Frederic Buton <fbuton@groupemutuel.ch>
To: "sekretariat@actuaries.ch"<sekretariat@actuaries.ch>
Subject: test from Groupe Mututel
Thread-Topic: test from Groupe Mututel
Thread-Index: AdO5+5bBVC8ZG3n1TgWRmDaZBXN2jA==
Date: Mon, 12 Mar 2018 12:14:05 +0000
Message-ID: <317ff18a6f10407090d79186d895f8b5@GMAPMSG01.groupemutuel.ch>
Accept-Language: fr-CH, en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [172.16.23.4]
MIME-Version: 1.0
X-SM-OUT: True
X-MIMETrack: Itemize by SMTP Server on DOMPHU01/SRV/GroupeMutuel/CH(Release 8.5.3FP2|July
02, 2012) at 12.03.2018 13:14:15,
        Serialize by Router on DOMPMC01/SRV/GroupeMutuel/CH(Release 8.5.3FP6|November
21, 2013) at 12.03.2018 13:14:17,
        Serialize complete at 12.03.2018 13:14:17
X-TNEFEvaluated: 1
Content-Type: multipart/alternative;
        boundary="_000_317ff18a6f10407090d79186d895f8b5GMAPMSG01groupemutuelch_"
Content-Language: en-US

We have already update our SFP record by thursday in order to remove "sbap007.sb.neva-hosting.ch " entrie.

Please Help.

Frederic.

Hi

Our users are getting boune backs from addresses using message labs to say Messages are filtered.

Our IP was listed but has been removed but we are still getting bouncebacks.

Can you whitelist our IP 89.100.15.226

Hi,

We've configured postfix in Ubuntu 16.04  that will relay mails to our mailserver. It is realying all mails through our mailserver. Mails belongs to other domains are not sending( Got bounced ) but ableto send mails belongs to our domain ( mcci.com ).

We've checked the logs of mail, it is clearly showing that the IP which is assigned in DreamCompute VM got blocked by symantec.

please have a look at the error message below:

Mar 16 01:19:13 gitlab-x postfix/pickup[26806]: 7BBECFB9BB: uid=1002 from=<cmurugan@gitlab-x.mcci.com>
Mar 16 01:19:13 gitlab-x postfix/cleanup[31590]: 7BBECFB9BB: message-id=<20180316011913.7BBECFB9BB@gitlab-x.mcci.com>
Mar 16 01:19:13 gitlab-x postfix/qmgr[1418]: 7BBECFB9BB: from=<cmurugan@gitlab-x.mcci.com>, size=373, nrcpt=1 (queue active)
Mar 16 01:19:14 gitlab-x postfix/smtp[31592]: 7BBECFB9BB: to=<anjalatchimurugan@gmail.com>, relay=cluster2.us.messagelabs.com[216.82.251.43]:25, delay=0.83, delays=0.06/0.01/0.63/0.13, dsn=5.0.0, status=bounced (host cluster2.us.messagelabs.com[216.82.251.43] said: 553-you are trying to use me [server-12.tower-196.messagelab 553-s.com] as a relay, but I have not been configured to 553-let you [208.113.165.10, gitlab-x.mcci.com] do this. 553-Please visit www.symanteccloud.com/troubleshooting for 553-more details about this error message and instructions 553 to resolve this issue. (#5.7.1) (in reply to RCPT TO command))
Mar 16 01:19:14 gitlab-x postfix/cleanup[31590]: 630DCFB9BC: message-id=<20180316011914.630DCFB9BC@gitlab-x.mcci.com>
Mar 16 01:19:14 gitlab-x postfix/qmgr[1418]: 630DCFB9BC: from=<>, size=2992, nrcpt=1 (queue active)
Mar 16 01:19:14 gitlab-x postfix/bounce[31595]: 7BBECFB9BB: sender non-delivery notification: 630DCFB9BC
Mar 16 01:19:14 gitlab-x postfix/qmgr[1418]: 7BBECFB9BB: removed
Mar 16 01:19:14 gitlab-x postfix/local[31596]: 630DCFB9BC: to=<cmurugan@gitlab-x.mcci.com>, relay=local, delay=0.07, delays=0.02/0.03/0/0.03, dsn=2.0.0, status=sent (delivered to mailbox)
Mar 16 01:19:14 gitlab-x postfix/qmgr[1418]: 630DCFB9BC: removed

Regards, 

Murugan Chandrasekar

Hello,

My IP address : 112.78.3.144 cant sent any messages to recipients who use messagelabs email service

display error like this:

  Randomly picked 85.158.142.100 from list of possible hosts

  Attempting SMTP connection to 85.158.142.100:25

  Waiting for socket connection...

  *  Socket error 10060 - The connection timed out.

  *  85.158.142.100 added to connection failure cache for 5 minutes

  Attempting SMTP connection to cluster4a.eu.messagelabs.com

  Resolving A record for cluster4a.eu.messagelabs.com (DNS Server: 112.78.1.2)...

  *  D=cluster4a.eu.messagelabs.com TTL=(0) A=[85.158.139.103]

  Attempting SMTP connection to 85.158.139.103:25

  *  85.158.139.103 in connection failure cache for up to 5 minutes due to previous connection failure(s)

Help me remove IP from blacklist of messagelabs

thank you

Hello,

We receive emails from ts.fujitsu.com to momalogitech.com. in our Linux server cp426.webempresa.eu

When the emails come from 195.245.231.0/23 arrive in few minutes but when they come from 195.245.231 they always have important delays, about 8 hours...

We tried to sniff the traffic before the firewall and we didn't detect any connection to our pot 25 from that network before the emails arrive.

Could you bring some light to this issue?

Regards

Hello,

I am writting as Linakis Digital company's System Administrator.

We have a mail server which cannot send mails to some domains (vodafone.com / minerva.com.gr) which use as SMTP cluster5.eu.messagelabs.com & cluster3.eu.messagelabs.com.

Below is telnet outcome from this server.

C:\>telnet cluster5.eu.messagelabs.com 25
Connecting To cluster5.eu.messagelabs.com...Could not open connection to the host, on port 25: Connect failed

C:\>telnet cluster3.eu.messagelabs.com 25
Connecting To cluster3.eu.messagelabs.com...Could not open connection to the host, on port 25: Connect failed

Note that from our other Mail server we can send emails and we can telnet on port 25.

We also tried blacklist tool http://ipremoval.sms.symantec.com/lookup/  and we got response " The IP address you submitted, X.X.X.X, does not have a negative reputation and therefore cannot be submitted for investigation."

Please advice and also inform us if there is a way to send you the Mail Server IP on some private message to further investigate.

Regards,

Kyriakos Tzanoulinos