ntlworld domain blocked by trend micro

[davidas99]

It appears that the ntlworld.com domain name is being blocked by Trend Micro, meaning it is impossible to send email to the uk NHS (example@nhs.net). Trend Micro returns the error :

host prefilter.emailsecurity.trendmicro.eu [150.70.226.147]

    SMTP error from remote mail server after RCPT TO:<example@nhs.net>:

    554 5.7.1 <example@nhs.net>: Recipient address rejected:  ERS-QIL.

In the last few days, two different email addresses within the nhs.net domain have failed with this error.

Can VM please ask trend micro to remove the blockage?

Thankyou

David

[Joseph_B]

Hey @davidas99,

Welcome back to the Community Forums and thanks for the post.

Sorry to hear you have been having this issue with your emails, can you confirm when sending these emails are you doing it through the webmail or through a 3rd party app such as Outlook?

Joe

[davidas99]

@Joseph_B,

I'm using Outlook (as I need a reasonable level of management of emails). I'm not having problems sending mails to other domains; the error is quite explicit (the domain name is on a block list) and that has nothing to do with the email client. As I understand how block-lists work, VM has to make the request to Trend Micro to have the domain removed from the block-list.

David

[Vikki_M]

Thank you for your response David.

You mentioned the ntlworld.com domain name is being blocked by Trend Micro. Have you contacted Trend Micro directly regarding this? It appears you're sending the email from our servers successfully, however its getting blocked at the end. This would therefore not be something we can resolve on our end, you would need to contact Trend Micro directly please. 

[davidas99]

@Vikk_M

I don't work for Virgin Media. Trend Micro, or indeed any other anti-spam service provider won't talk to me about VM's domain name / IP address. It needs to come from the domain name holder. Surely you understand that?

David

[Daniel_Et]

Hi @davidas99, thank you for your response. 

Just to confirm, are you trying to send the e-mail whilst in the UK and/or from your home network?

Regards,
Daniel

[coenoby · Accepted solution]

@davidas99 

" Recipient address rejected: ERS-QIL."

Yes you are correct in your understanding of the issue.

"QIL" is Trend Micro's "Quick IP List"  which is used to filter incoming emails on the basis of their IP Reputation. It's part of Trend Micro's Email Reputation Service (ERS)

It may not be a case of removing the relevant VM IP address from the list because as I understand it, organisations can set how aggressively that filter is applied. It may be that is being is being applied too aggressively.

One thing I am not sure of is whether the IP address in question is:

• the IP address of one of VM's outgoing email servers
• or whether it is the IP address of your VM home network.

I am thinking the concern is most likely with the VM email server but both addresses will be available to the recipient's incoming mail server when you send an email via Outlook. 

I would suggest that the details of this case need to be passed to the relevant VM security team. Hopefully, one of the Forum Team members such as @Daniel_Et can do that.

However, while you are waiting for that to happen you could use VM''s netreport serivce to report this yourself:

• Go to https://netreport.virginmedia.com/netreport/  and:
  • select an abuse type of Email Sending Errors from drop down list
  • select an abuse form of Other from drop down list
  • paste the complete error message that you put in your initial post into the Log Evidence area
  • enter your name into My name field
  • enter your email address into Email address field
  • select Submit button

I hope you can get it sorted asap.

Coenoby

[davidas99]

Thanks @Coenoby.

I have tried again today, sending to one of the two email addresses. It was successful - it appears that the blockage has been removed (by whatever means). Thanks also for the details of how to report a problem directly rather than whinging on this forum in the hope that someone from VM will pick it up.... I've copied the details for future reference.

David

[davidas99]

@Daniel_Et

Yes, UK / Home. However, as per my response to @Coenoby the blockage appears to have been cleared - this evening I've sucessfully sent mail to one of the two addresses I previously couldn't send to.

David

[ravenstar68]

---

@Vikki_M wrote:

Thank you for your response David.

You mentioned the ntlworld.com domain name is being blocked by Trend Micro. Have you contacted Trend Micro directly regarding this? It appears you're sending the email from our servers successfully, however its getting blocked at the end. This would therefore not be something we can resolve on our end, you would need to contact Trend Micro directly please. 

---

While the problem may have resolved itself, I'm going to politely disagree with @Vikki_M here.  When an email is blocked it because the SENDING IP of the outbound mail server appears on the block list in question - in this case the ERS QIL.  Note that some security software will block these IP addresses at different stages of the mail transfer, sometimes leading to slightly confusing errors - in this case - "recipient address rejected".

I'm not sure of the full setup of the QIL, but some of these real time lists are transitory in nature, in that if no more spam is seen from a specific IP address in a given period of time then the IP address drops off.  Meaning mail flows again.  However VM should normally escalate issues like this as they need to try and identify the source of the spam and take appropriate steps to prevent it happening again as well as request that the IP address be delisted 

@coenoby Typically a mail exchanger doesn't receive the original users IP address until the data portion of a mail send.  Recipient address rejected usually means that the send was blocked before the main mail data is sent.  So the Senders IP in the Trend Micro help pages indicates the IP address of the Mail Transfer Agent (VM's outbound server in this case) rather than the original users sending address.