Forum Discussion

davidas99's avatar
davidas99
On our wavelength
12 months ago
Solved

ntlworld domain blocked by trend micro

It appears that the ntlworld.com domain name is being blocked by Trend Micro, meaning it is impossible to send email to the uk NHS (example@nhs.net). Trend Micro returns the error :

host prefilter.emailsecurity.trendmicro.eu [150.70.226.147]

    SMTP error from remote mail server after RCPT TO:<example@nhs.net>:

    554 5.7.1 <example@nhs.net>: Recipient address rejected:  ERS-QIL.

In the last few days, two different email addresses within the nhs.net domain have failed with this error.

Can VM please ask trend micro to remove the blockage?

Thankyou

David

 

  • coenoby's avatar
    coenoby
    11 months ago

    davidas99 

    " Recipient address rejected: ERS-QIL."

    Yes you are correct in your understanding of the issue.

    "QIL" is Trend Micro's "Quick IP List"  which is used to filter incoming emails on the basis of their IP Reputation. It's part of Trend Micro's Email Reputation Service (ERS)

    It may not be a case of removing the relevant VM IP address from the list because as I understand it, organisations can set how aggressively that filter is applied. It may be that is being is being applied too aggressively.

    One thing I am not sure of is whether the IP address in question is:

    • the IP address of one of VM's outgoing email servers
    • or whether it is the IP address of your VM home network.

    I am thinking the concern is most likely with the VM email server but both addresses will be available to the recipient's incoming mail server when you send an email via Outlook. 

    I would suggest that the details of this case need to be passed to the relevant VM security team. Hopefully, one of the Forum Team members such as Daniel_Et can do that.

    However, while you are waiting for that to happen you could use VM''s netreport serivce to report this yourself:

    • Go to https://netreport.virginmedia.com/netreport/  and:
      • select an abuse type of Email Sending Errors from drop down list
      • select an abuse form of Other from drop down list
      • paste the complete error message that you put in your initial post into the Log Evidence area
      • enter your name into My name field
      • enter your email address into Email address field
      • select Submit button

    I hope you can get it sorted asap.

    Coenoby

10 Replies

Sort By
  • Joseph_B's avatar
    Joseph_B
    Forum Team (Retired)
    12 months ago

    Hey davidas99,

    Welcome back to the Community Forums and thanks for the post.

    Sorry to hear you have been having this issue with your emails, can you confirm when sending these emails are you doing it through the webmail or through a 3rd party app such as Outlook?

    Joe

  • davidas99's avatar
    davidas99
    On our wavelength
    12 months ago

    @Joseph_B,

    I'm using Outlook (as I need a reasonable level of management of emails). I'm not having problems sending mails to other domains; the error is quite explicit (the domain name is on a block list) and that has nothing to do with the email client. As I understand how block-lists work, VM has to make the request to Trend Micro to have the domain removed from the block-list.

    David

     

    • Vikki_M's avatar
      Vikki_M
      Icon for Forum Team rankForum Team
      12 months ago

      Thank you for your response David.

      You mentioned the ntlworld.com domain name is being blocked by Trend Micro. Have you contacted Trend Micro directly regarding this? It appears you're sending the email from our servers successfully, however its getting blocked at the end. This would therefore not be something we can resolve on our end, you would need to contact Trend Micro directly please. 

       

      • davidas99's avatar
        davidas99
        On our wavelength
        12 months ago

        @Vikk_M

        I don't work for Virgin Media. Trend Micro, or indeed any other anti-spam service provider won't talk to me about VM's domain name / IP address. It needs to come from the domain name holder. Surely you understand that?

        David