Delivery Status Notification

[MalcP]

One or two emails recently have generated a Delivery Status Notification. One is "Message from 81.104.62.43 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1" and the other is "Messages from your IP have been determined to be suspicious as a device on your current network may have malware." I run scans regularly on my system and have had no problem with the vast majority of emails I send. Any ideas please?

[HowardML]

Yes. I have shrewd idea of what is going on here. First we need to see the full error messages with personal email details redacted. Please post them in this thread. A paraphrase is a clue, but not much of one!

Second check you home IP address for being on a blacklist. Use MXToolbox here:

https://mxtoolbox.com/blacklists.aspx

and let us know what you get back. We'd be especially interested in seeing if it is listed on Spamhaus Zen. We expect to see it listed on SORBS DUHL or Spamhaus PBL. No cause for concern with those two listings.

You can get your home IP address (the IP address of the Hub) here:

https://whatismyipaddress.com/

When you click on the link your IP (IPv4) address appears instantly.

The big clue here is the IP range that VM have used to send you messages out.  That range is reserved for email that appears spammy to the VM outgoing mail servers

[MalcP]

I have checked my IP and it is blacklisted with Barracuda, SORBS DUHL and Spamhaus ZEN

The error messages are:

From: mailer-daemon@virginmedia.com
Date: 13 April 2021 at 03:32:16 BST
To:
Subject: Message Delivery Failure

     This is an automatically generated Delivery Status Notification.      

Delivery to the following recipients failed permanently:

  xxxxx@sky.com

Reason: This is the mail system at host know-smtprelay-11-imp.

I am sorry to have to inform you that your message, "Tea and Coffee in the garden", could not be delivered to xxxxxx@sky.com.

Messages from your IP have been determined to be suspicious as a device on your current network may have malware. Please refer to the spamhaus listing below for further information;

https://www.spamhaus.org/query/ip/[DELETED]


Please be aware that if you are not sending mail from your own broadband connection that the listing may have been caused by a previous user Delivery has been aborted due to the below issue:
Maximum Retry Queue Age Reached

and:

From: mailer-daemon@virginmedia.com
Date: 12 April 2021 at 11:10:22 BST
To: 
Subject: Delivery Status Notification

     This is an automatically generated Delivery Status Notification.      

Delivery to the following recipients was aborted after 37 minute(s):

 xxxxx@sky.com

Reason: This is the mail system at host know-smtprelay-11-imp.

I am sorry to have to inform you that your message, "Tea and Coffee in the garden", has not yet been delivered to .com.

Messages from your IP have been determined to be suspicious as a device on your current network may have malware. Please refer to the spamhaus listing below for further infomation;
https://www.spamhaus.org/query/ip/[DELETED]
Please be aware that if you are not sending mail from your own broadband connection that the listing may have been caused by a previous user The remote server returned the below error when attempting delivery:

421:421 4.7.0 [TSS04] Messages from 81.104.xxxx temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.verizonmedia.com/error-codes


)

[MOD EDIT: Personal and private information has been removed from this post.]

[HowardML]

You need to run a further check before I refer this to the VM staff for investigation.

We need to know which part of the Spamhaus Zen composite list your IP is on. Btw next time please edit out your home IP address from posts, that too is held to be private information. I will ask the Mods to do it for us this time as it is too late for you to edit your posts. My bad - I should have mentioned this too.

Run the same IP address through this check and let us know what parts of the Spamhaus list are reported, XBL is of particular interest as is SBL.

https://check.spamhaus.org/

[MalcP]

Thanks Howard

The check returned

Policy Blocklist (PBL) - This is for information only. No action is required (unless you run your own mail server).

This IP is listed in the Policy Blocklist (PBL)

Outbound Email policy of The Spamhaus Project for this IP range
This IP address range has been identified by Spamhaus as not meeting our policy for IP addresses permitted to deliver unauthenticated 'direct-to-mx' email to PBL users.

Important: If you are using any normal email software (such as Outlook, Entourage, Thunderbird, Apple Mail, etc.) and you are being blocked by this Spamhaus PBL listing when you try to send email, the reason is simply that you need to turn on "SMTP Authentication" in your email program settings.

Don’t panic!

The inclusion of your IP address on the Policy Blocklist (PBL) is standard for the vast majority of internet users and is not the result of your actions. Here are some key PBL facts for your understanding:

• Being on this list does not mean you won’t be able to send emails.
• You do not need to request removal from PBL.
• This listing is controlled by your Internet Service Provider (ISP), not Spamhaus.
• Your ISP lists ranges of IP addresses that shouldn’t be sending email directly to the internet.
• Typically, IPs of broadband or dial-up customers will be included in this list.
• This is part of Internet best practices enacted to protect all users.
• Outbound Email policy of The Spamhaus Project for this IP range

  This IP address range has been identified by Spamhaus as not meeting our policy for IP addresses permitted to deliver unauthenticated 'direct-to-mx' email to PBL users.

  Important: If you are using any normal email software (such as Outlook, Entourage, Thunderbird, Apple Mail, etc.) and you are being blocked by this Spamhaus PBL listing when you try to send email, the reason is simply that you need to turn on "SMTP Authentication" in your email program settings. 

Hope this is enough info

[HowardML]

Kudos to you. You are very good at this. I wish others were as receptive to advice and cooperation. 

The PBL is nothing to worry about. Your IP address should be on that. Mine is. All dynamically allocated IP addresses from ISPs should be on it as they should not be running mail servers. 

My suspicions were your IP address was listed on part of the Spamhaus Zen composite list that indicates that spam had been detected as coming from your system. Well you passed that test. No such listing. 

But you are on one list (Barracuda) and what I am also seeing is that the VM servers sending out your mail are those in use when VM think you mail is spam or spammy. That needs investigation by VM so I am going to ask the Forum Team to look at it for you. @ModTeam 

This will take time so be prepared for a bit of wait. VM staff here will respond in this thread and may ask for more information via private message. They will probably want the mail headers from the relevant returned mail. 

[MalcP]

Many thanks Howard. I will wait for further instructions.

[Ashleigh_C]

Hi there @MalcP

Thank you so much for your post and I am so sorry to hear this has happened to you email! 

I'm going to send you a PM so we can discuss this further. Keep an eye out for the purple envelope in the top right corner to alert you to a new message.

Thank you. 

[MalcP]

This problem was picked up by you 8 weeks ago. Has there been any progress please?

[Steven_L]

Thanks for coming back to us @MalcP and sorry that we haven't provided a further update.

I have gotten in touch with the agent that raised this for you and I will be in touch once, I have a further update for on this issue.

Regards,

Steven_L