Not receiving some emails

[Jimbob69]

I subscribe to a service that sends quite a few emails on a daily basis to my ntlworld email address. I've noticed that recently some of these aren't getting through to me. They are not in spam folders or being filtered by me (I've checked the settings) and the mail server - Sendgrid - reports that some of these are being blocked by the incoming server although most are getting through. This has only started happening in the last few days and I haven't had any issues for years prior to this. These emails are auto-generated and sent out to other addresses too but there is no reputational issue that we are aware of and, as I say, most of the emails are getting through to me. The issue seems to occur most often when several emails are due to be sent to me in a short space of time, and/or when the content of the emails appear to be quite similar to one another. Nevertheless, this is a service to which I subscribe and it is frustrating that the Virgin servers recently appear to have blocked some of these emails for no obvious reason. 

I have the block reports from Sendgrid for some of these blocked emails but presumably shouldn't post them openly here.

[coenoby]

---

@Jimbob69 wrote:

I have the block reports from Sendgrid for some of these blocked emails but presumably shouldn't post them openly here.

---

There is no problem posting one or more of those Non Delivery reports here providing you redact the email address by disguising the part before the @ symbol prior to posting. So for example post your email address as "xxxxxxx@ntlworld.com". Leave all the email domains intact though.

Coenoby

[Jimbob69]

Thanks.

A sample of the reports:

Processed

2021/05/28 12:25pm UTC+00:00

We sent the email using the shared IP address 167.89.8.74. Learn more.

Ntlworld.comReceived by mx.tb.ukmail.iss.as9143.net

Blocked

2021/05/28 12:25pm UTC+00:00

The ntlworld.com server blocked this message from being delivered. While we won't try to send this message again, we will attempt to send new messages to this address in the future.

You can view all addresses in your Blocks suppression group. Learn more.

Full response from the ntlworld.com server:

452 4.1.1 <xxxxxxxxxxxx@ntlworld.com> requested action aborted: try again later; info=mbY1luof9A3xl;mx4.tb;202105281425;167.89.8.74;

NB The sender IP is a proxy but isn't blacklisted and seems to have no reputation issues reported.

[coenoby · Accepted solution]

---

@Jimbob69 wrote:

452 4.1.1 <xxxxxxxxxxxx@ntlworld.com> requested action aborted: try again later; info=mbY1luof9A3xl;mx4.tb;202105281425;167.89.8.74;

---

Thanks for this.

I am not a deep diving email expert but I have an idea that this 452 4.1.1 error may be generated as a result of some anti spam measures by VM. Alternatively. it could simply be down to a temporary server issue.

Often these errors include some explanatory text such as "Too many recipients" or "Too many emails sent in the last hour". However, in this case there is just the rather unhelpful "try again later".

The fact that the block seems to come into play when Sendgrid sends a large number of emails in a short period or when the emails are all very similar does support my anti spam theory, In the later case, the fact that the emails are very similar may cause VM to suspect that multiple copies of the email are being sent, again very spammer like activity.

The fact that Sendgrid's emails are only being blocked intermittently does seem to rule out:

1) Sendgrid's domain or iP address being blacklisted, or

2) that something with Sendgrid's  outgoing email server setup is at fault.

Those are very common reasons for incoming emails being blocked but in both cases you would expect it to result in all Sendgrid's emails being blocked.

A copy of Sendgrid's outgoing email log for that email might offer more clues  as to what is going on.

One of the real in depth email experts on this forum may well be able to provide more insight than I can. Alternatively, it may well need to be referred to VM's email security team. That will need to done by one of the Forum Team (VM employees who support this forum) and they should be along to pick up this thread in the next few days. 

Either way, keep an eye on this thread for more insight into what is going on. In the meantime, as I said earlier, a copy of Sendgrid's outgoing email log for this email would be useful.

Sorry I cannot be more definitive. 😕

Coenoby

[Jimbob69]

Thanks. Your feedback is much appreciated in chimes with my feeling that the Virgin server's anti-spam settings are misrecognising some of these emails as spam due to a combination of proxy server, multiple addresses, similar appearance/text and close timing. And I can see how they might do so, but in this instance they're being oversensitive. My problem is that I pay to receive these emails and I can't do much about the problem if they are intercepted by the Virgin server before they even get to my personal spam filtering. Sendgrid seem confident that they're not doing anything wrong at their end, so I need some help from a VM mod, yes.

Anyway, thanks again.

[ravenstar68]

@coenoby 

I think you've done pretty well there.

Looking at the error message - it does seem to come from VM's server even though there's no MXIN error code.

452 4.1.1 <xxxxxxxxxxxx@ntlworld.com> requested action aborted: try again later; info=mbY1luof9A3xl;mx4.tb;202105281425;167.89.8.74

I've colour coded the relevant info:

SMTP Transaction ID
Individual VM server handling mail
Date and Time
Sending IP address

Looking at the IP - Forward and reverse DNS are correct, and it's not blacklisted on any of the major blacklists that MXtoolbx use.

@ModTeam 

I think this is going to need escalating to the team managing the inbound mail servers to determine what's going on here.

@Jimbob69 Do you have the sending domain?

Tim

[Jimbob69]

Thanks Tim

The sending domain is www.coolload.com. There was another block this morning - two almost (but not) identical emails which were generated within a minute of one another; the first got through to me, the second was blocked:

Processed

2021/05/31 9:45am UTC+00:00

We sent the email using the shared IP address 167.89.8.74. Learn more.

Ntlworld.comReceived by mx.tb.ukmail.iss.as9143.net

 Blocked

2021/05/31 9:45am UTC+00:00

The ntlworld.com server blocked this message from being delivered. While we won't try to send this message again, we will attempt to send new messages to this address in the future.

Full response from the ntlworld.com server:

452 4.1.1 <xxxxxxxxx@ntlworld.com> requested action aborted: try again later; info=neU9lPan1A3xl;mx4.tb;202105311145;167.89.8.74;

My (uneducated) sense is that the Virgin server is detecting 'suspicious activity' (similar emails generated within a short time period from a proxy server) and blocking them on an individual basis, but that it is (properly) not blocking all of them. I can see why it's doing this, but it's not spam - the emails contain information I'm paying for and, although the emails may appear identical to one another, they aren't.

Is this forum and the @ModTeam the only way I can get help from Virgin on this matter? It's quite frustrating.

I appreciate the help offered by you and @coenoby though.

[Steven_L]

Hey @Jimbob69,

I have picked this up now and have raised this with our IT team giving them all of the information that you have given us so far. I will be able to provide an update to you as soon as the team come back to me.

The response may not come until tomorrow due to the bank holiday today.

Regards,

Steven_L

[Jimbob69]

Thanks very much Steven

[Martin_N]

You're welcome Jimbob69.

^Martin