virginmedia SMC Policy Violation bounce error

[CWildeRE]

Hi,

We're an ESP sending emails on behalf of cleints who are receiving the following bounce error from virgin media domains (blueyonder, ntlworld, virginmedia) across multiple different domains and IPs:

SMTP service unavailable: "421 4.2.0 MXIN618 Temporary SMC Policy Violation detected, retry later ;id=KdKFlqEMxa7TsKdKFlL2Ap;sid=KdKFlqEMxa7Ts;mta=mx12.tb;dt=2021-03-12T09:39:16+01:00;ipsrc=xx.xx.xx.xx;" received from mx.tb.ukmail.iss.as9143.net (212.54.56.11) while connected from SENDINGDOMAIN.co.uk (xx.xx.xx.xx) to mx.tb.ukmail.iss.as9143.net (212.54.56.11)

 We have tried "sending later", as suggested in the error but no emails are being allowed through. Would someone please be able to help me with the cause of this error, and how we may resolve it moving forwards? I can't find any information on it online nor action I can take for it to be removed.

If there is elsewhere better to post this question, please let me know and I'll be happy to move it.

Many thanks,

Chris

[anightin]

Hi Tim,

Have PM'ed you the source of one of the messages -- they are pretty much all the same form. They are e-mails that have been sent to my domain e-mail.

Happy to accept that I'm barking up the wrong tree -- my plan is to bark up as many trees as I can in the hope that one of them will be the right one 🙂

Kind Regards

Andy

[ravenstar68]

This is the mail system at host unirelay11.hostedemail.com.

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to postmaster.

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

The mail system

<address@ntlworld.com>: host mx.tb.ukmail.iss.as9143.net[212.54.56.11]
said: 421 4.2.0 MXIN618 Temporary SMC Policy Violation detected, retry
later
;id=gsaBngRTJ5AFugsaCn0NcN;sid=gsaBngRTJ5AFu;mta=mx7.tb;dt=2022-04-19T20:28:13+02:00;ipsrc=64.99.140.10;
(in reply to end of DATA command)

I've copied the important bits from the message and obscured the email address

The IP address that's causing the issue is this one:

ipsrc=64.99.140.10

I've posted the address because it's not your personal IP address..

Rather it's the IP address of the forwarding email server used by your registrar.

@ModTeam 

This needs passing on to your email team in order to see if they can solve this issue on behalf of the user.

The important information is in the bounce message:

id=gsaBngRTJ5AFugsaCn0NcN - The id address of the email transaction on your mail exchangers.

dt=2022-04-19T20:28:13+02:00 - Date and time of email transaction

Those are really the only two pieces of information your email team needs.

As @anightin has pointed out asking them to change their password is NOT going to solve this issue.

Tim

[anightin]

Thankyou @Ravenstar68, very much appreciated 🙂

@ModTeam I have plenty of other examples, all with the same error and I'm getting about 10-15 of these a day into my inbox

e.g. All with the same ipsrc as identified by @Ravenstar68

;id=hYOQnVPX6hcbzhYORnhj0y;dt=2022-04-21T17:06:57+02:00;ipsrc=64.99.140.10;

;id=hWEJnixqiJpTWhWEKnlpZb;dt=2022-04-21T14:48:17+02:00;ipsrc=64.99.140.10;

;id=hRrznCqlFk7hkhRs0nbb9S;dt=2022-04-21T10:08:57+02:00;ipsrc=64.99.140.10;

.

.

.

etc

Kind Regards

Andy

[anightin]

Dear All,

I don't want to speak too soon but I noticed at midnight today that about 30-40 e-mails came in that I suspect were all previously being bounced.

I haven't seen any more bounces so far today so I assume someone in the VM technical team has made some tweaks? Thank you to whoever you are 😁

FYI I pinged a note back to UK2.net who provide my forwarding service and their response was:

"Our email team advises "421 4.2.0 MXIN618 Temporary SMC Policy Violation detected, retry later" indicates a temporary greylisting of our UK2 IP, likely because it's hit a few inbound spams traps with Virgin."

I'm flagging here in the hope that there might be some sandboxing put in place, such as pre-testing inbound VM spam traps or anything else that affects user experience prior to go-live changes.

I am hoping the above will be of benefit to other VM email customers who are experiencing similar issues.

Many thanks

Andy

[Jonn1801]

Hi Andy

It does seem that someone is on the right track now.

My issue (reported earlier in this thread) is almost exactly the same as yours. I have a personal domain that forwards email to my VM email inbox. When it gets bounced, the error message is sent to me (the domain admin) and these are the msgs get that get through - hence we see all the SMC errors in our Inboxes..

Thanks to Ravenstar, I looked back at all of my SMC bounced emails - they nearly all have the same email address for ipsrc: 64.99.140.10

  SMC Policy Violation detected, retry later.   ;id=hSTxnrcbi8ArqhSTynHbxe;sid=hSTxnrcbi8Arq;mta=mx2.tb;dt=2022-04-21T10:48:11+02:00;ipsrc=64.99.140.10;

However my ISP is Enom (part of Tucows in US). I wonder if UK2 uses the 'hosteremail.com' servers too.

I have done a Tracert (see below) and always get the 'hiccup' on legs 4 and 5. I don't know if that is relevant or not.

Same with Tracert to 64.99.140.28 , which is their forwarding server and is sometimes is the ipsrc server in the SMC error message.

Hopefully VM can take this address off the black list too.

many thanks

--Jon

C:\Users\jon>tracert 64.99.140.10

Tracing route to forward2.hostedemail.com [64.99.140.10]
over a maximum of 30 hops:

1 1 ms 1 ms 2 ms 192.168.0.1
2 11 ms 13 ms 12 ms 10.53.39.189
3 15 ms 10 ms 9 ms hari-core-2b-xe-11011-0.network.virginmedia.net [213.104.22.57]
4 * * * Request timed out.
5 * * * Request timed out.
6 13 ms 12 ms 13 ms m686-mp2.cvx1-b.lis.dial.ntli.net [62.254.42.174]
7 17 ms 24 ms 16 ms 213.46.174.118
8 14 ms 12 ms 19 ms ldn-bb1-link.ip.twelve99.net [62.115.122.188]
9 99 ms 99 ms 102 ms nyk-bb2-link.ip.twelve99.net [62.115.113.20]
10 114 ms 111 ms 114 ms toro-b2-link.ip.twelve99.net [62.115.123.109]
11 111 ms 114 ms 110 ms toro-b5-link.ip.twelve99.net [62.115.117.228]
12 119 ms 112 ms 110 ms tingfiberinc-svc082796-ic372724.ip.twelve99-cust.net [62.115.48.101]
13 115 ms 111 ms 110 ms xe-0-1-1.0.br02-toon03.tingfiber.net [64.98.10.134]
14 113 ms 95 ms 93 ms et-0-0-2.iar02.bra2.tucows.cloud [64.98.11.33]
15 111 ms 176 ms 268 ms csr-te2.9.4.bra.tucows.net [216.40.38.46]
16 110 ms 110 ms 117 ms sdl04a-l0.bra2.tucows.cloud [216.40.38.114]
17 114 ms 111 ms 122 ms forward2.hostedemail.com [64.99.140.10]

[anightin]

Hi Jon,

Indeed, I am not fully confident that the issue is resolved as yet because although my forwarded emails are now coming in, there seems to be quite a delay in them arriving. For example I sent a test e-mail to my VM address and it arrived in <1 min. I sent an e-mail to my domain name e-mail and it hasn't yet arrived after 2 hours.

It is almost as if someone is playing with the firewall/SPAM/greylist settings but not quite being sure what effect the changes are having and to who.

It would be nice to reduce the amount of abstraction between end-users like you and me and those making the tweaks so that we can both verify if we're happy with the result -- the feedback loop is a little too wide and loose ATM IMHO.

I think we agree that things are moving in the right direction though which is good.

Kind Regards

Andy

[anightin]

Quick update,

So the test message that I sent from work to my domain e-mail yesterday at 13:56 just arrived in my VM inbox at 11:03am, 21 hours and 7 minutes later!

No more bounce e-mails though!

Kind Regards

Andy

[anightin]

Aaaagh!

Just as I was thinking that I wasn't seeing any more bounces, they are back again today, and with the same IP as before:

host mx.tb.ukmail.iss.as9143.net[212.54.56.11]
said: 554 5.2.0 MXIN603 DMARC validation failed.
;id=jhXsnYtft5KUmjhXtnWLnl;sid=jhXsnYtft5KUm;mta=mx9.tb;dt=2022-04-27T15:17:31+02:00;ipsrc=64.99.140.10;
(in reply to end of DATA command)

Help!

[anightin]

Noted that this error is not SMC Policy Violation, but another spam related issue.

[ravenstar68]

I'd have to look at the attached email but DMARC validation failures can be caused by mail forwarding when the original sender only uses SPF as an authentication mechanism, or where the mail gets modified in transit, thus invalidating DKIM

One of the reasons I recommend against mail forwarding services if you own your own domain.  Better to have the mail delivered directly to your own servers.