4
Microsoft... again... a never-ending story
Question asked by Sabatino - 12/28/2023 at 8:49 AM
Unanswered
Hi guys. An advice. One of my mailservers has been banned by MS and I can't send to their domains (e.g. live.com, outlook.com)
Unfortunately, every now and then it happens for no obvious reason and I have now resigned myself to it.
104.47.14.33 [00007F4EAEBFA700] 09:55:00 Client session <<< 550 5.7.1 Unfortunately, messages from [xx.xxx.xxx.xxx] weren't sent. Please contact your Internet service provider since part of their network is on our block list (S3150). You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors. [VI1EUR04FT040.eop-eur04.prod.protection.outlook.com 2023-12-28T09:55:00.771Z 08DBED649612F650]

As always I check the reputation of the IP and it is good, I check their site https://sendersupport.olc.protection.outlook.com/snds/ and there are no problems.
senderscore, Talos, Cyren report no problems on the IP
and is not present in any black list

Fortunately it is a mail server that has routing rules so I redirected the error traffic to an SM server and at least I have no problems with the clients. (but that's another story)

I filled out the usual form

The first automatic response arrives and I reply to the ticket as usual providing the details. Typically after providing the details the IP is removed from their lists without them providing explanations.
This time they don't reply to me, despite repeated requests to the same ticket, and they don't remove it.

This thing has been going on since December 7th. You had problems. Do you know if there is another way to report the problem.
Sabatino Traini
      Chief Information Officer
Genial s.r.l. 
Martinsicuro - Italy

12 Replies

Reply to Thread
0
Kyle Kerst Replied
Employee Post
More often than not Microsoft will unblock you without giving a reason as to why. They seem to follow a blacklist until proven innocent policy and always have. One of the benefits of heavy market share! 

The best suggestion I can give on this one is to monitor how many emails you have leaving your server destined for Microsoft MX's on a daily basis as they're probably blocking you temporarily based on volume. Do you have a lot of users who forward to their outlook.com/live.com/etc email accounts by chance?
Kyle Kerst IT Coordinator SmarterTools Inc. www.smartertools.com
2
Sabatino Replied
No, Kyle. The volume is really low. this is my secondary server.
Among other things, since December 7, 2023 the messages sent to Microsoft have failed and are therefore rerouted to my SM server which instead has a volume 10 times higher towards Microsoft and I have no problem.

it has already happened in the past, sometimes even to my sms server, but it was enough to open the report, wait for the first automatic message, reply with the details and within 24 hours it was removed.
This time, however, the story continues from 7 December 2023.
As long as the server is the secondary one I'm not worried. But this ignorance on Microsoft's part scares me. If this were to happen to my SM server it would be a disaster. I have heard that it is happening to others, that is, after filling out the form, waiting for the first response, replying with the details, there is absolute silence from MS and without removal.
Sabatino Traini Chief Information Officer Genial s.r.l. Martinsicuro - Italy
0
Kyle Kerst Replied
Employee Post
It definitely sounds like they aren't making it easy for third-party administrators to get to the bottom of this stuff. Another thing we've seen (albeit with Gmail) is that occasionally they'll implement new requirements/standards on some of their servers as a test, so maybe something similar is happening here and they keep quiet about it for that reason.
Kyle Kerst IT Coordinator SmarterTools Inc. www.smartertools.com
0
Douglas Foster Replied
Do you have clients who are forwarding to Microsoft?   If so, do you do SRS encoding (which I recommend)?   I am wondering if forwards are triggering your problem?
0
Sabatino Replied
I don't think SRS is the problem.
However it is enabled, but it is a small server and I have verified that there are no forwards to Microsoft domains.
Furthermore, for 1 month now the message that fails to send directly is diverted to my SM gateway which delivers it without adding anything to it (obviously my SM server is SPF authorized). so a problem on the SRS header of the message would have propagated to my SM server
Sabatino Traini Chief Information Officer Genial s.r.l. Martinsicuro - Italy
1
Bruce Replied
We had this with a customers dedicated server on the 11th of December. We completed the IP deleting form three times and spent two weeks emailing Microsoft with some odd replies or complete silence.

I think Microsoft support was overwhelmed on the run-up to Christmas as I filled in the IP delisting form again Christmas Eve and this time got the usual canned reply there was no issue, which I replied to and got back the  IP mitigation email from them a few hours later.

Try their IP delisting form again now, hopefully, you will have more luck this time;
https://support.microsoft.com/en-us/supportrequestform/8ad563e3-288e-2a61-8122-3ba03d6b8d75

We encounter this problem every few weeks with customer's mail servers, regardless of whether it's SmarterMail, HMailServer, or MailEnable they block the mail server IP address with the same "network is on our block list (S3150)" message. It happens even with low email volume of just 10 emails a day and mail servers that don't forward any emails. 

It seems to be that if Microsoft sees a new IP address sending email they block it until you contact them and they add mitigation to the IP address.
1
Sabatino Replied
they unlocked the IP today
Without any explanation.

Who understands them....

they didn't even bother to send the message: we mitigated the IP
Sabatino Traini Chief Information Officer Genial s.r.l. Martinsicuro - Italy
0
David Jamell Replied
I've had the exact experience as Sabatino.  I get "(S3150)" failure and after checking the IP Address on SDNS and other 3rd party tests, I fill out the MS Support From and go thorough the same marry-go-round. Early December 2023 they went silent on 4 different requests.
0
Douglas Foster Replied
Does presence or absence of DKIM signing and DMARC policy make any difference?

Assuming No, my suspicion is that another domain on your ASN range was misbehaving, so they responded with overkill, using a block that included your addresses.
2
Sabatino Replied
dkim dmark spf are present and correct in all my domains.
Unfortunately for Microsoft we are presumed guilty until proven innocent.
So far it was enough to open the ticket and reply to the automatic message with the details and within a few hours everything was resolved.
In December 2023 something went wrong.
I have had confirmation of this from many colleagues.
For about 3 weeks MS did not handle the messages sent in response to the automatic message leaving us on the block lists

it is an abuse of authority
Sabatino Traini Chief Information Officer Genial s.r.l. Martinsicuro - Italy
0
Brian A. Replied
It seems to me that they do this to LOW VOLUME IP addresses... 
0
David Jamell Replied
I got a reply back, with "mitigation", for a ticket I opened today.  Perhaps they just took the month of December off.

Reply to Thread