Help sought for email problem

[Not sure if this is the most appropriate board, but here goes]

An elderly friend has emailed me about a problem she has with getting emails to one particular friend. Her email said

Emails to particular address delayed
Recently I have sent a number of email to one person � he asked me send so he could see if emails to his address were being blocked. When I tried to follow-up the reason I met requests for two bits of information and I have no idea what the requested information is.
What is my / my internet providers Domain Name?
What is IP/C1 Range of outgoing services

To which I replied

Your internet provider is of course Eclipse, and they use �eclipse.co.uk� as their domain name (the last part of your email address). IP/C1 � I wonder if it�s actually TCP/IP ? Though what that�s got to do with it is very odd, and anyway there are a number of them and the one you�ll get changes from time to time. Must admit I wonder if that person is on ntlworld.com or virginmedia.xxx or some other virgin media email address. I�ve had lots of problems getting emails to people on their systems and have had to bang a few heads together between my email service provider (not Eclipse) and Virgin; seems ok� at the moment. Who actually requested the information?

Her response was

Delayed (blocked) email: I had a go at filling in the information requested by the provider but it wanted things I did not understand so got no-where. It was something called Cox communications that sent stuff to me. The email address to which I was trying to send ends cox.net. Also the sender of the message telling me my message delayed seemed to be MAILER � [email protected]

SO I just gave-up, phoned my friend and told him his emails from me not getting through.

My response was

[email protected] is actually an Eclipse mail server, rather than anything untoward. Cox Communications is a USA based company, I can see no reason for them to be wanting such specialised information, I don�t recollect ever having come across that. The only thing I can think of is that they operate on a �block all emails unless explicitly permitted in advance� policy. Even then as far as I�m aware they would only want the email address of emails that were to be permitted. I must admit to being a bit bemused on this one.

I've given all the correspondence rather than trying to hide anything I may have got wrong. I'm genuinely puzzled on this one, and wonder (perhaps being overly paranoic) whether there's a scam lurking somewhere.

Any thoughts?

Sounds like cox.net are delaying emails sent to them. Perhaps the owner of the cox.net mailbox can ask cox.net for clarification as to why they are delaying their mails.

Edited by Oliver341 (Wed 08-Apr-15 11:54:38)

I have come across instances where sent emails are being blocked by the system somewhere (?) because the sender's IP is on some list, with the error msg:

host hotmail.co.uk[65.55.37.72] said: 550

SC-001 (COL004-MC1F41) Unfortunately, messages from 193.252.xx.yyy weren't sent. Please contact your Internet service provider since part of their network is on our block list. You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors.

I believe the block list is held by Spamhaus. Another instance came across this:

This IP address range has been identified by Spamhaus as not meeting our policy for IP addresses permitted to deliver unauthenticated 'direct-to-mx' email to PBL users

My usual suggestion to get over this is to reboot the router in the hope of getting a diff IP.

In reply to a post by XRaySpeX:

Another instance came across this:

This IP address range has been identified by Spamhaus as not meeting our policy for IP addresses permitted to deliver unauthenticated 'direct-to-mx' email to PBL users

My usual suggestion to get over this is to reboot the router in the hope of getting a diff IP.

The Spamhaus PBL is the list of customer IP ranges declared as dynamic IP addresses by ISPs and declared unfit to send email direct to MX servers (mail should be sent via an external SMTP server instead, not directly). This typically happens when someone decides to set up an SMTP server on their LAN with a dynamic WAN IP address and is unaware of the spam filtering implications.

I've now got the NDR email.

-----Original Message-----
From: Mail Delivery System [mailto:[email protected]]
Sent: Friday, 10 April, 2015 21:56
To: xxxx <at> yyyy.eclipse.co.uk
Subject: Delivery Status Notification (Failure)

The following message to <[email protected]> was undeliverable.
The reason for the problem:
5.4.7 - Delivery expired (message too old) 554-'fed1rmimpi312 cox
212.50.160.34 blocked. Error Code: CXBL - Refer to Error Codes section at http://postmaster.cox.net/confluence/display/postmas... for more information.'

and error code CXBL is

The sending IP address has been blocked by Cox due to exhibiting spam-like behavior

So cox.net are blocking emails from eclipse for apparently spam-like behaviour.

The linked-to form at cox.net postmaster certainly does ask for technical stuff which it says should be completed by an email administrator or other technical contact.

Clearly it needs a ticket raising with Eclipse to get it progressed. As I'm also with Eclipse I'll either get it raised via my account on my friend's behalf (preferred) or get her to raise it directly.

Looks like you had a similar problem with IP in 2011.
Google IP No

If emails are being blocked by a mail server then your mail provider needs to SPF (Sender Policy Framework) sign your emails.

We had the same sort of issues with GMail, Yahoo, Hotmal and a few others, this was due to I run an online game site that sends out emails and they thought they were spam etc and got blacklisted, as soon as we added SPF signing of emails it was all fine again and haven't had any issues since.

So that's also worth looking into.

Paul

In reply to a post by PaulKirby:

If emails are being blocked by a mail server then your mail provider needs to SPF (Sender Policy Framework) sign your emails.

SPF doesn't sign anything it's just a TXT DNS entry specifying which mail servers are authorised to send email for the domain.

You might be thinking about DKIM?

In reply to a post by Oliver341:

In reply to a post by PaulKirby:

If emails are being blocked by a mail server then your mail provider needs to SPF (Sender Policy Framework) sign your emails.

SPF doesn't sign anything it's just a TXT DNS entry specifying which mail servers are authorised to send email for the domain.

You might be thinking about DKIM?

I wasn't thinking of DKIM (used to use that and still got blacklisted), but yeah I know you have add multiple TXT DNS Records for each of the mail domains the mail server handles and also a record for the mail server itself.

Also SPF is much more easier to setup than DKIM
Well for outgoing emails that is.

Note to self: Be more clear
And stop saying it signs emails

Paul

In reply to a post by PaulKirby:

Also SPF is much more easier to setup than DKIM

Yep, I use SPF too, on the "strongest" fail flag, -all. It works well for one or a few users on the domain who are clued up.

But of course problems ensue if there are multiple users, and one or some of them choose to set up SMTP via a third party server, for whatever reason, because their email will then almost certainly be treated as spam by the receiving server. In that instance, ~all is a safer option.