Re: [mailop] How should we respond in this situation

2024-08-23 Thread Bill Cole via mailop
On 2024-08-22 at 16:12:26 UTC-0400 (Fri, 23 Aug 2024 04:12:26 +0800) horizon--- via mailop is rumored to have said: As a postmaster, I often receive assistance investigation emails from official organizations in certain countries (which I have not confirmed) such as intelligence agencies and c

Re: [mailop] Strange behavior of the Microsoft Blacklist

2024-08-23 Thread Carter, Jason (Infrastructure) via mailop
Are you sending to M365/Exchange Online tenants, or Hotmail/Outlook.com accounts? if it's consumer facing use https://olcsupport.office.com/ to put in a ticket. If it's EXO tenants, you may need the assistance of one or your partners who host their mail there to put in an internal ticket withi

Re: [mailop] How should we respond in this situation

2024-08-23 Thread Bill Cole via mailop
On 2024-08-22 at 17:53:07 UTC-0400 (Fri, 23 Aug 2024 05:53:07 +0800) horizon--- via mailop is rumored to have said: If the other party provides evidence, such as our users suspected of participating in terrorist attacks, is it necessary to directly provide relevant information out of humanitar

Re: [mailop] Strange behavior of the Microsoft Blacklist

2024-08-23 Thread Juha-Matti Tapio via mailop
Tobias Grychtol-Matthaeus via mailop kirjoitti 22.8.2024 22:46: The Microsoft demicery team wrote me round about 36 hours before now, that they mitigated the IP address and that it should work now. It still does not work. I send all bounce emails to del...@microsoft.com like it was written in t

Re: [mailop] Strange behavior of the Microsoft Blacklist

2024-08-23 Thread Xavier Beaudouin via mailop
Hello, > Same situation here, Microsoft suddenly blocking our main server for all > M365 domains with the same 5.7.511 error code. No indications on what > could have possibly triggered the issue. All DMARC reports are clean, no > marketing emails, no known hacked accounts, no clear suspects. The

[mailop] DMARC p=reject Interaction with security gateways

2024-08-23 Thread Alex Shakhov via mailop
Hello - We are currently managing several domains that are experiencing spoofing attacks, which led us to implement a p=reject policy. We monitor these domains through Uriports, and while all DKIM/SPF validations pass, exceptions arise with emails routed through security providers such as Cloudflar

Re: [mailop] DMARC p=reject Interaction with security gateways

2024-08-23 Thread Faisal Misle via mailop
Yes, you can disregard those. Most customers of security gateways exempt the gateway IPs from further checking on the final mailbox. I don't think any of those gateways use ARC yet, but if they did, that would also help (in case they didn't whitelist their gateway IPs). Here's a good explaine

Re: [mailop] DMARC p=reject Interaction with security gateways

2024-08-23 Thread John Levine via mailop
It appears that Alex Shakhov via mailop said: >-=-=-=-=-=- >-=-=-=-=-=- > >Hello - We are currently managing several domains that are experiencing >spoofing attacks, which led us to implement a p=reject policy. We monitor >these domains through Uriports, and while all DKIM/SPF validations pass, >e

Re: [mailop] [EXTERNAL] DMARC p=reject Interaction with security gateways

2024-08-23 Thread Michael Wise via mailop
If the traffic passes thru a filtering gateway in front of the recipient server, SPF will fail. Also, if that gateway modified the Subject, From, or prepends a message about it being, “External” in the body of the message, then DKIM will fail. And in either of the above, DMARC will almost certai

Re: [mailop] DMARC p=reject Interaction with security gateways

2024-08-23 Thread Dave Crocker via mailop
On 8/23/2024 1:34 PM, Alex Shakhov via mailop wrote: We are currently managing several domains that are experiencing spoofing attacks, which led us to implement a p=reject policy. In terms of the mechanical details, what exactly is the attack and how is it affecting your email service? We

Re: [mailop] [EXTERNAL] DMARC p=reject Interaction with security gateways

2024-08-23 Thread Alex Shakhov via mailop
Michael - Thank you for sharing this! Inky, for example, includes an external notification in the email body. However, we have never received a rejection notification for emails that failed DMARC. We suspect that some emails sent to M365 users registered through GoDaddy with Proofpoint add-on are s