My fight against Microsoft Outlook hotmail etc email blocking

[stephen_usher]

[exxos]

Day 4 ... Email still getting through... That's two more days longer than all the other times I was unbanned

Oddly I seem to get abuse reports from wp.pl I don't even know what that site is. I certainly have never emailed it.

If anyone can make any sense of the report then let me know...

Code: Select all

<feedback>
<report_metadata>
<date_range>
<begin>1714600800</begin>
<end>1714687200</end>
</date_range>
<org_name>wp.pl</org_name>
<email>dmarc-support@wp.pl</email>
<extra_contact_info>dmarc-reports@wp.pl</extra_contact_info>
<report_id>1714695505.815565118</report_id>
</report_metadata>
<policy_published>
<domain>exxosforum.co.uk</domain>
<adkim>r</adkim>
<aspf>r</aspf>
<p>none</p>
<sp>none</sp>
<pct>100</pct>
</policy_published>
<record>
<row>
<source_ip>185.52.2.172</source_ip>
<count>3</count>
<policy_evaluated>
<disposition>none</disposition>
<dkim>pass</dkim>
<spf>pass</spf>
</policy_evaluated>
</row>
<identifiers>
<header_from>exxosforum.co.uk</header_from>
</identifiers>
<auth_results>
<spf>
<domain>exxosforum.co.uk</domain>
<result>pass</result>
</spf>
<dkim>
<domain>exxosforum.co.uk</domain>
<result>pass</result>
</dkim>
</auth_results>
</record>
</feedback>

Got one from outlook as well..

Code: Select all

<?xml version="1.0"?>
<feedback xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <version>1.0</version>
  <report_metadata>
    <org_name>Outlook.com</org_name>
    <email>dmarcreport@microsoft.com</email>
    <report_id>e6e9da35006a45f6a682e9a3b7b28ebf</report_id>
    <date_range>
      <begin>1714435200</begin>
      <end>1714521600</end>
    </date_range>
  </report_metadata>
  <policy_published>
    <domain>exxoshost.co.uk</domain>
    <adkim>r</adkim>
    <aspf>r</aspf>
    <p>none</p>
    <sp>none</sp>
    <pct>100</pct>
    <fo>0</fo>
  </policy_published>
  <record>
    <row>
      <source_ip>185.52.2.172</source_ip>
      <count>1</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>fail</dkim>
        <spf>pass</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <envelope_to>hotmail.com</envelope_to>
      <envelope_from>exxoshost.co.uk</envelope_from>
      <header_from>exxoshost.co.uk</header_from>
    </identifiers>
    <auth_results>
      <spf>
        <domain>exxoshost.co.uk</domain>
        <scope>mfrom</scope>
        <result>pass</result>
      </spf>
    </auth_results>
  </record>
</feedback>

<dkim>fail</dkim>

Though I wonder if that's because its exxoshost not exxosforum

[Cyprian]

Day 4 ... Email still getting through... That's two more days longer than all the other times I was unband

good news

Oddly I seem to get abuse reports from wp.pl I don't even know what that site is. I certainly have never emailed it.

WP.pl is (or was) the largest Polish equivalent of Yahoo - news, email accounts, web accounts etc.

[derkom]

Oddly I seem to get abuse reports from wp.pl I don't even know what that site is. I certainly have never emailed it.

Your DMARC record includes "rua=mailto:abuse@[redacted];", which is requesting that other mail systems send you aggregate reports of mail from you that they have processed. Most email systems don't do that, but some do. On my own personal, low-volume server, I receive reports from Gmail and Outlook fairly often, and rarely some other system I happen to have sent a mail to on a given day.

While you may not have sent any mail to a @wp.pl address, your server probably did send something to some domain whose mail is processed by wp.pl.

You can generally just ignore these reports. On my server, my DMARC requests they be sent to reports@, which makes it easy for me just to /dev/null that address during times I'm not interested.

I imagine that on high volume servers these reports could be pretty useful for analysing aggregate acceptance data, but in my case they are typically reporting an "aggregate" of one email.

[exxos]

@derkom OK thanks, but why <dkim>fail</dkim> in the log is that their failure or mine

Day 6 still not banned

[rubber_jonnie]

@derkom OK thanks, but why <dkim>fail</dkim> in the log is that their failure or mine

Day 6 still not banned

But my mysterious spam continues...

[derkom]

@derkom OK thanks, but why <dkim>fail</dkim> in the log is that their failure or mine

I don't actually know. I would suspect your guess is right.

[stephen_usher]

@derkom OK thanks, but why <dkim>fail</dkim> in the log is that their failure or mine

Day 6 still not banned

Oh, they're saying that your DKIM record failed for some reason.

Using nslookup it seems that the IP address reverse look-up is exxosforum rather than exxoshost and hence the names don't match. The IP address reverse look-up for exxoshost should be primary.

You can check this yourself. Run nslookup and type in exxoshost.co.uk then copy and paste the IP address in the A record back into nslookup and you get exxosforum.co.uk.

You should really have exxosthost as the A record and exxosforum as a CNAME.

[exxos]

Problem is, exxosforum is actually the master domain these days. exxoshost is only there to not break links more than anything.

[stephen_usher]

For mail exchange the A record has to be primary unfortunately. The MX record has to point to it and reverse look-up should return that domainname. It's a right pain. This is why my home system's primary DNS name is mail.lingula.org.uk and everything else is a CNAME pointing to that.