Email Security.cloud

 View Only
  • 1.  553-Message filtered

    Posted Jan 14, 2017 09:04 AM

    Good morning.

    Starting early January 2017, users in my domain (nevosi.com) have been having extensive trouble both emailing to and receiving email from Symantec Email Security.cloud customers -- primarily cbts.net and cinbell.com domains.  This does not affect all emails, but rather only certain emails such as emails with attachments, replies to emails received from cbts.net/cinbell.com users, and meeting requests.  Failures are met with an 553 rejection (after the message content has been transmitted) similar to the following:
    Remote Server returned '<cluster6.us.messagelabs.com #5.0.0 smtp; 553-Message filtered. Refer to the Troubleshooting page at 553-http://www.symanteccloud.com/troubleshooting for more 553 information. (#5.7.1)>'

    This issue started after an issue with the provider who hosts our reverse DNS resulted in no reverse resolution for our network. This reverse DNS issue was rectified a few days, however we continue to have issues sending to/receiving from Symantec Email Security.cloud customers.

    Our MTA is nv-dc2-mail1.nevosi.com/198.187.23.231

    As I stated above, reverse DNS is back in place for this MTAs:
    nv-dc2-mail1.nevosi.com. 523    IN      A       198.187.23.231
    231.23.187.198.in-addr.arpa is an alias for 231.192-26.23.187.198.in-addr.arpa.
    231.192-26.23.187.198.in-addr.arpa domain name pointer nv-dc2-mail1.nevosi.com.

    This MTA's IP addresses is covered by an SPF record that covers nevosi.com which has been in place since 2010:
    nevosi.com.             599     IN      TXT     "v=spf1 mx ip4:198.187.23.192/26 ip4:10.245.0.0/24 ~all"

    I have verified that SPF and DKIM both validate by emailing a Gmail account and clicking "Show Original" for the message which reports the following:
    SPF:    PASS with IP 198.187.23.231
    DKIM:    PASS with domain nevosi.com 

    The Symantec Email Security.cloud IP Reputation Investigation tool (http://ipremoval.sms.symantec.com/lookup/) reports the following:
    "The IP address you submitted, 198.187.23.231, does not have a negative reputation and therefore cannot be submitted for investigation.", and

    I even resorted to spinning up another MTA and attempting to relay messages through it, but those messages are rejected as well, so I have reverted that change and am back to using nv-dc2-mail1.nevosi.com/198.187.23.231.

    Can anyone with Symantec please assist?  I have exhausted all possible avenues as a non-customer; I simply want to be able to send emails to and receive emails from your customers.  I would be most appreciative of any assistance.

    Thank you in advance,
    -jd



  • 2.  RE: 553-Message filtered

    Broadcom Employee
    Posted Jan 16, 2017 08:51 AM

    Hello

    A 553 Message Filtered error means that your mail has been flagged by our Anti-Spam service. In order to investigate this issue please can I ask you to follow the steps outlined in the link below.

     

    https://support.symantec.com/en_US/article.TECH233678.html

     

    Once the mail has been submitted in the correct format please direct message me to let me know from what address and at what date and time this was submitted and I will take a look at it for you.

     

    Thank you



  • 3.  RE: 553-Message filtered

    Broadcom Employee
    Posted Jan 18, 2017 10:20 AM

    Hi Jason

     

    The detection that has been causing these false positives has now been removed.

    As such from about 13:15 UTC today you should not be seeing an issue with this any further.

    However if you have further examples this afternoon/tomorrow please let me know and I can get these looked into as well.

     

    Thank you

     

    Ian Tiller

    Tier 2 Senior Technical Support Engineer