Email Security.cloud

My client is unable to send any messages to any email address protected by messagelabs.

The error is, 

server-9.tower-96.messagelabs.com gave this error:
mail rejected because your IP is in the PBL. See http://www.spamhaus.org/pbl

​I have checked the WAN IP and it is not listed, I emailed SPAMHAUS and they confirmed this and said it was an issue with Message Labs and their copy is not up to date or their PBL usage is incorrect.

IP is 144.139.4.172 this is causing significant disruption to the business, please rectify asap.

Hi

I checked you IP and can see this is not listed in the PBL. I also checked our infrastructure and this is not picking up any listing on the PBL either any more.

It may be that the IP had been listed which our services were picking up but it seems the listing has now been removed so I do not see any reason for this to be blocked going forwards.

If you do still see this happening with new emails please let me know the details of the email such as sender and recipient so I can check it.

Thanks

Ian Tiller

Tier 2 Senior Technical Support Engineer

Hi Symantec, I am also getting this same error message when our organisation tries to email anyone using Messagelabs servers. Our IP is 210.10.242.220. The IP is not listed in Spamhaus PBL. This has been happing since 2nd of May and is becoming a serious problem.

I have the same error. server-11.tower-76.messagelabs.com #553-mail rejected because your IP is in the PBL. See 553 http://www.spamhaus.org/pbl ## checking the spamhaus pbl shows my IP is not listed

I'd like it rectified. We are trying to send invoices to customers and having them rejected. I will suggest that these customers of ours stop using your product as it clearly not in their interest. 

I sent an example email to Investigation@review.symantec.com and have had no response.

Our IP is 49.176.197.220 

Hi All,

I have checked all of your 3 individual IP's against the our systems and can confirm the following for all 3 IPs listed below:

They are not listed on any of our internal Blacklists or any other external blacklist.

The only thing that may have caused a problem was the confidence of all 3 Ip's was low accross our infrastructure. I have now reset the confidence of those IP's to high across all of our boxes.

I can now confirm that there is no reason for us to be blocking your connections at all.

Jmartin73 - Should this resolve the issue please set this thread as resolved to ensure others do not add to it, if not please provide further details to assist us,

Matt and Micro - Should you still have problems please open a new thread for yourself as if all your problems were for different reasons the thread become confusing and you all will get updates on each others problems.

Kind regards

Kevin Brosnan

Tier 2 Senior Technical support engineer

Same exact problem is occouring with me IP address 12.245.202.50.  I have confirmed with Spamhaus that our IP is not listed but getting bounce backs from cluster5.us.messagelabs.com  Example 

cluster5.us.messagelabs.com #<cluster5.us.messagelabs.com #5.0.0 smtp; 553-mail rejected because your IP is in the PBL. See 553 http://www.spamhaus.org/pbl> #SMTP#

Kevin,

I am having the same issue as the folks above.

host server1.inboundmx.com [216.82.242.115]: 553-mail rejected because your IP is in the PBL. See

    553 http://www.spamhaus.org/pbl

Our public IP address is 70.62.133.86 and is not listed anywhere on the PBL.

Double post, sorry

Hi All,

We have checked the last two IPs listed here (12.245.202.50 & 70.62.133.86) and neither are listed on any of the block list databases we use.

Again it appears any listing that we may have had has been removed. If any further occurence happens please let us know as soon as possible,

Kind regards

Dave Parker

Senior Principal Technical Support Engineer

Hi, 

I am also seeing this error from:

68.166.204.83
68.166.204.107

Both of which are not on the PBL list. The NDR happens when sending to my Network Solutions Exchange email account *@acsyscomputer.com

server-10.tower-131.messagelabs.com rejected your message to the following e-mail addresses:

Redacted (redacted@acsyscomputer.com)

server-10.tower-131.messagelabs.com gave this error:
mail rejected because your IP is in the PBL. See http://www.spamhaus.org/pbl 

A problem occurred during the delivery of this message to this e-mail address. Try sending this message again. If the problem continues, please contact your helpdesk.

Thank you, 

Chris

My customer was  also getting blocked saying they were on the pbl, but they are not. Their ip address is  216.12.49.21

Attached is the lookup from pbl. 

My customer is having a similiar issue when sending to their customer. The ndr states they were blocked becasue they were on the pbl blacklist. Did a check and found it wasn't. Their ip address is 216.12.49.21.

Attached is the lokup on the spamhaus lookup. This is causing issues since my customer is in the health care industry.

I spent three days with Symantec tech support on this issue to get it resolved. Luckily I had a customer who use messagelabs so I could open a support ticket under their customer's name - even though they were not the ones who could not send mail.

The tech did not say what they did to fix the issue but there were test emails sent, spamhaus lookups and examining of logs at their end. 

Good luck to all and hope Symantec fixes this issue.

adding a me too on 210.10.236.2

it was listed at one stage as being in a dynamic ip address range,

it hasn't been listed for at least a week, but probably months.

The bounces are intermittent, if we resend, it might take 4 goes, but eventually, they get delivered.

Do you guys have an out of date cache of the pbl on some servers or something?

Please add 101.167.172.238 to the list  with

    cluster5.us.messagelabs.com[216.82.241.195] said: 553-mail rejected because
    your IP is in the PBL. See 553 http://www.spamhaus.org/pbl (in reply to
    RCPT TO command)

The client can send the mail to me but not to any email that uses messagelabs

Thanks for tracing this  Chris

I find it really odd that Symantec tech support isn't more concerned that their system is not only providing false positives but also relaying incorrect error messages regarding these false positives. 

Thanks for your help though Kevin, we haven't received any more errors

My issue is resolved.

How do I resolve the thread?

Been at this and tchecking that the Domain is setup correctly. Check both Spamhaus and MXToolbox and no listing anywhere. 

Also contacted the NBN in Aus who set the static IP address

From: Mail Delivery System [mailto:MAILER-DAEMON@airgas.com.au]

Sent: Tuesday, 9 May 2017 2:51 PM

To: *****@airgas.com.au

Subject: Undelivered Mail Returned to Sender

This is the mail system at host smtp2.airgas.com.au.

I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to <postmaster>

If you do so, please include this problem report. You can delete your own text from the attached returned message.

                   The mail system

<@originenergy.com.au>: host

    cluster5.us.messagelabs.com[216.82.242.131] said: 553-mail rejected because

    your IP is in the PBL. See 553 http://www.spamhaus.org/pbl (in reply to

    RCPT TO command)

Static Ipaddress 101.167.172.238 This is a mail server and is starting to cause disruptions  Could you please Flush your cache and update your PBL

Thanks

Anyone that is continuing to experiace a problem with bounce backs stating that your IP is listed on the PBL but the Spamhaus Lookup tool says that your IP is not,

Can I point you to this post, which explains a problem that we have discovered in the Spamhaus lookup tool

https://www.symantec.com/connect/forums/spamhaus-issue-553-mail-rejected-because-your-ip-pbl-see-553-httpwwwspamhausorgpbl

Hi Jmartini73,

I believe you click on actions and select resoled. Please can you resolve this thread to stop others adding to it.

Kind regards

Kevin Brosnan

Tier 2 Senior Technical Support Engineer.

Hi Jmartini73,

Just following up on this and wondered if you require any further information.

If not please can you set this thread as resolved to prevent others adding to it.

Kind regards

Kevin Brosnan
Tier 2 Senior Technical Support Engineer
CompTIA Security+ Certified

Hi Kevin

We got in touch with the client who lodged a ticket with Symantec and as they only had one static ipaddress they had it removed from messagelabs

Thanks for the message and the issue hasbeen resolved from all other clients as well

Chris

Hi 

i am getting the same isuue .all my emails are rebounding back to me with this message.

my ip address is 27.32.172.195

my ip address is not listed in your pbl but still its blocking.

Hi Areefs,

Can I point you to this document

https://support.symantec.com/en_US/article.TECH82881.html

It contains all of the information you need to submit directly to our security team to have your issue investigated

Kind Regards

Richard Brittain
Tier2 Senior Technical Support Engineer,
Symantec Corporation