Email Security.cloud

Several of our customers and suppliers use messagelabs and are unable to send or receive email from /to our domain (thesolution.co.uk) consitstently.

They are receiving the generic 553 message. Our SPF and DKIM records are intact, and mail is coming from legitimate accounts and IP Addresses.

We have tested what messages can get through and it appears to be linked to the e-mail address being part of the standard signature.

Once we removed the e-mail address from the signature we appear to be able to send, but the customer then receives the error when attempting to reply.

This seems to be a problem with the content triggering the filtering.

We have checked that we are not listed on any blacklists either ip based or domain based.

Replies to the customer with their e-mail signatures contained their e-mal address also fails with erro 553.

Can you please explain how we can identify the problem.

Hi

Can I as you to follow the process laid out here and submit some examples of the mails that you are having issues with to our investigation.review@symantec.com submission address.

The relavant teams can then investiagte and amend or remove any detection thats causing false positives as necessary.

Thank you

Ian Tiller

Tier 2 Senior Technical Support Engineer

Thanks for that.

but the e-mail address bounces with ...

server-14.tower-55.messagelabs.com rejected your message to the following e-mail addresses:
investigation.review@symantec.com (investigation.review@symantec.com)
server-14.tower-55.messagelabs.com gave this error:
Invalid recipient <investigation.review@symantec.com> (#5.1.1)
A problem occurred during the delivery of this message to this e-mail address. Try sending this message again. If the problem continues, please contact your helpdesk.

Diagnostic information for administrators:
Generating server: SBS11-COGNITIVE.cognitive.local
investigation.review@symantec.com
server-14.tower-55.messagelabs.com #550-Invalid recipient <investigation.review@symantec.com> 550 (#5.1.1) ##
Original message headers:
Received: from SBS11-COGNITIVE.cognitive.local ([fe80::1690:f1f:e975:f5b2]) by
 SBS11-COGNITIVE.cognitive.local ([fe80::1690:f1f:e975:f5b2%10]) with mapi id
 14.01.0438.000; Fri, 16 Jun 2017 16:29:05 +0100
From: Marc Stinton <Marc.Stinton@thesolution.co.uk>
To: "investigation.review@symantec.com" <investigation.review@symantec.com>
Subject: False positives
Thread-Topic: False positives
Thread-Index: AdLmtB0GQuKvJFW+R/G3SefEtLrkVQ==
Date: Fri, 16 Jun 2017 15:29:04 +0000
Message-ID: <1C804F46C6B8204EA18F6FE144010BA324CE4B@SBS11-COGNITIVE.cognitive.local>
Accept-Language: en-GB, en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
x-originating-ip: [172.17.20.17]
Content-Type: multipart/mixed;
 boundary="_008_1C804F46C6B8204EA18F6FE144010BA324CE4BSBS11COGNITIVEcog_"
MIME-Version: 1.0

It appears that then address for the investigations team is actually..

 Investigation@review.symantec.com

I have also updated our SPF records as well.

Hi,

Just following up on this and wondered if this has now been resolved. Please do let us know if you require further assistance or if all now ok, please can you mark this thread as resolved to prevent others adding to it.

Kind regards

Kevin Brosnan
Tier 2 Senior Technical Support Engineer

CompTIA Security+ Certified

Hi Mstinton,

Just following up on this topic and wondered if you need any further assistance on this matter.

If the issue has since been resolved. Please can you set this thread as resolved to prevent others adding to it.

Kind regards

Kevin Brosnan
Tier 2 Senior Technical Support Engineer

CompTIA Security+ Certified

Hi Mstinton,

Just following up on this topic and wondered if you need any further assistance on this matter.

If the issue has since been resolved. Please can you set this thread as resolved to prevent others adding to it.

Kind regards

Kevin Brosnan
Tier 2 Senior Technical Support Engineer

CompTIA Security+ Certified