Email Security.cloud

 View Only
  • 1.  messagelabs servers denying traffic from a specific IP

    Posted Mar 11, 2015 11:49 AM

    Full disclosure: I have a client site that had their mailserver compromised and was attmpting to send send out massive amounts of spam. The mailserver was replaced (it was overdue), the site shows up on no major blacklists, and operations returned to normal. Except....

     

    When the client site tries to email someone using a message labs server, the connection is dropped. The is no rejection message or no communication of any kind, just dropped.

     

    To give an example: If I were to try and telnet to a messagelabs server on port 25 from my office, I get something akin to the following:

    telnet 216.82.249.179 25
    Trying 216.82.249.179...
    Connected to 216.82.249.179.
    Escape character is '^]'.
    220 server-4.tower-44.messagelabs.com ESMTP

     

    There is an exchange there. If I try to do the same from the client site, I get:

    telnet 216.82.249.179 25
    Trying 216.82.249.179...

    The connection just hangs as if there is nothing there responding before eventually timing out. I can ping that address and get a response, but nothing on port 25.

     

    To make things a bit more muddled, some email is going through fine. I know messagelabs has a lot of load balancing email servers on different IPs, so I have to wonder if the Client's IP is only being blocked on some of their servers.

     

    Any idea on how I would go about contacting messagelabs to have them look at this? Any thought on the problem would be appreciated.
     



  • 2.  RE: messagelabs servers denying traffic from a specific IP

    Posted Apr 08, 2015 03:13 PM

    Hello Kevin,

    It is possible the connections are being throttled if spam was detected by Symantec Cloud servers from that IP previously. The most efficient way to get this looked at would be to have your contact at one of the recipient using the Symantec Cloud filtering service contact their IT support to investigate. That will have them contact Symantec Cloud support to investigate the IP(s) in question.