Xtra mail blocking authenticated email addresses from sending via SMTP server?

Forums › Spark New Zealand (including Skinny and BigPipe) › Xtra mail blocking authenticated email addresses from sending via SMTP server?

1 | 2 | 3 | 4 | 5 | 6 | 7

1421 posts

Uber Geek
+1 received by user: 314
Inactive user

#1726127 25-Feb-2017 15:41

hio77:

nunz:

The problem with that is when you get a mobile phone, and a laptop and desktop at home, then it has traditionally been an issue as the ISPs themselves have failed to let authenticated mail be sent if you aren't on their domain as isp. ISPs are reaping what they have sown. If they actually had let authenticated mail be sent through their servers, even if your device was connected to another isp at the time then half the messed up work arounds we used over the last 10 years would have been null and void.

Any authenticated mail cases are null in void when the recommended settings are used. There is no reason in this day in time that you should use a relay service, That is going to cause issues soon as you visit a friends, Change providers etc.

Using SSL configurations allows you to skip all the hassle and have your security, No work around just looking forward to where things should be at these days..

nunz:

Xtra were quicker off the mark with authenticated SMTP than most but then botched that with port 25 blocking and a raft of other idiot processes banning emails until you filled out impossible to find forms they then ignored.

Spark make port 25 unblocks easily found..

Spark.co.nz/port25

Search will also bring this up straight away, I can't speak for other ISP's

nunz:

Vodafone / Clear / Paradise - probably the very worst. Still no authenticated smtp for clear last time I checked and I think paradise ditto. Trying to use vodafone authenticated smtp was a failure in the making if you were a clear or paradise client so thus loose spf records allowing you to send from other ISPs / anywhere becuase at the end of the day you arent allowed to put in enough isp names and ip addresses in an spf to cover all of NZs offerings.

I still wince at the number of mail servers we had on telecom / xtra networks where the client connected to them as the single point of authenticated mail sending, using anything other than port 25 / 26 and the support issues that raised. Then having to smart mail them through xtras smtp or send.xtra.co.nz as the sillybuggers blocked sending ports on their networks.

Filtering port 25 by default is normal these days, i dont exactly understand why you look at this as playing silly buggers.

Vodafones support for email service is absolutely the bane of my existence at this time, 95% of the cases i deal with on this issue, Are Vodafone based services.

Vodafone do have an option for their paradise servers to add /p to the front of your username to be able to authenticate externally But this is not sparks job to setup Vodafone customers emails correctly.

Vodafone unfortunately do a horrible job at supporting customers through this process aswell, the lack of SSL support on many of their platforms and janky workarounds such as /p adds to the frustration.

Vodafone will not take ownership of this for customers and pass the blame, when technically it is Their product that is not working correctly.

nunz:

Again - the ISPs are their own worst enemies.

I always said I would never run commercial mail servers but now have three as it is still less painful to take that responsibility than deal with the crap using ISPs email has caused. Uptimes all reflect we only reboot once a year on some of the servers to get windows processes to pick up the renewed certificates. Happy clients. Happy IT guy.

I'm glad you keep your clients off ISP provided services, Business's should be on Business grade email address's.

The amount of business's that i deal with who have xtra email address's is astonishing.

I will say at this point, the issues with Authenticated email address's do seem resolved, There is a few edge cases however spark have a special back-end team who is going through double checking these cases and returning to be followed up.

The one case where this still will not work, Is clients that are unsupported by sparks network - EG Outlook Express does not support the SSL requirements.

Re port 25 blocking. Over the years we have had a number of clients who ran their own exchange server and their ISP was Spark / Xtra. Exchange gives calendar, push notifications etc. Unfortunately when the exchange server goes to send to another mail server the port 25 blocking rules would stop it being able to send out.

Yes, you can apply for that to be removed on your static IP address but the forms are arcane, most of the questions make no sense as they didn't apply, the response was slow and the chances of them getting it right were very hit and miss. Then they would reverse the policy. if I charged for all the time spent on phone to xtra on mail issues me and Bill Gates would be dining out in the same clubs.

The answer was often have your exchange server upload mail to sparks smtp server as a smart relay - with other attendant issues like getting blocked as xtra were black listed. The other issues faced included getting dropped as spam as even static ip address ranges were registered by telecom / xtra / spark with black lists as not allowed to host mail servers - so by sending direct from your static IP address you got blocked via black lists. We did also use thirdparty mail box as collection point then pulled it down to the exchange server - but then splitting out mail at that point had its hiccups requiring third party add ins or mail pull servcies to munge te addres into the right boxes. Exchange etc was never good at pulling from a global pop collection box.

Again - my comment was on the historical mess that has left us in the situation we face today and forced so many hacks and work arounds to deal with stuff.

Our clients mostly use mail servers hosted by NON ISPs that specialize in mail services ( digiweb were a good go to for many years - great support until they got bought out) or mail servers we run on VDS / VPS on their behalf. however, it is only in recent years that the cost of data and VPS and cloud services have got to the point that not having to hack your way through the ISP induced mess was financially reasonable.

nunz

1421 posts

Uber Geek
+1 received by user: 314
Inactive user

#1726129 25-Feb-2017 15:47

richms: Why is the ISP the logical place to do it?

They don't provide IRC, discord, WhatsApp or any other servers so not sure why they are logical just for email?

Because they used to block port 25 and make life a real heart ache for those not using them as their mail service. Now the ISPs all want out of mail hosting but its them that forced us towards them in the first place. Just because it is hard - they have now reversed hsitorical policies.

Your question makes sense NOW - but it is only a very very few short years ago that it made no sense at all. cloud services are now defacto standard. They weren't then and there is a huge cost in moving historical processes for a business.

adx

21 posts

Geek
+1 received by user: 6

#1726187 25-Feb-2017 17:35

nunz:

richms: Why is the ISP the logical place to do it?

They don't provide IRC, discord, WhatsApp or any other servers so not sure why they are logical just for email?

Because they used to block port 25 and make life a real heart ache for those not using them as their mail service. Now the ISPs all want out of mail hosting but its them that forced us towards them in the first place. Just because it is hard - they have now reversed hsitorical policies.

Your question makes sense NOW - but it is only a very very few short years ago that it made no sense at all. cloud services are now defacto standard. They weren't then and there is a huge cost in moving historical processes for a business.

Basically what I was going to say, except I'm struggling to come to terms with any fact that it is only a historical problem.

Email pre-dates the web and is every bit as popular as the web these days, even if a lot of it is hosted in the cloud, through the web. It's still email (eg Google's SMTP). It's not a web service some company dreamed up, nor is it (ISP email) really a "server" since a mail relay has client and server functions. It's just a way of sending emails, or queuing them for delivery after the user disconnects their dialup link. Roll the clock forward a decade or two, then they blocked port 25. It's like an ISP blocking port 80 because this new-fangled web thing is inconvenient or costing them too much. If they didn't provide some sort of proxy, nobody would or could use it. I'm also only talking about SMTP - the ability to send or relay emails (because of spam, the port 25 block, and the reason this was needed). Incoming email has a similar story, because it was impractical to deliver directly in the days of dialup, and it is still strongly discouraged for end users to have to run a mail server at their end (say on their phones). Incoming spam is less of a dire emergency but still better centrally managed (eg Gmail) or with good real-time RBLs.

The function of an ISP used to be to make the popular functions of the internet accessible to "ordinary people" - web, email, maybe a usenet server or whatever else is needed to make a dialup connection on client computers usable (as opposed to say a university with their own servers and permanent connection). What seems to be happening these days is the "S" (service) is being dropped and those functions are being pushed off to third party providers, often "free", often massive thrust-advertising data-mining global corporates which is ok but has its own cost. Customers are paying their "IP"s retail prices for a wholesale function. Would be my gripe, had the connections not got so much better and cheaper over the last couple of decades.

My actual gripe is that being able to run a mail client or in-house server of some kind is just as relevant these days as 20 years ago, therefore the function is just as relevant, consumers are just as needy, and the business case for it remains. Yet the latter is being actively dissolved, we're all expected to go to Gmail, or pay again for some third party to provide the "service", secretly / by mistake / loss of insight. Not blaming Spark for that at all (they are evidently well aware of the need to support the "old" way of doing things, once forced to re-open their eyes), just the weird belief-overrides-all disconnect raised in my last post.

tdgeek

30048 posts

Uber Geek
+1 received by user: 9455

Trusted

Lifetime subscriber

#1726211 25-Feb-2017 18:33

nunz:

you missed the point in the first lines. Most of us today end up hooked to multiple ISP by virtue of our mobility. Even if your phone is with Acme ISP you are on a differnt network to the broadband network they offer and without the ability to tunnel back into your home mail server using authentication and/or SSL then you are screwed. Add to that my internet at home is possibly different ISP to work and then hotels / motels / cafe / client sites etc - you end up coming out of multiple ISPs. Until recently many of the ISPs were only using port 25 and port 25 is still the default receiving port for all SMTP servers - so if they are blocking it on your ISP you cant send outgoing email from your own mail server, that sits with your ISP.

No, I didn't miss the point, that is a default reply if the replier does not agree.

Multiple ISP, yes, no problem. Use SSL that your provider, whoever that may be, uses.

"Until recently many of the ISPs were only using port 25" Pardon me? Port 25 over smtp is 17 years out of date, thats long gone. Any ISP worth their salt does not provide it, or if they do, they also provide a proper, current, secure means of transmission, SSL.

Any ISP worth their salt blocks Port 25 by default, so you need to ask for that to be unblocked, which is clearly an issue if you are elsewhere, motels, hotels, etc. Dont use it.

"port 25 is still the default receiving port for all SMTP servers" Correct, except no ISP worth their salt uses that as the sole means of transmission.

Use SSL. For your home mail server, use SSL. Webmail is also accepted worldwide with no issues.

tdgeek

30048 posts

Uber Geek
+1 received by user: 9455

Trusted

Lifetime subscriber

#1726213 25-Feb-2017 18:43

nunz:

Re port 25 blocking. Over the years we have had a number of clients who ran their own exchange server and their ISP was Spark / Xtra. Exchange gives calendar, push notifications etc. Unfortunately when the exchange server goes to send to another mail server the port 25 blocking rules would stop it being able to send out.

Yes, you can apply for that to be removed on your static IP address but the forms are arcane, most of the questions make no sense as they didn't apply, the response was slow and the chances of them getting it right were very hit and miss. Then they would reverse the policy. if I charged for all the time spent on phone to xtra on mail issues me and Bill Gates would be dining out in the same clubs.

The answer was often have your exchange server upload mail to sparks smtp server as a smart relay - with other attendant issues like getting blocked as xtra were black listed. The other issues faced included getting dropped as spam as even static ip address ranges were registered by telecom / xtra / spark with black lists as not allowed to host mail servers - so by sending direct from your static IP address you got blocked via black lists. We did also use thirdparty mail box as collection point then pulled it down to the exchange server - but then splitting out mail at that point had its hiccups requiring third party add ins or mail pull servcies to munge te addres into the right boxes. Exchange etc was never good at pulling from a global pop collection box.

Again - my comment was on the historical mess that has left us in the situation we face today and forced so many hacks and work arounds to deal with stuff.

Our clients mostly use mail servers hosted by NON ISPs that specialize in mail services ( digiweb were a good go to for many years - great support until they got bought out) or mail servers we run on VDS / VPS on their behalf. however, it is only in recent years that the cost of data and VPS and cloud services have got to the point that not having to hack your way through the ISP induced mess was financially reasonable.

"Yes, you can apply for that to be removed on your static IP address but the forms are arcane, most of the questions make no sense as they didn't apply, the response was slow and the chances of them getting it right were very hit and miss."

?? The port 25 unblock bears no relationship whatsoever with a Static IP. The form is a form, its simple, standard, uncomplicated. Hit and miss? No. I know. The port 25 policy has never been reversed to my knowledge. There could well be an issue, but its never been reversed to my knowledge.

Extra blacklisted? Not to my knowledge. Examples? If an Xtra IP address was blacklisted that has no effect on a port 25 issue, as port 25 is not IP related. If your talking Trend Micro, they do block any Static IP that does not have a reverse record. If an IP got blacklisted, you would need to look at the user primarily.

Yahoo is not Xtra, Yahoo is amongst other things, an email provider. There were issues, so "Xtra" email is now being moved to SMX, a business email provider, so you should now expect a business class result. Its still free, so the SLA won't be the same a a business paid account, but its a very very good option.

tdgeek

30048 posts

Uber Geek
+1 received by user: 9455

Trusted

Lifetime subscriber

#1726215 25-Feb-2017 18:44

nunz:

richms: Why is the ISP the logical place to do it?

They don't provide IRC, discord, WhatsApp or any other servers so not sure why they are logical just for email?

Because they used to block port 25 and make life a real heart ache for those not using them as their mail service. Now the ISPs all want out of mail hosting but its them that forced us towards them in the first place. Just because it is hard - they have now reversed hsitorical policies.

Your question makes sense NOW - but it is only a very very few short years ago that it made no sense at all. cloud services are now defacto standard. They weren't then and there is a huge cost in moving historical processes for a business.

Richards reply made sense many many years ago. And Port 25 over smtp made sense many years ago.

Dell

Shop now for Dell laptops and other devices (affiliate link).

tdgeek

30048 posts

Uber Geek
+1 received by user: 9455

Trusted

Lifetime subscriber

#1726218 25-Feb-2017 18:54

adx:

nunz:

richms: Why is the ISP the logical place to do it?

They don't provide IRC, discord, WhatsApp or any other servers so not sure why they are logical just for email?

Because they used to block port 25 and make life a real heart ache for those not using them as their mail service. Now the ISPs all want out of mail hosting but its them that forced us towards them in the first place. Just because it is hard - they have now reversed hsitorical policies.

Your question makes sense NOW - but it is only a very very few short years ago that it made no sense at all. cloud services are now defacto standard. They weren't then and there is a huge cost in moving historical processes for a business.

Basically what I was going to say, except I'm struggling to come to terms with any fact that it is only a historical problem.

Email pre-dates the web and is every bit as popular as the web these days, even if a lot of it is hosted in the cloud, through the web. It's still email (eg Google's SMTP). It's not a web service some company dreamed up, nor is it (ISP email) really a "server" since a mail relay has client and server functions. It's just a way of sending emails, or queuing them for delivery after the user disconnects their dialup link. Roll the clock forward a decade or two, then they blocked port 25. It's like an ISP blocking port 80 because this new-fangled web thing is inconvenient or costing them too much. If they didn't provide some sort of proxy, nobody would or could use it. I'm also only talking about SMTP - the ability to send or relay emails (because of spam, the port 25 block, and the reason this was needed). Incoming email has a similar story, because it was impractical to deliver directly in the days of dialup, and it is still strongly discouraged for end users to have to run a mail server at their end (say on their phones). Incoming spam is less of a dire emergency but still better centrally managed (eg Gmail) or with good real-time RBLs.

The function of an ISP used to be to make the popular functions of the internet accessible to "ordinary people" - web, email, maybe a usenet server or whatever else is needed to make a dialup connection on client computers usable (as opposed to say a university with their own servers and permanent connection). What seems to be happening these days is the "S" (service) is being dropped and those functions are being pushed off to third party providers, often "free", often massive thrust-advertising data-mining global corporates which is ok but has its own cost. Customers are paying their "IP"s retail prices for a wholesale function. Would be my gripe, had the connections not got so much better and cheaper over the last couple of decades.

My actual gripe is that being able to run a mail client or in-house server of some kind is just as relevant these days as 20 years ago, therefore the function is just as relevant, consumers are just as needy, and the business case for it remains. Yet the latter is being actively dissolved, we're all expected to go to Gmail, or pay again for some third party to provide the "service", secretly / by mistake / loss of insight. Not blaming Spark for that at all (they are evidently well aware of the need to support the "old" way of doing things, once forced to re-open their eyes), just the weird belief-overrides-all disconnect raised in my last post.

"then they blocked port 25. It's like an ISP blocking port 80" Your not serious? Maybe you and nunz need to seek the services of an IT guy. Port 25 is used by spammers, there is (or was) more spam throughout globally than legit email. You cannot remotely compare Port 25 to Port 80

I'm not going to bother replying to any other points in your post, sorry. If you used todays email transmission protocols, and not one that old, insecure and long gone, you would not have issues. Analogy, your basically trying to get Windows 95 to work with everything in 2017.

yitz

2239 posts

Uber Geek
+1 received by user: 594

#1726240 25-Feb-2017 20:03

The term "dumb pipe" comes to mind, that's what ISPs or "IPs" are nowadays.

Just happens Spark provides both the dumb pipe and the services operating over it (Xtra email, Lightbox etc.).

tdgeek

30048 posts

Uber Geek
+1 received by user: 9455

Trusted

Lifetime subscriber

#1726302 25-Feb-2017 23:29

yitz: The term "dumb pipe" comes to mind, that's what ISPs or "IPs" are nowadays. Just happens Spark provides both the dumb pipe and the services operating over it (Xtra email, Lightbox etc.).

Xtra email and Lightbox don't operate over Spark's pipe (actually its the network providers pipe, that RSP's use). Xtra email and Lightbox operate over any RSP's pipe.

adx

21 posts

Geek
+1 received by user: 6

#1726307 26-Feb-2017 00:37

tdgeek:

adx:

...

"then they blocked port 25. It's like an ISP blocking port 80" Your not serious? Maybe you and nunz need to seek the services of an IT guy. Port 25 is used by spammers, there is (or was) more spam throughout globally than legit email. You cannot remotely compare Port 25 to Port 80

I'm not going to bother replying to any other points in your post, sorry. If you used todays email transmission protocols, and not one that old, insecure and long gone, you would not have issues. Analogy, your basically trying to get Windows 95 to work with everything in 2017.

Why would I not be serious?

Perhaps someone who is more up with the play than me can chime in and put me straight, but over the internet, all email is delivered via the SMTP protocol on port 25, and most web is delivered via the HTTP protocol on port 80. A global block on port 25 would be worse to email than what a global block on port 80 would do to the web (since secure sites would still work). Port 80 is used by just as many spammers as port 25 (generally the payloads are all on the web, none of them accept return email).

Furthermore, all that SMTP traffic is completely unsecured - plaintext. Email is supposed to be insecure, which may be a surprise to those security "yapalongs" (to potentially coin a word). It has to be this way - email is public - how is a receiving server to understand encrypted data from "any source"? (Yes, I realise this would technically be possible, but it's not done.)

So absolutely - blocking port 25 is like blocking port 80. It is deliberately breaking part of the internet as it is accepted (standards and all that). If an "IP" is going to block port 25, then they better know what they're doing, because otherwise they're breaking email.

Now I'm not arguing that the average residential customer needs or should have port 25 open to the world, but it shouldn't matter these days because no self-respecting mailserver is going to accept mail from those IPs. Delivery of outgoing email to the ISP's mailserver (rather than the internet) via port 25 is less of a problem these days because it simply won't be there if it comes from the wrong network. The point I'm trying to make is that extreme security of the SMTP connection is rather pointless, from a security standpoint. It's for convenience, and as a backup for customers who have unsecured WiFi at home. Definitely a good idea, but not all that essential.

And yes, Xtra would get blacklisted all the time. Any IP address from the pool, any time, any Received header. It was really annoying. That might be one thing Yahoo improved on now I think about it.

I'm not really disagreeing, just trying to shine some light on what is really going on.

yitz

2239 posts

Uber Geek
+1 received by user: 594

#1726324 26-Feb-2017 00:56

adx:
Furthermore, all that SMTP traffic is completely unsecured - plaintext. Email is supposed to be insecure, which may be a surprise to those security "yapalongs" (to potentially coin a word). It has to be this way - email is public - how is a receiving server to understand encrypted data from "any source"? (Yes, I realise this would technically be possible, but it's not done.).

Actually in the post-Snowden world it is pretty much all encrypted.

Apple TV

Stream your favourite shows now on Apple TV (affiliate link).

adx

21 posts

Geek
+1 received by user: 6

#1726330 26-Feb-2017 01:44

yitz:
adx:

Furthermore, all that SMTP traffic is completely unsecured - plaintext. Email is supposed to be insecure, which may be a surprise to those security "yapalongs" (to potentially coin a word). It has to be this way - email is public - how is a receiving server to understand encrypted data from "any source"? (Yes, I realise this would technically be possible, but it's not done.).

Actually in the post-Snowden world it is pretty much all encrypted.

At the link level, yes, I suppose everything would be. But that's not much use if the very entity that you least want abusing your information has all the keys...

What I was wondering was if there is any effective encryption (beyond physical security) of the links between all the mailservers (in the old ISP to ISP sense). Once the virtual connection comes out of the router in the datacentre - does it normally go through some sort of encryption process in the server or something locked into the same cabinet? This is not so much a worry for a traditional "phone exchange" type DC like you'd imagine an ISP would have, but it just going somewhere in the building with no more than the usual level of wiring security you'd find in the corporate world, with random failovers and peering connections and other customers about the place. I don't know. Now I think about it most places that "take security seriously" are going to actually do that, but it has to happen at both ends, and any places in between, no matter where in the world it goes. AFAIK there is no encrypted connection from "end to end" over the internet for SMTP.

richms

29104 posts

Uber Geek
+1 received by user: 10222

Trusted

Lifetime subscriber

#1726415 26-Feb-2017 10:38

Most servers are quite happy to starttls on their connections. Gmail actually warns you if it came in to it insecurely now.

Richard rich.ms

adx

21 posts

Geek
+1 received by user: 6

#1726482 26-Feb-2017 13:14

richms: Most servers are quite happy to starttls on their connections. Gmail actually warns you if it came in to it insecurely now.

Well well, I stand ~80% corrected...

https://www.google.com/transparencyreport/saferemail/

groj

2 posts

Wannabe Geek

#1758025 7-Apr-2017 10:50

So,

Spark/Xtra, How about letting us know this is an issue for Mac's running Office 2011.

Oh, and if you are a Business mail user we let you use anything as you are important to us.... (check it out even settings for Outlook express! )

Nothing on the Spark website to advise any changes nor notes this. Mail just stopped working.

Thanks for all the comments here. Thought I was going insane and keying something wrong.

Oh, and just on to Spark support chat and guess what... First response, "I'm not sure on that let me pass you to our email support team" Waiting....... Waiting...... Waiting....

1 | 2 | 3 | 4 | 5 | 6 | 7