ihug smtp problems

Forums › One New Zealand (including Vodafone, WxC, Farmside) › ihug smtp problems

wnelson

10 posts

Wannabe Geek

#20106 13-Mar-2008 14:11

Hi,

just a query here:

I'm living over in the UK (and have done for several years). I've maintained my ihug account as it is well known to friends and family in NZ.

Late last week I started getting authentication problems with ihug's smtp servers. The symtoms are recieving an authentication dialogue box every time I try and send an email via ihug. I have to stress here that this wasn't a problem until late last week. Up until then, sending/recieving had been fine. I hadn't changed any of my client settings but just to be sure I made a few checks:
1. First I used another ISP here in the UK just in case my primary ISP had descided to pull a swift one (has been known ;)) I use a couple of different ISPs so this was easy to check: nope same problem with ihug on both ....

2. Use another PC just in case I screwed my client settings - nope same problem on 3 different PCs.

3. local problem with router etc: nope I have several mail accounts spread over UK, US, Germany and NZ. All other smtp servers were working correctly.

4. emmmm... does seem to point to a problem within ihug. So I waited a day and then another. Nothing showing up on their status page. I then reported a fault through their Rightnow Technoligies knowledge base system ( I think they call it Smily or something). Wait 3 days .... no response so I bump the message. Another 2 days still no response so I call:

I'm really irked by this ... they have a knowlege base and ticket system why does the customer have to call to get a response?? :(

International call ... wait on hold for 20 minutes and I finally get throught to someone at 'Customer Services' (that is stretching the title a bit)

First I'm told: 'yeah that is a problem we have had for a few years' I then pointed out that it was working fine for me up until late last week. I'm then told to 'resolve' the problem I should use my ISPs server. I pointed out that that my ISP (in all likelyhood) doesn't want to relay ihug's mail and even by slim chance that it did, the mail would get bounced by most of the worlds mail servers as probable spam.. The conversation went on for quite some time and during this time (mysteriously) I recieved an email reponse to the call I had logged 6 days previously .....

The email response was even worse. 1st it told me to turn on authentication in my client for the smtp server (duh!) then if that didn't work use my ISP for smtp (relay??) and told me to set that up thus: "However some overseas ISP's block the use of a secure connection if this is the case all you would then need to do is change the outgoing mail settings to the ISP's SMTP that you are using to connect ex: smtp.at overseas isp. co.nz."

Huh? I had told them it wasn't *my* ISP blocking what is the 'smtp.at overseas isp.co.nz' about??? Even if I *could* relay that string wouldn't work

Whilst writing this, I recieved another email from ihug saying they only told me to use ISP for SMTP because 'this had worked for other customers' and they wanted to help me relsolve my issue 'at the soonest opportunity' ??? (funny that it took them 6 days to respond) and do they *really* advise customers to use another ISP for relaying? - It seems pretty amateurish to me ??

Anyway to cut to the chase:

Anyone else experiencing smtp problems with ihug? (they tell me I'm the only one that reported a problem)

Regards,
Wayne

1 | 2

2380 posts

Uber Geek

ID Verified

Trusted

#116378 13-Mar-2008 15:57

Not sure why yours worked for a while and then stopped.

I actually have the same problem, have a read of this;

http://www.geekzone.co.nz/forums.asp?ForumId=40&TopicId=19898

I have to relay my ihug email through the xnet smtp server which (as you pointed out) gets a lot of my email blocked as spam.

Ive tried all manner of configurations and havent had any luck.

At least Im not the only one anymore!

Personally I dont see why I cant relay my ihug email through the ihug smtp server if im with another provider, I do after all pay for the privledge of having the ihug account (and am hence an authenticated user)

Trevor

wnelson

10 posts

Wannabe Geek

#116517 14-Mar-2008 05:09

I agree 100% - you pay for the service and they should be delivering. This is basic ISP functionality to be able recieve and send email. The fact that you are using another ISP to connect shouldn't matter at all. As you point out you are authenicating (or trying to!)

I had a read of your thread - Do Xtra really block port 25?? You may want to setup a little test like this:

(assuming you are using MS) Open a cmd prompt. Type in: telnet smtp.ihug.co.nz 25

If you are getting blocked on port 25 anywhere you'll probably get a response like:
Connecting To smtp.ihug.co.nz...Could not open connection to the host, on port 25: Connect failed

If you get a response like this, it means port 25 isn't blocked (note the 1st line might differ from what is here):
220-smtp.mailfilter4.ihug.co.nz ESMTP
220 STMPAUTH-RELAY: You may only relay through this system if you authenticate yourself

If it is the 1st case and you want to check if Xtra is doing the blocking, try a couple of my mail servers in the US:
First lets try port 25 <type>: telnet mail.kiwiphotography.co.uk 25
If it works you'll get a response something like:
220-curry.cirtexhosting.com ESMTP Exim 4.68 #1 Thu, 13 Mar 2008 11:21:51 -0400
220-We do not authorize the use of this system to transport unsolicited, and/or bulk e-mail.
This would point to a problem somewhere on the Xtra/ihug gateway (not sure how this works in NZ)

However, it it fails with a message like Connect failed then we need check a bit further. Another of my mail servers uses port 26, so it is worth checking if Xtra is blocking on this port <type>: telnet mail,digitalir.co.uk 26
You'll get either Connect Failed or a 220 message like above

If you end up with a Connect Failed on kiwiphotography, but a 220 on digitalir, it probably points to Xtra blocking port 25 but not port 26. If this is the case I'd get onto Xtra about it. After all you are paying them for a service as well and port blocking shouldn't be part of this.

I know I'm not being blocked on any ports - this is my telnet session with smtp.ihug.co.nz (italics is me, bold is ihug server):
telnet smtp.ihug.co.nz 25
220-smtp.mailfilter2.ihug.co.nz ESMTP
220 STMPAUTH-RELAY: You may only relay through this system if you authenticate yourself
EHLO wayne
250-smtp.mailfilter2.ihug.co.nz
250-8BITMIME
250-SIZE 33554432
250-STARTTLS
250-AUTH PLAIN LOGIN
250 AUTH=PLAIN LOGIN
AUTH LOGIN
334 VXNlcm5hbWU6
d25lbHNvbg==
334 UGFzc3dvcmQ6
aWh1Z3N1eA== (yes I did change the password )
535 #5.7.0 Authentication failed

For the geeks: interesting to note from the above that ihug don't require an encrypted session to be established before accepting clear text credentials!

Trevor: so are we the only 2 people on the planet that can't send email through ihugs servers???

Regards,
Wayne

tchart

2380 posts

Uber Geek

ID Verified

Trusted

#116541 14-Mar-2008 08:05

Right, had a quick test this morning before I had to leave for work.

telnet smtp.ihug.co.nz 25
...Could not open connection to the host, on port 25: Connect failed

telnet mail.kiwiphotography.co.uk 25
...Could not open connection to the host, on port 25: Connect failed

telnet mail.digitalir.co.uk 26
...We do not authorize the use of this system to transport unsolicited, and/or bulk e-mail.

So it appears to be Xnet (not Xtra) blocking all port 25 traffic unless its to their server?

Trevor

wnelson

10 posts

Wannabe Geek

#116552 14-Mar-2008 08:30

It appears so. I guess you can't blame ihug for this one.

I don't know who Xnet is (haven't lived in NZ for a few years) but I wouldn't accept that from an ISP. You are paying them for an Internet connection and they shouldn't be dictating what ports you can connect to servers on. What say you want to set up your own domain and mail server in the future?

Wayne

freitasm

BDFL - Memuneh
79309 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#116553 14-Mar-2008 08:34

wnelson: Anyone else experiencing smtp problems with ihug? (they tell me I'm the only one that reported a problem)

Most ISPs block access to their SMTP servers from external networks, and many go an extra step and block it even if you are authenticated - dumb in this case, but prevents dictionary attacks, which a lot of spammers do.

Perhaps the CSR just doesn't know the policies? Or perhaps this is really a technical fault they are not aware of - but we should hear of more people having problems.

wnelson: Do Xtra really block port 25??

Yes, and they have done that for years now. Users can apply online to have the block lifted.

wnelson: You may want to setup a little test like this:

No need to test, the comments on the other thread make it clear that Xnet also blocks access to port 25.

freitasm

BDFL - Memuneh
79309 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#116556 14-Mar-2008 08:37

wnelson: It appears so. I guess you can't blame ihug for this one.

I don't know who Xnet is (haven't lived in NZ for a few years) but I wouldn't accept that from an ISP. You are paying them for an Internet connection and they shouldn't be dictating what ports you can connect to servers on. What say you want to set up your own domain and mail server in the future?

As in my previous reply, Xtra allows you to ask for an exemption - just do it online. Xnet requires a static IP address, but it allows after a request.

Most ISPs block access to port 25 on external networks to prevent trojans and bots sending out spam. Millions of PCs around the world are infected and those use hijacked or open smtp relays to send out billions of spam messages. So ISPs block access to external port 25 to prevent this happening.

wnelson

10 posts

Wannabe Geek

#116559 14-Mar-2008 08:48

Most ISPs block access to port 25 on external networks to prevent trojans and bots sending out spam. Millions of PCs around the world are infected and those use hijacked or open smtp relays to send out billions of spam messages. So ISPs block access to external port 25 to prevent this happening.

Where do you get 'most ISPs' from?? that is most certainly not my experience in the UK or Europe. There would be an absolute uproar.

Wayne

Quic Broadband

Move to New Zealand's best fibre broadband service (affiliate link). Free setup code: R587125ERQ6VE. Note that to use Quic Broadband you must be comfortable with configuring your own router.

freitasm

BDFL - Memuneh
79309 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#116560 14-Mar-2008 08:50

Make it "some" or "many" then.

wnelson

10 posts

Wannabe Geek

#116563 14-Mar-2008 09:00

freitasm: Make it "some" or "many" then.

Yes and confine it to NZ (maybe Aus - don't know??)

Seems to be some flawed logic on the part of the ISPs down there then. Why don't they invest in some decent IDS to detect the dictionary type attacts?

And if you read my post above you would have seen ihug doesn't even require an encrypted session before authentication credentials are sent --- is ihug one of the 'many' ISPs that blocks 25?

Wayne

freitasm

BDFL - Memuneh
79309 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#116569 14-Mar-2008 09:31

wnelson:
freitasm: Make it "some" or "many" then.

Yes and confine it to NZ (maybe Aus - don't know??)

Seems to be some flawed logic on the part of the ISPs down there then. Why don't they invest in some decent IDS to detect the dictionary type attacts?

And if you read my post above you would have seen ihug doesn't even require an encrypted session before authentication credentials are sent --- is ihug one of the 'many' ISPs that blocks 25?

Wayne

I've heard of U.S.-based ISPs doing the same.

Port 25 is never encrypted. If you want encryption then you will have to try Secure SMTP with SSL and a different port - if your provider supports it.

I don't know if IHUG blocks incoming or outgoing port 25 access.

wnelson

10 posts

Wannabe Geek

#116574 14-Mar-2008 09:53

I've heard of U.S.-based ISPs doing the same.

Care to name one? This is quite different to the blanket statement you first came out with....

Port 25 is never encrypted. If you want encryption then you will have to try Secure SMTP with SSL and a different port - if your provider supports it.

ESMTP (which ihug uses) supports TLS, it sets up a tunnel first before credentials are passed. The way ihug have it setup: although you *can* use TLS, it is not required so the users credentials are passed in clear text. I think you mis-understood.

I don't know if IHUG blocks incoming or outgoing port 25 access.

They don't block incoming port 25 (and haven't for the past 12 years that I have been using them). They still don't now as I proved on the tenet session above. Outgoing??? - don't know - only someone someone using ihug will be able to tell us

Wayne

freitasm

BDFL - Memuneh
79309 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#116576 14-Mar-2008 09:58

wnelson:
I've heard of U.S.-based ISPs doing the same.

Care to name one? This is quite different to the blanket statement you first came out with....

Google Search with lots of results. Comcast started doing a selective block and AT&T SNET is doing a blanket blocking. But hey, go around and check the search. I can't list all results here.

freitasm

BDFL - Memuneh
79309 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#116578 14-Mar-2008 10:00

And a reference to other ISPs:

"Bell System DSL, Charter Cable, Cox Cable and other ISPs are implementing "port 25 blocking", so you may have to send OUTBOUND email through THEIR server."

And yes, doubting the word of the Alpha Geek around here is not well received ;-)

wnelson

10 posts

Wannabe Geek

#116583 14-Mar-2008 10:26

And yes, doubting the word of the Alpha Geek around here is not well received ;-)

LOL ..... it doesn't substantiate of "most" or even "many". This was tried by quite a few ISPs some time ago but it failed because (as Trevor has found out), the mail will get bounced by many of the world's mail servers. It is easy for me to create an emal FROM: Mauricio.Freitas@geekzone.co.uk but if I send that through one of my mail servers, who is going to believe it???

I agree though: spam, trojans, attacks are big problems for the ISP. Blocking ports to their customers is not the solution though. Maybe there is not enough competition in NZ? If they tried that over here they would loose so many customers, they would soon back-track.

And what was that you quoted about requiring a static IP for one of the ISPs to remove the block on 25? that is nothing more than a crude money grab to modify an ACL.

NZ customers affected need to tell thier ISPs where it hurts them - in the pocket. If your ISP is implementing such a crude (and ineffective) measure: migrate!

.... This has diverged well off my OP. My problem has nothing to do with port blocking!

Wayne

freitasm

BDFL - Memuneh
79309 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#116584 14-Mar-2008 10:30

Agreed things aren't going to work well all the time. The outgoing port 25 block is not to prevent impersonation, which as you note can still be accomplished by using the ISP's own server, but it prevents using external open relays - we both know that and it should now be clear to anyone reading this discussion.

As for impersonation, Xtra will start to require registration of third party supplied e-mail addresses from anyone who wants to use their SMTP servers.

wnelson: .... This has diverged well off my OP. My problem has nothing to do with port blocking!

Exactly, but the second post came up and you asked if Xtra was blocking...

By the way. geekzone.co.uk does redirect to geekzone.co.nz ;)

1 | 2