SMX spam filtering possibly having issues

Forums › IT Pro and developers › SMX spam filtering possibly having issues

Dynamic

4015 posts

Uber Geek
+1 received by user: 1851

ID Verified

Trusted

Lifetime subscriber

#213972 21-Apr-2017 13:48

It looks like SMX may be currently experiencing some issues. Both ourselves and clients sending from Office 365 based email accounts are seeing rejection notices from companies using SMX for spam filtering, when there is no chance the messages are spam (i.e. not marketing emails etc). Speaking to SMX a few minutes ago after logging a case electronically, the rep spoken to was unaware of any issues.

The rejection email message includes:

550 5.7.350 Remote server returned message detected as spam -> 554 5.7.1 We apologise but this message has been rejected due to suspected spam

Their upstream provider CloudMark's web site is currently offline. I hope for their sake it's not a DDOS attack or similar. Chrome tells me:

This page isn’t working
www.cloudmark.com is currently unable to handle this request.
HTTP ERROR 500

“Don't believe anything you read on the net. Except this. Well, including this, I suppose.” Douglas Adams

1 | 2

193 posts

Master Geek
+1 received by user: 39
Inactive user

#1768503 21-Apr-2017 15:00

See what score you get here:

http://www.mail-tester.com/

It might give you a few clues what is "wrong" with your email server.

Personally, I believe no company should use a spam filter.

I can't see how missing a customers email due a false positive is worth not having to press delete on a spam email on occasion.

It's not that hard to delete spam.

It's also not that hard to protect your email address from getting "out there" either.

muppet

2642 posts

Uber Geek
+1 received by user: 1660

Trusted

#1768506 21-Apr-2017 15:14

mattrix:

See what score you get here:

http://www.mail-tester.com/

It might give you a few clues what is "wrong" with your email server.

Personally, I believe no company should use a spam filter.

I can't see how missing a customers email due a false positive is worth not having to press delete on a spam email on occasion.

It's not that hard to delete spam.

It's also not that hard to protect your email address from getting "out there" either.

You run a public mailserver that has no spam filtering?

On what do you base this "it's not hard to delete spam" claim? I run a small personal mailserver and even it sometimes sees upwards of 2-3 spam attempts a second.

I'd say it's not possible to run a public mailserver, business or otherwise, without spam filtering.

Dynamic

4015 posts

Uber Geek
+1 received by user: 1851

ID Verified

Trusted

Lifetime subscriber

#1768508 21-Apr-2017 15:29

mattrix: See what score you get here:

http://www.mail-tester.com/

It might give you a few clues what is "wrong" with your email server.

I don't believe there is anything 'wrong' with the sending mail server. It appears to be an issue with the recipient's anti-spam system. I say that with some confidence, as messages from multiple sources to multiple destinations using the same anti-spam system were affected. I'm now advised the issue has been resolved, though curiously the cloudmark.com web site is still not responding as I type this message.

Personally, I believe no company should use a spam filter.

I can't see how missing a customers email due a false positive is worth not having to press delete on a spam email on occasion.

It's not that hard to delete spam.

It's also not that hard to protect your email address from getting "out there" either.

I think these comments do not reflect commercial realities. I've had clients experience 4 out of 5 incoming emails be junk with volumes of 100+ messages per day. Clearing that volume of spam is monotonous. Having an anti-spam system getting rid of the most obvious junk is worthwhile IMHO.

Once your email address is out there, the genie cannot be put back in the bottle. It doesn't have to be your fault your email address is out there (e.g. an inexperienced web developer hyperlinking email addresses on your web site), and the older your email address is, typically the worse the problem becomes.

“Don't believe anything you read on the net. Except this. Well, including this, I suppose.” Douglas Adams

Dynamic

4015 posts

Uber Geek
+1 received by user: 1851

ID Verified

Trusted

Lifetime subscriber

#1768510 21-Apr-2017 15:32

muppet: I'd say it's not possible to run a public mailserver, business or otherwise, without spam filtering.

Not to mention anti-malware scanning as well when possible, with a large percentage of viruses and other malware being transmitted by email these days. Not all computer users are as cautious as their IT Support people would like.

“Don't believe anything you read on the net. Except this. Well, including this, I suppose.” Douglas Adams

mattwnz

20515 posts

Uber Geek
+1 received by user: 4795

#1768513 21-Apr-2017 15:46

Check the sending servers IP address at mxtoolbox.com, to see if it is on any blacklists. If not, then likely a problem with the receivers server.

mattrix

193 posts

Master Geek
+1 received by user: 39
Inactive user

#1768518 21-Apr-2017 16:07

mail-tester checks blacklists.
It also checks important things like correct DKIM signature, DMARC and your SPF DNS records.

If your not getting 10/10 - then you should really talk to your email provider (or host your own - $5 a month)

Samsung

Shop now on Samsung phones, tablets, TVs and more (affiliate link).

richms

29098 posts

Uber Geek
+1 received by user: 10207

Trusted

Lifetime subscriber

#1768526 21-Apr-2017 16:20

mattrix:

Personally, I believe no company should use a spam filter.

I can't see how missing a customers email due a false positive is worth not having to press delete on a spam email on occasion.

Mine got disabled for 2 days in error by the guy that ran a basic LAMP server with spam assasin on it once.

20,000 emails.

Normallu 20-30 over a weekend with maybe 5-6 that get thru the filters which are set very very loose.

Richard rich.ms

mattwnz

20515 posts

Uber Geek
+1 received by user: 4795

#1768535 21-Apr-2017 16:50

mattrix:

mail-tester checks blacklists.
It also checks important things like correct DKIM signature, DMARC and your SPF DNS records.

If your not getting 10/10 - then you should really talk to your email provider (or host your own - $5 a month)

I just tested using that tool from SMXs server by sending from xtramail, and only scored 7.1. Their serer is also listed on a blacklist, Listed in BACKSCATTERER

Also it has the following problem below, as well as a few other problems.

Message has a DKIM or DK signature, not necessarily valid
This negative score will become positive if the signature is validated. See immediately below.

vulcannz

436 posts

Ultimate Geek
+1 received by user: 136
Inactive user

#1768709 22-Apr-2017 09:20

mattrix:

Personally, I believe no company should use a spam filter.

I can't see how missing a customers email due a false positive is worth not having to press delete on a spam email on occasion.

It's not that hard to delete spam.

It's also not that hard to protect your email address from getting "out there" either.

Wow, I'm sorry but you should not make such comments on things you have no experience with.

Spam filters are more than just spam blockers these days. False positives are very very low.

Spam filtering solutions are usually providing DoS protection, DHS protection, phishing protection, and antivirus/day zero protection. 97% of ransomware attacks happen via email.

mattrix

193 posts

Master Geek
+1 received by user: 39
Inactive user

#1768774 22-Apr-2017 10:50

"False positives are very very low."

And yet your comment is on a thread about a false positive.

Maybe my statement was a bit over the top.

I did not initially think about company's with more susceptible users which is most likely most of them.

vulcannz

436 posts

Ultimate Geek
+1 received by user: 136
Inactive user

#1768922 22-Apr-2017 14:35

mattrix:

"False positives are very very low."

And yet your comment is on a thread about a false positive.

Maybe my statement was a bit over the top.

I did not initially think about company's with more susceptible users which is most likely most of them.

There is no such thing as more less susceptible users. Everyone is susceptible if they use email and have a connection to the internet.

This thread is not about a false positive. A company has been blacklisted, there is usually a reason for this.

Geekzone

Want to support Geekzone and browse the site without the ads? Subscribe to Geekzone now (monthly, annual and lifetime options).

mattwnz

20515 posts

Uber Geek
+1 received by user: 4795

#1768930 22-Apr-2017 14:51

Usually a email server is blacklisted because they have at least one user sending out spam, possibly via a hacked pic. One solution around this is to give everyone a dedicated IP, rather than everyone share the same IP

vulcannz

436 posts

Ultimate Geek
+1 received by user: 136
Inactive user

#1769270 23-Apr-2017 16:29

mattwnz: Usually a email server is blacklisted because they have at least one user sending out spam, possibly via a hacked pic. One solution around this is to give everyone a dedicated IP, rather than everyone share the same IP

Wut? That makes no sense. Everyone should be sending out via their single mail server and that in turn sends out via its IP.

If a user is sending out spam to the point they get blacklisted it usually means:

- the firewall policies are incorrectly configured and allow anyone to send email when only the allocated mail server IP should be able too

- the mail server itself is either not capable of managing internal spam or has been configured incorrectly (this is the case for the OP where the mail server in question is backscattering)

mattwnz

20515 posts

Uber Geek
+1 received by user: 4795

#1769276 23-Apr-2017 16:50

vulcannz:

mattwnz: Usually a email server is blacklisted because they have at least one user sending out spam, possibly via a hacked pic. One solution around this is to give everyone a dedicated IP, rather than everyone share the same IP

Wut? That makes no sense. Everyone should be sending out via their single mail server and that in turn sends out via its IP.

If a user is sending out spam to the point they get blacklisted it usually means:

- the firewall policies are incorrectly configured and allow anyone to send email when only the allocated mail server IP should be able too

- the mail server itself is either not capable of managing internal spam or has been configured incorrectly (this is the case for the OP where the mail server in question is backscattering)

The mailserver of the ISP either has a single IP or a IP range that is shared across all the shared customer base. So it one of the customers is hacked and is sending our spam, or is spamming intentionally, then that has the potentially to affect a substantial number of other customers using that shared mail platform. Usually ISPs though will have systems in place to detect high mass email senders, or they have staff to monitor things, as well as check the blacklists regularly. My test email shows that xtras own IP is or was blacklisted too, so it has to have been blacklisted for a reason, such as at least one of their users sending spam.

mdav056

616 posts

Ultimate Geek
+1 received by user: 160

Subscriber

#1769357 23-Apr-2017 20:06

Hmmm. I've been having trouble today trying to validate my MS account on a new laptop, which uses my Xtramail (SMX) account. I've tried 4 times to get MS to send validation codes to my @xtra.co.nz address, and according to the software, the codes have been sent. But none have arrived on my xtramail. Could SMX be blocking such emails from MS? If so, a bloody big black mark.

gml

1 | 2