Email Bounce backs

Schmike · 21-07-2010 2:52pm #1

Anyone getting anything like these

Your message did not reach some or all of the intended recipients.
Subject: Re: (Subject)

Sent: 21/07/2010 13:19
The following recipient(s) could not be reached:
(name) on 21/07/2010 13:20
The message reached the recipient's e-mail system, but delivery was refused. Attempt to resend the message. If it still fails, contact your system administrator.
<(Server name).(domian name) .local #5.2.0 smtp;552 5.2.0 kcFD1e0194PHs5i01cFGEd Abusive content detected in your email>

Seen this on a few sites in the passed week or so.

Fysh · 21-07-2010 2:57pm

.......

Email bouncebacks are a pain in the arse to troubleshoot if you don't have the sender's details, the logs from the mailserver they're sending the message through, and a copy of the original message.

Given the triviality of spoofing a source address, a lot of bouncebacks are actually generated by spoofed spam messages.

Schmike · 21-07-2010 3:03pm

Hi Fysh,

It's very hard to track down. Just seen a high volume of the same issue in the passed few days. Different email setup’s Exchange, Mdaemon and pop. The mail seems to go out fine and some comes in. No blacklist issues or anything. Can’t see the other side to see why.

Fysh · 21-07-2010 3:24pm

In the absence of any other evidence, I'd say it's most probably a spike in the amount of spam mail spoofing its source address as your domain.

ressem · 21-07-2010 11:11pm

The other thing that pops up at this time of year is holiday time.

If your spam filter isn't external, and you're the admin the reason you're seeing these messages could be spam being sent to a mail account with out of office enabled, and your server attempting to send out of office messages to false addresses.

matt-dublin · 27-07-2010 1:37pm

Abusive content detected in your email

did you say a curse word in your email, or send a dodgy picture?

jamesd · 27-07-2010 2:26pm

matt-dublin wrote: »

Abusive content detected in your email

did you say a curse word in your email, or send a dodgy picture?

I was getting this lately on a domain I look after, I removed a hyperlink from their email signature and solved.

matt-dublin · 27-07-2010 4:54pm

yeah it looks like something in the mail that was sent is being blocked by some form of mail scanning software at the far end.

The message reached the recipient's e-mail system, but delivery was refused : it got to the door but wasn't allowed in...

smtp;552 5.2.0 kcFD1e0194PHs5i01cFGEd Abusive content detected in your email> ; suggest that either a picture, word or a link in the email containf some form of profanity and was blocked.

phill106 · 29-07-2010 4:20pm

I work in a hosting company and the increase in last few months of people having same issue is huge. Generally people who send out through eircom and are getting blacklisted left right and centre.

matt-dublin · 29-07-2010 5:12pm

phill106 wrote: »

I work in a hosting company and the increase in last few months of people having same issue is huge. Generally people who send out through eircom and are getting blacklisted left right and centre.

generally because eircom is an open relay.

you can send an email from anyone's email address to anyone's email address using eircom.net's smtp server.

the only company i have seen that hasn't blacklisted eircom recently is ironport although we do sometimes have difficulty getting eircom.net mails through our ironport servers at times.

@eircomnet : start using SMTP auth on your relay servers!

Hal1 · 31-07-2010 2:31pm

Get the person your sending to, to add you on the whitelist on their spam filter.

david.dalton · 12-08-2010 6:45pm

in July Eircom changed the eMail filtering software they use. This has resulted in a huge increase in the number of false positive "Abusive Content" mails being bounced from their servers. What is happening is that the scanners are reading through the incoming mail and mis-interperating some of the text as abusive content. I have spent many hours since last week in July trying to work through this problem with their support team but as yet do not have any result. Pushing your mail through their smart host mail1.eircom.net makes no difference as the mail is still scanned by the faulty scanner.

Come on Eircom... Admit the problem and get it fixed...

RoadKillTs · 13-08-2010 1:10pm

I had this on a customers pc yesterday. Think it was linked to a malware issue.

testicle · 18-08-2010 11:42am

matt-dublin wrote: »

generally because eircom is an open relay.

Eircom haven't been an open relay for about 10 years!

mollyware · 19-08-2010 9:43am

We are running SBS 2003 and have started to see the same problem in the last few days. Oddly enough only mails with 2 attachements or more get stopped. Remove the attachements and it goes through fine. david.daltons post on new filtering software being used by Eircom is worring. If this is the case how does one go about getting this changed. I've changed exchange back to routing email through DNS from mail1.eircom.net and will monitor the issue.

The message received in the NDR is:-
domain.ie #5.2.0 smtp;552 5.2.0 w75b1e0120jTFrn0175eAH Abusive content detected in your email>

matt-dublin · 20-08-2010 4:26pm

u sure about that? give me your email address and ill send you an email from your mail address from mail1.eircom.net

testicle · 22-08-2010 9:24pm

matt-dublin wrote: »

u sure about that? give me your email address and ill send you an email from your mail address from mail1.eircom.net

Certain, what you are describing isn't an open relay. What would be an open relay would be if I were able to do as you describe - I'm not an Eircom customer.

matt-dublin · 23-08-2010 8:56pm

You can send an email anyone@anywhere.com using mail.Eircom.net as an smtp server.

I am 100% sure of this being an open relay, with 10 years plus in high level IT and email systems administration I'm quite confident I'm right.

Give me ur address and il send u an email from bill gates using eircoms mail server!!

RoadKillTs · 23-08-2010 9:29pm

Hi Matt,

Why would Eircom be using an open-relay? Thats unheard of these days with the amount of spam going around.

My ISP is Magnet and I changed my outgoing server to "mail1.eircom.net" but I am getting an "Outlook is unable to connect to your SMTP server" error.

matt-dublin · 23-08-2010 9:32pm

Use mail.Eircom.net

RoadKillTs · 23-08-2010 9:37pm

I tried that one aswell.

I also check the server here

Test mail relay
To:<spammer@spam.vancouver-webpages.com> .. 550 5.1.1 Relaying denied to domain spam.vancouver-webpages.com
To:<http@vancouver-webpages.com> .. 550 5.1.1 Relaying denied to domain vancouver-webpages.com
To:<http@vancouver-webpages.com@mail.eircom.net> ..550 5.5.0 malformed address: @mail.eircom.net> may not follow

matt-dublin · 24-08-2010 9:48am

That's new!!!

testicle · 24-08-2010 12:59pm

matt-dublin wrote: »

You can send an email anyone@anywhere.com using mail.Eircom.net as an smtp server.

Yes, I know. As long as you are on an eircom IP. This is not an open relay.

matt-dublin wrote: »

I am 100% sure of this being an open relay, with 10 years plus in high level IT and email systems administration I'm quite confident I'm right.

Big Swinging Mickey. You're still wrong.

matt-dublin wrote: »

Give me ur address and il send u an email from bill gates using eircoms mail server!!

Sure, anyone can do it, as long as they are on an eircom IP.

matt-dublin wrote: »

That's new!!!

It stopped being an open relay, as I said, many (about 10) years ago.

leokearns · 27-08-2010 10:40am

Remove all email address links and hyperlinks in any footers and it should go through ok.

Eircom aware of the filter issue but disconnect me each time we call.:)

Regards
Leo Kearns

phill106 · 30-08-2010 2:28pm

Just to reassure people, this is still happening to lots of people using eircoms smtp service. No fix as of yet.

bhickey · 30-08-2010 2:31pm

phill106 wrote: »

Just to reassure people, this is still happening to lots of people using eircoms smtp service. No fix as of yet.

When it happens, can you check your external IP on the RBL blacklists to see if that might have anything at all to do with it? You can check at MX Toolbox.

phill106 · 06-09-2010 11:45am

bhickey wrote: »

When it happens, can you check your external IP on the RBL blacklists to see if that might have anything at all to do with it? You can check at MX Toolbox.

Its not actually happening to me, Just to people i support. Invariably they are on some blacklist, but who isnt on some blacklist these days!

bhickey · 06-09-2010 11:50am

phill106 wrote: »

....but who isnt on some blacklist these days!

True but it would still be useful to check, if only to get an indication that this could be what's causing the problem. If one ISP (e.g. Eircom) consistently suffers from this and another ISP doesn't then well at least you have an option.

estrella_ · 07-09-2010 5:45pm

We send our office emails through mail1.eircom.net and today suddenly can no longer send any emails that contain a web link. We are getting the same error "5.2.0 3sRe1f00g0k9Q4e01sRhYi Abusive content detected in your email"

The links we are sending are work related and not dodgy or spam related.

I have contacted Eircom support but not expecting them to quickly resolve the issue.

Has anyone found a way around this?

thanks.

bhickey · 07-09-2010 5:52pm

Any chance you could check your external IP address at MX ToolBox to see if it is currently blacklisted?

STForSale · 14-09-2010 12:01pm

We've had problems for over a month now trying to deliver to eircom addresses. Started off with addresses containing apostrophises failing. Now we're also seeing the abusive content NDR when message clearly has no abusive content.

Never ceases to amaze me how people try to run a business using an eircom mail account

phill106 · 14-09-2010 4:54pm

STForSale wrote: »

Never ceases to amaze me how people try to run a business using an eircom mail account

Not just eircom mail accounts. Merely having an eircom connection, and using that to send out mail is enough to drive you mental.

estrella_ · 14-09-2010 5:14pm

Eircom support came back and said the issue is caused by using brackets ( ) in emails and to avoid using them. So for now can send email once we leave out the (brackets).

jamesd · 14-09-2010 5:28pm

estrella_ wrote: »

Eircom support came back and said the issue is caused by using brackets ( ) in emails and to avoid using them. So for now can send email once we leave out the (brackets).

Brackets in the body of the email?

phill106 · 17-09-2010 11:42am

estrella_ wrote: »

Eircom support came back and said the issue is caused by using brackets ( ) in emails and to avoid using them. So for now can send email once we leave out the (brackets).

jamesd wrote: »

Brackets in the body of the email?

I assume they mean in the formatting, because I am pretty sure an actual bracket is an invalid character for an email address.

I think they mean in this instance
emailname@somedomain
or
emailname@somedomain <emailname@somedomain>
With eircom not liking mails in the second format.

Either of two things happened: when configuring their email program, the sender entered their email address in both the "Name" and "E-mail" fields. Alternately, the email program ignored the "Name", if it even has the ability to use it, and substituted the email name instead.
So according to eircom, changing the name in your email properties to be your actual name, rather then the email address should sort it.
Anyone having this issue care to try?

jchayes · 22-09-2010 3:23pm

My company have being experiencing this problem intermittently for a few months now for business to business email - nothing dodgy. We are on routing via eircom smart host.

Generally the pattern is
1. I can send an email to a customer
2. Customer replies
3. I reply or forward to other customer and email gets blocked. The 3rd email is bounced from either by

The following organization rejected your message: avas03.vendorsvc.cra.dublin.eircom.net.

or

The following organization rejected your message: avas01.vendorsvc.cra.dublin.eircom.net.

and states

avas03.vendorsvc.cra.dublin.eircom.net #552 5.2.0 9paP1f00v4YBZim01paSq0 Abusive content detected in your email ##

I contacted eircom a few months ago and the reponse was, "nothing wrong here" no mention of a new filter. I noted the suggestion that hyperlinks in email could cause this, are they suggesting that I ask my customers to change their email footers

In relation to the brackets issue, thats a puzzle, as my Outlook client automatically puts in the name and brackets format, and the initial email gets through.

Anyone have any more info?
Thanks,
Conor.

jchayes · 22-09-2010 3:44pm

eircom asked me to send on the email samples, guess what happened....

phill106 · 23-09-2010 2:53pm

jchayes wrote: »

eircom asked me to send on the email samples, guess what happened....

hehe maybe fax them in

They have been having this issue for months, I find it hilarious.

jchayes · 23-09-2010 3:30pm

From eircom support: "When hyperlink is blacklisted any email containing it will be blocked on our antispam filter and email can not be sent through our mail server. Once hyperlink is whitelisted emails should go through normally." so it seems that most/all hyperlinks are blocked by default, as you can't blacklist everything, pretty remedial I would say...

phill106 · 23-09-2010 9:21pm

jchayes wrote: »

From eircom support: "When hyperlink is blacklisted any email containing it will be blocked on our antispam filter and email can not be sent through our mail server. Once hyperlink is whitelisted emails should go through normally." so it seems that most/all hyperlinks are blocked by default, as you can't blacklist everything, pretty remedial I would say...

So are all hyperlinks blocked or just a list of them? Do they provide a list?
What is the address to submit whitelisted emails to? Lead time? Seems like a load of codswallop, as alot of people i talk to are having problems sending attachments, but if they send the same mail with no file, it goes through fine.

kangaroo · 02-04-2011 2:06am

This thread came up when I did a search for a problem I had.

Anyway, I eventually isolated the problem that it was the following link:
http://bit.ly/hAvLon that was the problem.

I'd lots of other bit.ly links in the e-mail so don't know what it was about this one that did it.

Anyway this thread proved useful -thanks.

Capt'n Midnight · 02-04-2011 10:44am

kangaroo wrote: »

This thread came up when I did a search for a problem I had.

Anyway, I eventually isolated the problem that it was the following link:
http://bit.ly/hAvLon that was the problem.

I'd lots of other bit.ly links in the e-mail so don't know what it was about this one that did it.

Anyway this thread proved useful -thanks.

sounds like there is an overzealous scanner somewhere there

userindublin · 05-05-2011 11:25am

kangaroo wrote: »

This thread came up when I did a search for a problem I had.

Anyway, I eventually isolated the problem that it was the following link:
http://bit.ly/hAvLon that was the problem.

I'd lots of other bit.ly links in the e-mail so don't know what it was about this one that did it.

Anyway this thread proved useful -thanks.

This url sends me to: http://www.imt.ie/clinical/2011/03/cognitive-behavioural-therapy-not-harmful-in-chronic-fatigue.html

Can you post the intended url; we have a customer who's experiencing this exact same problem.

Cheers,

GKS

kangaroo · 05-05-2011 11:57am

userindublin wrote: »

kangaroo wrote:

This thread came up when I did a search for a problem I had.

Anyway, I eventually isolated the problem that it was the following link:
http://bit.ly/hAvLon that was the problem.

I'd lots of other bit.ly links in the e-mail so don't know what it was about this one that did it.

Anyway this thread proved useful -thanks.

This url sends me to: http://www.imt.ie/clinical/2011/03/cognitive-behavioural-therapy-not-harmful-in-chronic-fatigue.html

Can you post the intended url; we have a customer who's experiencing this exact same problem.

Cheers,

GKS

I'm not sure if you're thinking I made an error. I help run a patient organisation for ME/CFS so that was the correct URL.

userindublin · 05-05-2011 12:26pm

kangaroo wrote: »

I'm not sure if you're thinking I made an error. I help run a patient organisation for ME/CFS so that was the correct URL.

Laughs! Yes, after I had my coffee & reread your post, I twigged your meaning! I thought it might be a url to an explanation & resolution - I think the coffee helped get the brain fizzing properly.
GKS

Liam Byrne · 14-07-2011 2:55pm

I'm getting this "abusive content detected" lie when replying to emails (even with a one-line reply) so I'm assuming that eircom's mail server is objecting to the content that they had already sent me (which is included in the reply) even though it's not abusive ?

It also seems to happen more frequently if there's a web link in the email (which they sometimes have in their sigs) even if said website isn't in any way "abusive" or dodgy.

Can eircom sort this out ?

kangaroo · 15-07-2011 4:02am

Liam Byrne wrote: »

I'm getting this "abusive content detected" lie when replying to emails (even with a one-line reply) so I'm assuming that eircom's mail server is objecting to the content that they had already sent me (which is included in the reply) even though it's not abusive ?

It also seems to happen more frequently if there's a web link in the email (which they sometimes have in their sigs) even if said website isn't in any way "abusive" or dodgy.

Can eircom sort this out ?

I end up sending quite a few messages from gmail because of this sort of general problem. It's not ideal for me as my main address book is in Outlook.

Email Bounce backs

Comments