Email Bounce backs

Schmike · 21-07-2010 2:52pm #1

Anyone getting anything like these

Your message did not reach some or all of the intended recipients.
Subject: Re: (Subject)

Sent: 21/07/2010 13:19
The following recipient(s) could not be reached:
(name) on 21/07/2010 13:20
The message reached the recipient's e-mail system, but delivery was refused. Attempt to resend the message. If it still fails, contact your system administrator.
<(Server name).(domian name) .local #5.2.0 smtp;552 5.2.0 kcFD1e0194PHs5i01cFGEd Abusive content detected in your email>

Seen this on a few sites in the passed week or so.

Fysh · 21-07-2010 2:57pm

.......

Email bouncebacks are a pain in the arse to troubleshoot if you don't have the sender's details, the logs from the mailserver they're sending the message through, and a copy of the original message.

Given the triviality of spoofing a source address, a lot of bouncebacks are actually generated by spoofed spam messages.

Schmike · 21-07-2010 3:03pm

Hi Fysh,

It's very hard to track down. Just seen a high volume of the same issue in the passed few days. Different email setup’s Exchange, Mdaemon and pop. The mail seems to go out fine and some comes in. No blacklist issues or anything. Can’t see the other side to see why.

Fysh · 21-07-2010 3:24pm

In the absence of any other evidence, I'd say it's most probably a spike in the amount of spam mail spoofing its source address as your domain.

ressem · 21-07-2010 11:11pm

The other thing that pops up at this time of year is holiday time.

If your spam filter isn't external, and you're the admin the reason you're seeing these messages could be spam being sent to a mail account with out of office enabled, and your server attempting to send out of office messages to false addresses.

matt-dublin · 27-07-2010 1:37pm

Abusive content detected in your email

did you say a curse word in your email, or send a dodgy picture?

jamesd · 27-07-2010 2:26pm

matt-dublin wrote: »

Abusive content detected in your email

did you say a curse word in your email, or send a dodgy picture?

I was getting this lately on a domain I look after, I removed a hyperlink from their email signature and solved.

matt-dublin · 27-07-2010 4:54pm

yeah it looks like something in the mail that was sent is being blocked by some form of mail scanning software at the far end.

The message reached the recipient's e-mail system, but delivery was refused : it got to the door but wasn't allowed in...

smtp;552 5.2.0 kcFD1e0194PHs5i01cFGEd Abusive content detected in your email> ; suggest that either a picture, word or a link in the email containf some form of profanity and was blocked.

phill106 · 29-07-2010 4:20pm

I work in a hosting company and the increase in last few months of people having same issue is huge. Generally people who send out through eircom and are getting blacklisted left right and centre.

matt-dublin · 29-07-2010 5:12pm

phill106 wrote: »

I work in a hosting company and the increase in last few months of people having same issue is huge. Generally people who send out through eircom and are getting blacklisted left right and centre.

generally because eircom is an open relay.

you can send an email from anyone's email address to anyone's email address using eircom.net's smtp server.

the only company i have seen that hasn't blacklisted eircom recently is ironport although we do sometimes have difficulty getting eircom.net mails through our ironport servers at times.

@eircomnet : start using SMTP auth on your relay servers!

Hal1 · 31-07-2010 2:31pm

Get the person your sending to, to add you on the whitelist on their spam filter.

david.dalton · 12-08-2010 6:45pm

in July Eircom changed the eMail filtering software they use. This has resulted in a huge increase in the number of false positive "Abusive Content" mails being bounced from their servers. What is happening is that the scanners are reading through the incoming mail and mis-interperating some of the text as abusive content. I have spent many hours since last week in July trying to work through this problem with their support team but as yet do not have any result. Pushing your mail through their smart host mail1.eircom.net makes no difference as the mail is still scanned by the faulty scanner.

Come on Eircom... Admit the problem and get it fixed...

RoadKillTs · 13-08-2010 1:10pm

I had this on a customers pc yesterday. Think it was linked to a malware issue.

testicle · 18-08-2010 11:42am

matt-dublin wrote: »

generally because eircom is an open relay.

Eircom haven't been an open relay for about 10 years!

mollyware · 19-08-2010 9:43am

We are running SBS 2003 and have started to see the same problem in the last few days. Oddly enough only mails with 2 attachements or more get stopped. Remove the attachements and it goes through fine. david.daltons post on new filtering software being used by Eircom is worring. If this is the case how does one go about getting this changed. I've changed exchange back to routing email through DNS from mail1.eircom.net and will monitor the issue.

The message received in the NDR is:-
domain.ie #5.2.0 smtp;552 5.2.0 w75b1e0120jTFrn0175eAH Abusive content detected in your email>

matt-dublin · 20-08-2010 4:26pm

u sure about that? give me your email address and ill send you an email from your mail address from mail1.eircom.net

testicle · 22-08-2010 9:24pm

matt-dublin wrote: »

u sure about that? give me your email address and ill send you an email from your mail address from mail1.eircom.net

Certain, what you are describing isn't an open relay. What would be an open relay would be if I were able to do as you describe - I'm not an Eircom customer.

matt-dublin · 23-08-2010 8:56pm

You can send an email anyone@anywhere.com using mail.Eircom.net as an smtp server.

I am 100% sure of this being an open relay, with 10 years plus in high level IT and email systems administration I'm quite confident I'm right.

Give me ur address and il send u an email from bill gates using eircoms mail server!!

RoadKillTs · 23-08-2010 9:29pm

Hi Matt,

Why would Eircom be using an open-relay? Thats unheard of these days with the amount of spam going around.

My ISP is Magnet and I changed my outgoing server to "mail1.eircom.net" but I am getting an "Outlook is unable to connect to your SMTP server" error.

matt-dublin · 23-08-2010 9:32pm

Use mail.Eircom.net

RoadKillTs · 23-08-2010 9:37pm

I tried that one aswell.

I also check the server here

Test mail relay
To:<spammer@spam.vancouver-webpages.com> .. 550 5.1.1 Relaying denied to domain spam.vancouver-webpages.com
To:<http@vancouver-webpages.com> .. 550 5.1.1 Relaying denied to domain vancouver-webpages.com
To:<http@vancouver-webpages.com@mail.eircom.net> ..550 5.5.0 malformed address: @mail.eircom.net> may not follow

matt-dublin · 24-08-2010 9:48am

That's new!!!

testicle · 24-08-2010 12:59pm

matt-dublin wrote: »

You can send an email anyone@anywhere.com using mail.Eircom.net as an smtp server.

Yes, I know. As long as you are on an eircom IP. This is not an open relay.

matt-dublin wrote: »

I am 100% sure of this being an open relay, with 10 years plus in high level IT and email systems administration I'm quite confident I'm right.

Big Swinging Mickey. You're still wrong.

matt-dublin wrote: »

Give me ur address and il send u an email from bill gates using eircoms mail server!!

Sure, anyone can do it, as long as they are on an eircom IP.

matt-dublin wrote: »

That's new!!!

It stopped being an open relay, as I said, many (about 10) years ago.

leokearns · 27-08-2010 10:40am

Remove all email address links and hyperlinks in any footers and it should go through ok.

Eircom aware of the filter issue but disconnect me each time we call.:)

Regards
Leo Kearns

phill106 · 30-08-2010 2:28pm

Just to reassure people, this is still happening to lots of people using eircoms smtp service. No fix as of yet.

bhickey · 30-08-2010 2:31pm

phill106 wrote: »

Just to reassure people, this is still happening to lots of people using eircoms smtp service. No fix as of yet.

When it happens, can you check your external IP on the RBL blacklists to see if that might have anything at all to do with it? You can check at MX Toolbox.

phill106 · 06-09-2010 11:45am

bhickey wrote: »

When it happens, can you check your external IP on the RBL blacklists to see if that might have anything at all to do with it? You can check at MX Toolbox.

Its not actually happening to me, Just to people i support. Invariably they are on some blacklist, but who isnt on some blacklist these days!

bhickey · 06-09-2010 11:50am

phill106 wrote: »

....but who isnt on some blacklist these days!

True but it would still be useful to check, if only to get an indication that this could be what's causing the problem. If one ISP (e.g. Eircom) consistently suffers from this and another ISP doesn't then well at least you have an option.

estrella_ · 07-09-2010 5:45pm

We send our office emails through mail1.eircom.net and today suddenly can no longer send any emails that contain a web link. We are getting the same error "5.2.0 3sRe1f00g0k9Q4e01sRhYi Abusive content detected in your email"

The links we are sending are work related and not dodgy or spam related.

I have contacted Eircom support but not expecting them to quickly resolve the issue.

Has anyone found a way around this?

thanks.

bhickey · 07-09-2010 5:52pm

Any chance you could check your external IP address at MX ToolBox to see if it is currently blacklisted?

STForSale · 14-09-2010 12:01pm

We've had problems for over a month now trying to deliver to eircom addresses. Started off with addresses containing apostrophises failing. Now we're also seeing the abusive content NDR when message clearly has no abusive content.

Never ceases to amaze me how people try to run a business using an eircom mail account

Email Bounce backs

Comments