topic Re: Sent emails bounced with 'Nemesis' problem in Email

Sent emails bounced with 'Nemesis' problem

jayef — Sat, 10 Feb 2018 12:59:25 GMT

Over the last 24 hours I have had emails to two contacts bounced multiple times. They are contacts I have been emailing successfully & regularly for a number of years. Emails to other contacts seem to be delivered OK.

The initial bounced email had PDF & XL attachments but since then even a simple text 'testing' email is bounced.

I am using a personalised email address registered through my web host (like john@myname.org.uk) but I am using relay.plus.net as my outgoing mail server. I have been using this setup for about 4 years and it has mainly worked OK until now.

Any insight or suggestions please. I am puzzled as to what is happening and why only on two unconnected emails. I though maybe it would fix itself but it's been happening for over 24 hours now.

The emails are returned with a message like this: (I've removed the actual names)

Reporting-MTA: dns; avasout02 [212.159.14.17]
Received-From-MTA: dns; Jonxxx [99.999.99.99]
Arrival-Date: Sat, 10 Feb 2018 11:42:41 +0000

Final-recipient: rfc822; xxxxxx@iname.com
Diagnostic-Code: smtp; 554-mail.com (mxgmxus007) Nemesis ESMTP Service not available

Last-attempt-Date: Sat, 10 Feb 2018 11:42:41 +0000

The other email is xxx@gmx.co.uk

Re: Sent emails bounced with 'Nemesis' problem

Geoff1942 — Mon, 12 Feb 2018 17:16:00 GMT

I have the identical problem. It appears to be because the remote server i.e. at the email recipent's ISP, is considering all emails from plusnet as spam. This could be due to abnormally high traffic levels at plusnet, or an error in the DNS code. The latter seems unlikely since we can send to some recipients.

It would be good to have some response from customer support, but i am not hopeful !

Re: Sent emails bounced with 'Nemesis' problem

washboardmac — Wed, 14 Feb 2018 15:43:30 GMT

Hi Folks

Yes I'm getting this too, specifically with a mail.com contact. On Monday the email went after 3 resends but not today.

I contacted mail.com, received an automated reply asking me to send the error details, which I did and relay.plus.net then rejected me for sending spam!!!.

Someone from plusnet will read this and reply - they've always been good in the past.

Andy

Re: Sent emails bounced with 'Nemesis' problem

steve_arnold — Wed, 14 Feb 2018 16:58:53 GMT

Just to add I'm am also having trouble sending to GMX, on Monday emails went at the second attempt but since then all have bounced. My ip address is a static one issued by Plusnet.

Steve

Re: Sent emails bounced with 'Nemesis' problem

jayef — Wed, 14 Feb 2018 17:29:23 GMT

Just to update, as the original poster, ... The problem emails eventually started going through after about 48 hours. Still no idea why they stopped or why they restarted! The problem has not recurred to date

Re: Sent emails bounced with 'Nemesis' problem

steve_arnold — Wed, 14 Feb 2018 18:28:10 GMT

Unfortunately still not working for me, I've done some checking and apparently my ip in the 80.229.x.x range is on the Spamhaus Zen PBL list, as I only use normal email software and don't run a mailserver I take it Plusnet need to put in the request to have it removed from the list and not me.

Steve

Re: Sent emails bounced with 'Nemesis' problem

Strat — Wed, 14 Feb 2018 18:57:21 GMT

My 80.229.xxx.xxx IP has been on that list for many months now. I did ask if it could be remover but was advised that it shouldn't cause any issues unless I start to run a mail server.

Re: Sent emails bounced with 'Nemesis' problem

washboardmac — Wed, 14 Feb 2018 19:05:31 GMT

I'm running a mail server on a Synology NAS and it tells me it's on 91.x.x.x,which is not on the spamhaus. I guess that's good but it still no work!

Re: Sent emails bounced with 'Nemesis' problem

washboardmac — Wed, 14 Feb 2018 19:06:45 GMT

Forgot to add. To/from Gmail and my own domain working fine.

Re: Sent emails bounced with 'Nemesis' problem

steve_arnold — Wed, 14 Feb 2018 20:29:16 GMT

I've contacted GMX I'll report back what they say.

Steve

Re: Sent emails bounced with 'Nemesis' problem

steve_arnold — Thu, 15 Feb 2018 15:11:08 GMT

Reply from GMX just received:

Dear Steve,

Thank you for your message.

It seems that emails from this email server were rejected because the PTR Resource Record (PTR-RR) of the IP address does not follow our guidelines. Possible reasons for this can be:

- The PTR-RR states that the IP address was dynamically allocated.
- The PTR-RR is a generic standard entry of your provider. Please allocate an independent and fully qualified domain name (Fully Qualified Domain Name - FQDN) to your email server and enter the corresponding valid PTR-RR.
- Individual rejection of the PTR-RR for system protection reasons.

Please contact the administrator of this system who should then contact our Postmaster at: https://postmaster.gmx.com/en/contact

Best regards.

Your mail.com Support Team

Hope that means something to someone as it's completely over my head.

Steve

Re: Sent emails bounced with 'Nemesis' problem

spraxyt — Thu, 15 Feb 2018 17:31:17 GMT

@steve_arnold GMX refer to "this email server"; if you use a standard email client that isn't an email server so they shouldn't be referring to your IP. Your email client should be configured to send emails via relay.plus.net which *is* an email server and that server carries out authentication to validate you before passing the email to the GMX server.

From your earlier comments it seems sometimes GMX accept emails sent via relay.plus.net, sometimes they don't. Do you have the headers from a returned message that they rejected? Generally these are embedded in the body of the rejection message.

Re: Sent emails bounced with 'Nemesis' problem

steve_arnold — Thu, 15 Feb 2018 17:40:58 GMT

Content of last bounce, emails redacted:

 This is an automatically generated Delivery Status Notification. 

Delivery to the following recipients failed permanently:

 * @xxxxxx@gmx.co.uk

Reason: A message that you sent to the following recipient could not be delivered due to a permanent error. ** The remote server ?? responded with: ** xxxxxx@gmx.co.uk ??:?? This message was created automatically by mail delivery software on the server .



Reporting-MTA: dns; avasout04 [212.159.14.19]
Received-From-MTA: dns; [192.168.1.100] [80.229.xxx.xxx]
Arrival-Date: Wed, 14 Feb 2018 19:16:58 +0000


Final-recipient: rfc822; xxxxxx@gmx.co.uk
Diagnostic-Code: smtp; 554-gmx.net (mxgmx017) Nemesis ESMTP Service not available

Last-attempt-Date: Wed, 14 Feb 2018 19:16:58 +0000




Received: from [192.168.1.100] ([80.229.xxx.xxx])
 by smtp with ESMTP
 id m2Y5eyBntlfqam2Y6elNyE; Wed, 14 Feb 2018 19:16:58 +0000
X-CM-Score: 0.00
X-CNFS-Analysis: v=2.3 cv=JdWSU3CV c=1 sm=1 tr=0
 a=PAEqQyJP2UmHTn95Mvzntw==:117 a=PAEqQyJP2UmHTn95Mvzntw==:17
 a=IkcTkHD0fZMA:10 a=6k3yiS8A-Q29w6Ng7soA:9 a=QEXdDO2ut3YA:10
To: xxxxx <xxxxxxxx@gmx.co.uk>
From: xxxxx <xxxx@xxxxxx.plus.com>
Subject: another test
Message-ID: <8bd6bc09-1909-d4ff-3569-648d544c76f1@xxxxxx.plus.com>
Date: Wed, 14 Feb 2018 19:16:58 +0000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.6.0
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-GB
X-CMAE-Envelope: MS4wfM5H534LFg3tDhU/XY1fpKW6vaT9Q9aCU0Tj0547NUOFFFRI0tJYfMY0Y6iXbQbWWygDCaseA2qZTuBKD2twgbe0cYfiUrZQZHS/qNXIxB4S9uTTBoc0
 jUCMWksn3OjaktAjnXWhZFg6O2sIoUhjZAYUK+EgjwhwCW9MGvK24hbtLjJx5ByHK+YQLJoE3Zxwng==

Re: Sent emails bounced with 'Nemesis' problem

spraxyt — Thu, 15 Feb 2018 20:18:09 GMT

@steve_arnold Thanks, in context it's a bit easier to work out where the messages originate but some knowledge of how the process works helps.

Because the GMX server refuses to accept the messages the Plusnet MTA, avasout04.plus.net, trying to deliver it to them can only return it to you. The message came from you so that is what avasout04 reports as 'received-from'.

The message would be offered to GMX by avasout04, which should have identified itself to them as avasout04.plus.net with the IP 212.159.14.19. If we look that up using its URL and in reverse via its IP we get

C:\>nslookup avasout04.plus.net
Server:  dsldevice.lan
Address:  fe80::9e97:26ff:fe94:acb8

Non-authoritative answer:
Name:    avasout04.plus.net
Address:  212.159.14.19


C:\>nslookup 212.159.14.19
Server:  dsldevice.lan
Address:  fe80::9e97:26ff:fe94:acb8

Name:    avasout04.plus.net
Address:  212.159.14.

Both forward and reverse look-ups match so I would expect GMX to accept the message. Not doing so suggests they do not trust avasout04.plus.net (or whichever avasoutnn is used) - have they confirmed that?

Re: Sent emails bounced with 'Nemesis' problem

steve_arnold — Thu, 15 Feb 2018 20:43:12 GMT

Hi,

Post 11 was a copy and paste of the complete reply, I've now replied to them asking if they don't trust avasout04.plus.net, I've checked all the bounces I've received and they all refer to avasout04.plus.net.

Steve

Re: Sent emails bounced with 'Nemesis' problem

SpinDryer — Thu, 15 Feb 2018 20:58:38 GMT

@steve_arnold wrote:

Unfortunately still not working for me, I've done some checking and apparently my ip in the 80.229.x.x range is on the Spamhaus Zen PBL list,

Steve

All dynamic IP addresses will be on various blocklists, and this applies to all ISPs. That's to help users of blocklists stop spam due to botnets use of smtp services on infected computers. Using the ISP smarthost (in this case relay.plus.net) should be fine.

There is actually nothing to remove.

Re: Sent emails bounced with 'Nemesis' problem

steve_arnold — Thu, 15 Feb 2018 21:21:47 GMT

Hi,

My IP is a static one that I've had for all the years I've been with Plusnet.

Steve

Re: Sent emails bounced with 'Nemesis' problem

spraxyt — Thu, 15 Feb 2018 22:09:45 GMT

Both end-user dynamic and static IPs are on the PBL This reflects the

Outbound Email Policy of Plusnet Plc for (the relevant) IP range:

It is the policy of Plusnet Plc that unauthenticated email sent from this IP address should be sent out only via the designated outbound mail server allocated to Plusnet Plc customers. To find the hostname of the correct mail server to use, customers should consult the original signup documentation or contact Plusnet Plc Technical Support.

If using deep parsing of Received headers the guidance from Spamhaus is that reference to the PBL is *not* appropriate. If GMX do such deep parsing and respect that advice discussion of PBL content becomes irrelevant.

Re: Sent emails bounced with 'Nemesis' problem

washboardmac — Fri, 16 Feb 2018 11:55:02 GMT

Hi Folks

All's that's been discussed is the same as my problem; same error situation, same error message.

So as my NAS is configured to send through relay,plus.net then the problem is not my end, yes? Am I right in thinking that to the recipient (and their mail account) my mail server is not in question? Are the recipients' servers parsing too deeply or is relay.plus.net 'untrustworthy'?

I don't use the 'offending' email address much but when I do I need reliability.

So what's next then?

Andy

Re: Sent emails bounced with 'Nemesis' problem

spraxyt — Sun, 18 Feb 2018 12:45:32 GMT

Yes, that's correct. the recipient mail server should make whatever checks it wishes to do against the transmitting MTA (Mail Transfer Agent). This will be an avasoutNN.plus.net with matching IP for external MTAs. NN represents two digits. Normally the reputations of these servers is good and Plusnet would take action to fix the problem if any got blacklisted. Transmitting MTA IPs will never appear in the PBL (Policy Block List).

For internal recipients transmitting MTA IP reflects an infrastructure path, but that should never be an issue.

If receiving MTAs choose to do deeper parsing of Received headers, and check the Received header for the mail submission agent, care is needed. The content of that depends on which agent is used. Thunderbird provides the internal IP address whereas Outlook 2016 provides the computer name. These are accompanied by the WAN IP of the external connection. The reverse and forward DNS entries for WAN IPs normally match as far as I'm aware, but the IPs are likely to appear in the PBL because they should *not* be contacting external mail servers directly.

When using an internal mail server smart-hosting via relay.plus.net that internal server becomes the submission agent onto the WAN.