Can't send email to Plusnet / Metronet / Force9 etc

[#1]

Hey All

I provide VPS services and I have a customer who has a lot of friends on Plusnet and Metronet.
Sadly he can't email and of them because the Plusnet servers seem to refuse a connection from our server.

Eventually the email comes  back... see the content below.

I checked our server on all the spam balcklists and Ironport and it does not have a bad reputation.
To me it looks like Plusnet may have  blocked the entire IP subnet but I have no idea how to request it to be unblocked.

Thanks for any help you can provide.

(email addresses redacted, our server IP is 87.239.20.242

<xxx@hillsidetelecom.co.uk>: connect to

    mx.avasin.plus.net[212.159.9.200]:25: Connection timed out

<xxx@neurosys.co.uk>: connect to mail1.metronet.co.uk[213.162.97.76]:25:

    Connection timed out

<xxx@metronet.co.uk>: connect to

    mx-trial.last.plus.net[212.159.8.200]:25: Connection timed out

<xxx@icscotland.net>: connect to

    mx-ironport.last.plus.net[212.159.9.200]:25: Connection timed out

[#2]

Any chance you can provide a trace to our servers (212.159.8.200) from the VPS?

[#3]

I can but not sure it is very helpful

traceroute to 212.159.8.200 (212.159.8.200), 30 hops max, 60 byte packets
1 109.109.140.14 (109.109.140.14) 0.036 ms 0.016 ms 0.012 ms
2 ge-0-3-0-8.man1.as8553.net (195.10.244.121) 0.596 ms 0.585 ms 0.588 ms
3 xe-0-0-0.lon1.as8553.net (195.10.255.69) 7.143 ms 7.132 ms 7.110 ms
4 195.66.224.185 (195.66.224.185) 7.861 ms 7.870 ms 7.885 ms
5 core3-BE5.faraday.ukcore.bt.net (213.121.193.178) 8.015 ms 195.99.127.86 (195.99.127.86) 8.071 ms 8.080 ms

and after that it is just * * *

I get a very similar trace when i do it from my connection here which is on Zen.

Thanks very much for responding, hope this helps.

[#4]

For information, traceroute from the usertools server to 212.159.8 or 9.200 also ends in Faraday or Colindale.

ICMP probes

traceroute to 212.159.8.200 (212.159.8.200), 30 hops max, 60 byte packets
 6  peer1-Xe3-3-2.telehouse.ukcore.bt.net (109.159.253.46)  3.193 ms  2.919 ms  2.827 ms
 7  core3-te0-0-0-14.faraday.ukcore.bt.net (213.121.193.160)  2.697 ms  3.875 ms  3.808 ms
 8  * * * onwards

UDP probes

traceroute to 212.159.8.200 (212.159.8.200), 30 hops max, 60 byte packets
 6  peer1-Xe3-3-2.telehouse.ukcore.bt.net (109.159.253.46)  2.969 ms  3.003 ms  3.316 ms
 7  core2-hu0-18-0-0.colindale.ukcore.bt.net (62.172.103.16)  3.995 ms
    core3-hu0-3-0-0.faraday.ukcore.bt.net (213.121.193.160)  2.410 ms
    core2-hu0-18-0-0.colindale.ukcore.bt.net (62.172.103.16)  3.774 ms
 8  * * * onwards

However the email MTA on that server is able to deliver messages to Plusnet and Force9 addresses.

Tracing from my home connection does reach the target, but stays within the Plusnet network.

[#5]

Was anyone able to help with this?

I have had no joy at all speaking to support.

[#6]

So I wrote to customer services by letter about this... and still no response!

Does anyone know a good contact for escalations / complaints who can actually check these things?

[#7]

Apologies, lost track of this thread.

The trace doesn't really tell us much. Turns out we now block external ICMP probes to Sheffield-hosted services from outside of our network.

Looks like you have access to a *nix command line. What happens if you try a tcptrace across port 25? e.g

~$ sudo tcptraceroute mx.avasin.plus.net 25
traceroute to mx.avasin.plus.net (212.159.9.200), 30 hops max, 60 byte packets
 1  R7000P.local (192.168.1.254)  8.825 ms  8.548 ms  8.333 ms
 2  lo0.10.central10.pcl-bng01.plus.net (195.166.130.138)  17.678 ms  17.465 ms  17.229 ms
 3  irb.10.PCL-CR02.plus.net (84.93.249.82)  16.980 ms irb.10.PCL-CR01.plus.net (84.93.249.81)  17.111 ms  16.538 ms
 4  ae2.pcl-cr01.plus.net (195.166.129.6)  16.669 ms po2.pcl-gw01.plus.net (195.166.129.41)  16.255 ms ae2.pcl-cr01.plus.net (195.166.129.6)  15.975 ms
 5  84-93-224-48.plus.net (84.93.224.48)  23.316 ms  23.096 ms po2.pcl-gw01.plus.net (195.166.129.41)  15.276 ms
 6  84-93-224-48.plus.net (84.93.224.48)  22.663 ms  24.670 ms  24.138 ms
 7  mx.avasin.plus.net (212.159.9.200) <syn,ack>  23.642 ms  24.085 ms 84-93-224-36.plus.net (84.93.224.36)  23.551 ms

I also assume you're unable to telnet to our mail servers from the VPS?

telnet mx.avasin.plus.net 25

I've checked the obvious places where access would be blocked and am drawing blanks at the moment. Have there been some recent attempts to send email because I've asked somebody to trawl the MTA logs for me and look for any connection attempts?

[#8]

Thanks Bob - Really appreciate you coming back to me!

Traceroute as follows:

Selected device venet0, address 87.239.16.2, port 47180 for outgoing packets
Tracing the path to mx.avasin.plus.net (212.159.8.200) on TCP port 25 (smtp), 30 hops max
 1  109.109.140.14  0.094 ms  0.029 ms  0.020 ms
 2  ge-0-3-0-8.man1.as8553.net (195.10.244.121)  3.266 ms  0.444 ms  0.387 ms
 3  xe-0-0-0.lon1.as8553.net (195.10.255.69)  6.972 ms  6.931 ms  6.993 ms
 4  195.66.224.185  7.820 ms  7.928 ms  7.605 ms
 5  core3-BE5.faraday.ukcore.bt.net (213.121.193.178)  8.430 ms  8.401 ms  9.319 ms
 6  lo0.pcl-cr02.plus.net (195.166.128.4)  8.825 ms  8.464 ms  8.063 ms
 7  ae1.ptw-cr02.plus.net (195.166.129.2)  8.241 ms  7.847 ms  7.901 ms
 8  ae2.ptw-cr01.plus.net (195.166.129.4)  8.392 ms  8.726 ms  8.975 ms
 9  te9-4.ptn-gw01.plus.net (195.166.129.33)  9.031 ms  9.652 ms  8.906 ms
10  * * *

Telnet i get no response as follows:

-bash-4.1$ telnet mx.avasin.plus.net 25
Trying 212.159.9.200...

The last attempt i know of was Sent: 03 October 2016 20:20
I can let you know the specific email addresses if that helps.

Thanks again

[#9]

Thanks, that's very helpful. I'll see what I can determine, however it's not likely to be until next week now.

[#10]

That is amazing thank you! 

Will get a new email sent on Sunday and let you know details to help track down the issue.

My assumption is that our server IP is blacklisted and the logs wont show anything because we never establish a connection in order to deliver the email in the first place.

Very excited to be getting some help

[#11]

---

@speakdigital wrote:

My assumption is that our server IP is blacklisted and the logs wont show anything because we never establish a connection in order to deliver the email in the first place.

I'm inclined to agree. I've a suspicion there's going to be a manual block somewhere in our core network. Have asked somebody to take a look so I'll let you know once I've some answers...

[#12]

Any joy Bob? I inboxed you the mail logs from our server so hopefully you have all you need.

Would be great if they come up with something and we can get this put to bed.

Thanks

Ben Konyn

[#13]

Still looking into it Ben, can you just confirm that a tcptrace to 212.159.8.200 returns the same result as that from message 8 above? ^

[#14]

Hi Bob

See result here:

Selected device venet0, address 87.239.16.2, port 36325 for outgoing packets Tracing the path to 212.159.8.200 on TCP port 25 (smtp), 30 hops max
 1  109.109.140.14  0.082 ms  0.024 ms  0.015 ms
 2  195.10.244.121 (195.10.244.121)  1.236 ms  0.477 ms  0.452 ms
 3  xe-0-0-0.lon1.as8553.net (195.10.255.69)  7.097 ms  6.968 ms  7.035 ms
 4  195.66.224.185  7.639 ms  7.365 ms  7.616 ms
 5  core3-BE5.faraday.ukcore.bt.net (213.121.193.178)  9.063 ms  9.335 ms  9.212 ms
 6  lo0.pcl-cr02.plus.net (195.166.128.4)  8.487 ms  8.171 ms  8.351 ms
 7  ae1.ptw-cr02.plus.net (195.166.129.2)  8.307 ms  7.907 ms  7.920 ms
 8  ae2.ptw-cr01.plus.net (195.166.129.4)  8.496 ms  8.493 ms  8.462 ms
 9  te9-4.ptn-gw01.plus.net (195.166.129.33)  9.137 ms  10.088 ms  9.322 ms
10  * * *
11  * * *

Thanks again for what you are doing.

[#15]

Sorry, it was actually the 212.159.9.200 I meant to ask you to trace to. Can you confirm that a trace to this address dies at the same place?

We have an internal incident raised to investigate further, and I'll let you know as soon as we've managed to make some progress (ref: 95072).

Apologies for the continued hassle.