Plusnet Email servers giving random SMTP 550 errors for inbound emails

[#1]

OK, long-term PN customer here trying to fault-find an issue that may have cropped up in the last month.

Symptom: was noticing that people were claiming they'd sent email but I wasn't receiving them. Other emails from the same senders around the same time were being received OK. These included valid emails from a car hire company, a bank, Microsoft, yahoo groups, etc.

I have my own domain and use DuoCircle to forward to a PN account.

After noticing that some email didn't appear to be being received I checked the DuoCircle logs and noticed that in November the PN email servers had rejected 44 otherwise valid non-junk emails that DuoCircle had already checked for spam (including SPF checks).

An example of PN's reject message from the DuoCircle log is:-

Nov 22 14:45:31 (info) mailqueued: [c4cb7cd7-cf93-11e7-bb08-3194f007ca3e] [224293144] Delivering message to ycreighton.plus.com:25
Nov 22 14:45:31 (info) mailqueued: [c4cb7cd7-cf93-11e7-bb08-3194f007ca3e] [224293144] Connecting to [212.159.8.200]:25
Nov 22 14:45:34 (warning) mailqueued: [c4cb7cd7-cf93-11e7-bb08-3194f007ca3e] [224293144] SMTP error: 550 (#5.1.8 Domain of sender address <duo-srs0=1ppp=cu=europcar.com=noreply@mx1.mailhop.org> does not exist) expected 250 (CMD_MAIL_FROM)
Nov 22 14:45:34 (warning) mailqueued: [c4cb7cd7-cf93-11e7-bb08-3194f007ca3e] [224293144] Sender not accepted by server <duo-srs0=1ppp=cu=europcar.com=noreply@mx1.mailhop.org> (aborting)
Nov 22 14:45:34 (info) mailqueued: [c4cb7cd7-cf93-11e7-bb08-3194f007ca3e] [224293144] Delivery failed to <mike@ycreighton.plus.com> (retry 0, in 00:00:02.946): SMTP error: 550 #5.1.8 Domain of sender address <duo-srs0=1ppp=cu=europcar.com=noreply@mx1.mailhop.org> does not exist
Nov 22 14:45:34 (info) mailqueued: [c4cb7cd7-cf93-11e7-bb08-3194f007ca3e] [224293144] SMTP error is permanent: no more tries

Anyone else seeing anything similar? Have turned off all SPAM checking on the account now to see if it cures the problem.

Also how the hell are you supposed to raise a support call these days as describing the above over the phone isn't going to be easy!

[#2]

That looks to me like DuoCircle were doing something odd with the sender address of the forwarded emails. Our servers were rejecting the messages because they weren't being seen as having originated from a valid sender domain.

[#3]

Thanks for looking Bob.

It's strange as other emails (even from the same sender) are getting through. Here's another log excerpt - it gives the same initial error but the PN server returns a 452, and the subsequent re-try then works. To my untrained eye the sender format is the same?

If you think this is working as expected I'll raise it with DuoCircle support.

Nov 22 16:09:53 (info) mailqueued: [7ae265ff-cf9f-11e7-87ab-4ded5281c9b1] [229029656] Delivering message to ycreighton.plus.com:25
Nov 22 16:09:53 (info) mailqueued: [7ae265ff-cf9f-11e7-87ab-4ded5281c9b1] [229029656] Connecting to [212.159.8.200]:25
Nov 22 16:09:59 (warning) mailqueued: [7ae265ff-cf9f-11e7-87ab-4ded5281c9b1] [229029656] SMTP error: 452 (... temporary failure) expected 250 (CMD_MAIL_FROM)
Nov 22 16:09:59 (warning) mailqueued: [7ae265ff-cf9f-11e7-87ab-4ded5281c9b1] [229029656] Sender not accepted by server <duo-srs0=p1yp=cu=service.govdelivery.com=info99@mx1.mailhop.org> (aborting)
Nov 22 16:09:59 (info) mailqueued: [7ae265ff-cf9f-11e7-87ab-4ded5281c9b1] [229029656] Delivery failed to <mike@ycreighton.plus.com> (retry 0, in 00:00:06.038): SMTP error: 452 ... temporary failure
Nov 22 16:09:59 (debug) mailqueued: [7ae265ff-cf9f-11e7-87ab-4ded5281c9b1] [229029656] [script] HOSTS [API=172.31.14.194, DS=172.31.14.194, LOG=172.31.2.68, LOG2=172.31.17.77]
Nov 22 16:09:59 (info) mailqueued: [7ae265ff-cf9f-11e7-87ab-4ded5281c9b1] [229029656] Retry message in 1 minutes (retry: 0 of 253, increment_retry)
Nov 22 16:11:00 (info) mailqueued: [7ae265ff-cf9f-11e7-87ab-4ded5281c9b1] [229029656] Processing message from <info99@service.govdelivery.com> to <mike@ycreighton.plus.com> with mailtransport:1
Nov 22 16:11:00 (debug) mailqueued: [7ae265ff-cf9f-11e7-87ab-4ded5281c9b1] [229029656] [script] HOSTS [API=172.31.14.194, DS=172.31.14.194, LOG=172.31.2.68, LOG2=172.31.17.77]
Nov 22 16:11:00 (debug) mailqueued: [7ae265ff-cf9f-11e7-87ab-4ded5281c9b1] [229029656] [script] Meta: ["spam"=>"no","spf"=>"yes","type"=>"fwd","userid"=>"7481"]
Nov 22 16:11:00 (debug) mailqueued: [7ae265ff-cf9f-11e7-87ab-4ded5281c9b1] [229029656] [script] SRS: duo-srs0=p1yp=cu=service.govdelivery.com=info99@mx1.mailhop.org
Nov 22 16:11:00 (debug) mailqueued: [7ae265ff-cf9f-11e7-87ab-4ded5281c9b1] [229029656] [script] Source 172.31.28.95 PTR mail5.mailhostingservice.com
Nov 22 16:11:00 (info) mailqueued: [7ae265ff-cf9f-11e7-87ab-4ded5281c9b1] [229029656] Delivering message to ycreighton.plus.com:25
Nov 22 16:11:00 (info) mailqueued: [7ae265ff-cf9f-11e7-87ab-4ded5281c9b1] [229029656] Connecting to [212.159.9.200]:25
Nov 22 16:11:04 (info) mailqueued: [7ae265ff-cf9f-11e7-87ab-4ded5281c9b1] [229029656] Message was sent successfully (250 HXc5ewTgWWGeFHXc7eLyAG mail accepted for delivery)
Nov 22 16:11:04 (info) mailqueued: [7ae265ff-cf9f-11e7-87ab-4ded5281c9b1] [229029656] Successful delivery to <mike@ycreighton.plus.com> (retry 1) in 00:00:04.534
Nov 22 16:11:04 (debug) mailqueued: [7ae265ff-cf9f-11e7-87ab-4ded5281c9b1] [229029656] [script] HOSTS [API=172.31.14.194, DS=172.31.14.194, LOG=172.31.2.68, LOG2=172.31.17.77]

[#4]

---

@bobpullen wrote:
That looks to me like DuoCircle were doing something odd with the sender address of the forwarded emails. Our servers were rejecting the messages because they weren't being seen as having originated from a valid sender domain.

---

Hi Bob,

What did you mean by "odd"?  This rather looks like Sender Rewriting Scheme as described here - https://en.wikipedia.org/wiki/Sender_Rewriting_Scheme

The sender domain [mx1.mailhop.org] though seems valid.

> mx1.mailhop.org
Server:  [192.168.1.254]
Address:  192.168.1.254

Non-authoritative answer:
mx1.mailhop.org internet address = 52.29.162.96
mx1.mailhop.org internet address = 54.149.154.28
mx1.mailhop.org internet address = 54.149.205.143
mx1.mailhop.org internet address = 54.149.206.185
mx1.mailhop.org internet address = 54.186.60.165
mx1.mailhop.org internet address = 52.28.30.98
mx1.mailhop.org internet address = 54.68.193.51

mailhop.org     nameserver = ns2.p01.dynect.net
mailhop.org     nameserver = ns1.p01.dynect.net
mailhop.org     nameserver = ns4.p01.dynect.net
mailhop.org     nameserver = ns3.p01.dynect.net

Is there any possibility that the "some times it works sometimes it does not" is related to which MTA is processing the inbound message?  Is there any possibility of some of the MTAs being on a different build / patch level / configuration? 

[#5]

I have the same issue, sending e-mail to a friend who is on a Force9 address sometimes results in the following 550 error, sometimes doesn't.

I'm a Google Gsuite user, so I raised the problem with them, and they claim all is OK with my domain.

My friend raised this twice with PN Support who went through adding my address to white list etc, this has not worked.

   
Bounced
Google tried to deliver your message, but it was rejected by the server for the recipient domain <a href="http://<removed>.force9.co.uk" target="_blank"><removed>.force9.co.uk</a> by <a href="http://mx.avasin.plus.net" target="_blank">mx.avasin.plus.net</a>. [212.159.9.200]. The error that the other server returned was: 550 #5.1.8 Domain of sender address does not exist

[#6]

Must admit since I turned off all SPAM checking at the PN end my problem has gone away. As my email relay carries out it's own checking I'm quite happy, however I've no way of knowing if this was the cure or whether the problem has simply fixed itself.

[#7]

@cerij101

How often does "sometimes" mean in terms of the number of messages you send to that Force9 recipient?

I think there are indicationes that the DNS lookups done by the avasins are resulting in misleading answers.

@bobpullen have you any thoughts on this?

[#8]

Approx 50% of emails now fail

[#9]

That's a much higher percentage than I was expecting. 

Are these from messages well separated in time, ie not immediate retries after a failure?

[#10]

Thanks for your reply.

These messages are over a period of say 6 weeks to early November when I first started having problems. The failure bounce comes back within seconds. If I then re-send the original email it sometimes goes through OK.

[#11]

---

@cerij101 wrote:
These messages are over a period of say 6 weeks to early November when I first started having problems.

Thanks, but please could I query the highlighted phrase? Should that be "from early November"?

[#12]

Sorry David. Yes, issues have been since early November 2017. Thanks.

[#13]

Early November tallies with my experiences.

Not sure why the PN servers are returning 5xx fatal errors for what could be a transitory DNS lookup issue?

[#14]

@cerij101, can you private message me the address you're sending from and to please when these failures occur?
Edit: can you also provide me with the date and time of a recent bounce so I can try and locate it in our mail logs?

[#15]

@MrC

---

@MrC wrote:
Not sure why the PN servers are returning 5xx fatal errors for what could be a transitory DNS lookup issue?

---

I wonder if the temporary error 452 is the "correct" response implying a non-authoritive answer whereas permanent error 550 implies it is authoritive? In these instances the latter is wrong.

Turning Spam checking off will have changed mail server connections from the avasin (mx.avasasin.plus.net) to the core (mx.core.plus.net) servers; do your logs show any error 452 instances to the core servers since that Spam setting was changed?