Some incoming business emails being blocked?

[#1]

Townman, with just one exception, the failed emails are being sent direct to our Plusnet addresses.  I don't have enough information to identify a pattern, other than the ones I know about are all from businesses. I think they have all contained either an attachment or a link to a 3rd party website, but can't be sure that's always the case.

What makes it worse is that phishing emails do still get through, including a rash of emails pretending to be from Plusnet - "Dear valued customer etc..."

I assume we (clients) have no access to Plusnet's spam filtering and can't modify or turn it off?

[#2]

Yes we can - log into the user portal - go to manage my account - go to manage my mail ...

Therein is the SPAM control option.

[#3]

---

@PinballGoose wrote:

The emails are passing through Mimecast email security

---

How does that product work for you - between the sender and your mailbox or between your mailbox and your email client(s)?

Is the domain to which the emails are addressed @youraccount.plus.com ?

[#4]

Thanks, I'll look at that and report back.

[#5]

Townman, I found the relevant spam controls you pointed to and have disabled the spam filter for the time being. Let's see what happens. Thanks for your help.

Interested to see that the spam filter strength was previously set at the lowest level. Still a mystery why things like e-tickets from a rail company were not getting through, a building society telling us their emails were being returned undelivered etc.

Perhaps this is all I need to do for now. I didn't raise a ticket with PN because a customer advisor replied to the first of these posts with an offer to investigate, but there's been no resolution as yet resulting from that.

[#6]

I need to pick this up again (failed incoming emails) as it's still happening.

A couple of weeks ago, I disabled the spam filter on our Plusnet accounts, but have had to enable it again - a few days ago my wife's account received several hundred copies of the same malicious email (' you have been secretly filmed etc...').

This morning I received a plain email message from a holiday site in France saying they had been unable to send a contract to my Plusnet address. It's noteworthy that they could send me an email with no attachment, but not one with an attachment.

Plusnet were supposed to be looking into this but nothing useful came of that.

What's the best way to raise a ticket with them?

As things stand, we have an email service that's not fit for purpose, simple as that.

[#7]

I would not describe it as not fit for purpose, as you have seen, it has been keeping 100's of malicious emails away from your wife.

There is an unhelpful nature around the basic principle of spam filtering - these systems learn by what receivers of emails report back.  If enough users report otherwise legitimate email as being 'SPAM' then such emails become a 'SPAM' signature and can cause legitimate emails to be marked as probably spam.

This can happen where someone is signed up to a distribution list they no longer wish to participate in: instead of going through a tidy unsubscribe process, they flag the communications as spam.  Thereby that sender becomes profiled as a spammer.  It would be interesting to know if the notification that there are problems emailing to you came from the same email address as the one sending the rejected emails.

In passing, this week I received a paper letter from Plusnet advising that they had been unable to notify me of the price change via email.  Odd that all other communications from Plusnet are received fine.  I suspect that such emails come from a third-party and they have been profiled as spam.

Your best course of action is to phone the support desk.

[#8]

Remove the Plusnet spam service, it may be good at denying  spam but you won’t know which genuine emails have been blocked. If you don’t want to get involved with the email client spam filters look at software like mailwasher.  This app will allow you to set filters to block known unwanted emails, being local you can check the spam and change the status if necessary.

.

[#9]

Townman, thanks I'll have to call the Helpdesk.

To answer you question, I've no reason to think that the holiday site sent me a contract via one email address (which bounced) but then emailed me from a different address to tell me they could send the contract. I don't know how spam filters work but I understand there is a suspicion that it's emails with attachments which are being rejected and this instance would tend to support that.

This is happening to us much too often, with multiple senders. And those are just the ones that have bothered to let us know, usually by phone or letter, that our email address appears not to be working. Almost certainly there are other emails which have never been delivered but we don't know about them.

We've been with Plusnet for about 20 years and this has only come to light in recent months. It's not acceptable repeatedly having to ask suppliers to try an alternative email address because they can't get emails through to our Plusnet addresses. 

[#10]

Champnet, thanks, we tried that and a few days ago my wife received literally hundreds of copies of the same malicious email. So I enabled Plusnet's spam filter again. It is (and was) set to its lowest strength. I also set up a Spam folder in Webmail, thinking that any rejected emails would go into that. When I checked it this morning, it was empty, so I guess it doesn't work that way. As you can guess, my technical knowledge is not huge.

[#11]

---

@Dalesman wrote:

my wife received literally hundreds of copies of the same malicious email.

---

 Any Commonality in these emails, I.E.  'from'  'reply to',

or similar words or phrases used in 'subject' line or in the text in the 'body' of the message ?

If so these can be caught and marked as spam for checking  or auto-deleted.....

[#12]

@Dalesman 

I've no reason to think that the holiday site sent me a contract via one email address (which bounced) but then emailed me from a different address to tell me they could send the contract. I don't know how spam filters work but I understand there is a suspicion that it's emails with attachments which are being rejected and this instance would tend to support that.

Some businesses send their outbound business emails from an address which does not accept replies and sometimes from distinct sub-domains.  Thereby a "we are having issues" email from a support / customer service desk might well come from a different SENDERS email address.  You would need a BAU email which you did receive to make that comparison.

The attachment consideration could be significant, especially if the email is passing through a forwarding service.  See Issue - Emails forwarded by Plesk fail DKIM checks with certain attachments | Plesk Forum - this relates to corruption of email headers where an email has certain attachments ... and passes through a third party.  Note that a fix for this was found only circa 6th March 2024.  Alex is someone known to me...

[#13]

Townman, thanks, to be clear, how would I know if undelivered emails were passing through a forwarding service? We know for sure that they are addressed directly to our Plusnet accounts, not to a different address which is then trying to forward them to our Plusnet addresses, if that's what you mean. I realise from earlier comments that this muddies the water. I take your point about some businesses using 'do not reply' addresses, but I'm 99% sure that's not the case here either. The suppliers and businesses which have reported being unable to email us have ranged from Banks and rail companies to very small businesses, e.g. a bike shop and now a campsite.

I'm afraid the Plesk forum thread was way over my head.

I'm not sure if I mentioned earlier that Transport for Wales said they had spotted an issue with sending e-tickets to Plusnet addresses, i.e. not just ours. I'm surprised there are not more reports of this. I'll have to call the Helpdesk, maybe at a quieter time of day.

[#14]

@Dalesman TfW have sent e-ticket to my Plusnet address with no issues, maybe 4-5 weeks ago.

[#15]

Good to know. How can this affect some Plusnet addresses and not other?