Good reputation IP has been blocked with 554 5.7.1 Sender Not allowed

[marco di antonio]

Hi, our IP 51.38.52.139 is getting blocked from your services  This is IP has GOOD reputation from Cisco Talos,  high score on Sender Score. Good score on Barracuda . IP is not blacklisted anywhere (mxtoolbox, ecc).

However, when sending email to providers that use your service we get the following error in logs: 554 5.7.1 Sender Not allowed
 

Our IP is also NOT listed on  https://ipremoval.sms.symantec.com/

 

Can you please check? Our customers are complaining a lot that they can't send emails to some providers.

Please let me know, thanks

 

Marco

[ℬrίαη]

If you haven't done so already submit a sample of an email that's blocked to:

[e-mail] 

Links for reference:

https://www.symantec.com/docs/TECH82881

https://www.symantec.com/docs/TECH250089

https://www.symantec.com/docs/TECH240145

This is the first place to start until someone from Symantec can review this thread and remediate. But your best bet is to start sending PMs to Symantec folks on this forum as there has been very little activity here and support won't help because you're not a customer. Basically, your customers will need to whitelist your domain.

Don't shoot the messenger - I'm just letting you know. I'm not a Symantec employee and cannot help much further.

[marco di antonio]

Thanks, I've sent today an email at  [e-mail]  , but I guess I must wait but I'm not sure this will work...

 

I PM'd an employee that seems to be active here, hopefully he can help me out... 

[ℬrίαη]

Lack of support for non-customers has been a point of contention on this forum for a very long time. Hopefully, they get a better process in place for non-customers but....

[marco di antonio]

Do you by chance use their products? Can you somehow check if IP has finished in symantec product blacklist even if it isn't on  https://ipremoval.sms.symantec.com  ?

[ℬrίαη]

We don't use messaging gateway otherwise I could. The only other way is to submit an investigation, which it sounds like you did already.

[marco di antonio]

Brian, I'm quite demoralized.  If Symantec lookup says our IP isn't in bad reputation, why does Symantec Gateway refuse us with that SMTP error?  Can it be that these gateways need some time to update agains Symantec IP database?? Like, 7 days ?

[marco di antonio]

I'm quite demoralized.

If Symante lookup says our IP isn't in blacklist, why does such gateways refuse us with that SMTP error?  Can it be that these gateways need some days to update its database against Symantec's database? Like, 7 days or so?

 

[marco di antonio]

I'm quite demoralized.

If Symantec lookup says our IP isn't in blacklist, why does such gateways refuse us with that SMTP error?  Can it be that these gateways need some days to update its database against Symantec's database? Like, 7 days or so?

[VaclavMech]

Hello Marco,

I've checked the reputation of your IP  51.38.52.139 in my Symantec Messaging Gateway and it is listed as a "Global Bad Sender". And you're correct that the online tool says it doesn't have any negative reputation. This issue is similar to what I talked about in my post here: https://www.symantec.com/connect/forums/symantec-global-bad-sender-0#comment-12146331

I was told by Symantec support that this doesn't happen often, yet here we are.

Best regards,
Vaclav

[marco di antonio]

Vaclav, 

thanks so much. Since our IP is not spam, can we consider this a Symantec issue? Will this get fixed automatically?  Or , if you are a customer, would you be kind enough to open a ticket at them to let them know about this issue0?

 

Thanks so much in advanace..

Marco

[alexander smg]

As of this post, it is blacklisted here: http://multirbl.valli.org/lookup/51.38.52.139.html

[marco di antonio]

Is that a joke?  Of  230 blacklist it's blocked from Suomi (not my IP but the whole network)?  No , that can't be the reason of this issue.

 

Also, the IP is not in Symantec blacklist.  Why do you say such thing ?  Symantec has the issue...

[ℬrίαη]

He's simply pointing out what blacklist your IP is on. Symantec uses multiple lists, including their own, but not limited to their own. So no, it's not a joke. Again, you're best off getting your customer to open a ticket. There isn't going to be much help here from the forum unless Symantec steps in.

[marco di antonio]

I made customer open a ticket to Symantec.  Let's see how this goes.. I'll update the thread when I know something more..

 

 

[alexander smg]

We are all here to help each other. Don't worry, most ip block lists are aggregated. So the hopefully the blacklist does clear out soon.

[marco di antonio]

Our customer opened the ticket and FINALLY Symantec fixed the issue.  The bad thing though is that Symantec totally failed when supporting me (a non customer) with [e-mail] .

They replied but totally failed. It seems they were uncapable of understanding what I said and they replied with a sort of fix-template reply saying "It's all OK, Symantec has no issues".    I'm very disappointed about this.

If it wasn't for our customer that is a big ensurance company , I don't know how this would have ended.

Anyways, it's all working now... 

 

[alexander smg]

Yay. Good thing it's working.