Email being blocked by Recipient Mail Server (553-Message filtered).

[Migration User]

The last couple of days I have had users attempting to send emails to particular domains that are being filtered by messagelabs.

We are regularly reciving immediate bounces with the following error code:

cluster4.us.messagelabs.com #5.0.0 smtp; 553-Message filtered. Refer to the Troubleshooting page at 553-http://www.symanteccloud.com/troubleshooting for more 553 information. (#5.7.1)

One of the techs here decided to remove our email signatuire and attempt to send again. To our amazement it appeared to send.

Further investigation found that the removal of a specific hyperlink on an image displayed in the signature was the cause of the problem, in fact we had other images in the same signature that had links to them (that were not removed) and the email went through still.

 

There is something specific to this particular hyperlink that has caused the issue but I am not sure what the problem is.

Is there some sort of filter test taht I can use against the messagelabs filters to understand exactly why our signature is causing the filtering of the message?

[Migration User]

I think this is happening to us also. We've made no changes at our end, but have experienced a severe increase in delivery failures form a wide variety of Domains.

[Migration User]

Hello,

There can be detection surrounding specific links or URL found within the body of a message. There are some public tools that you can use to check against a variety of blacklist and reputation database to see if a particular domain or URL is known to have been seen on spam messages. For instance:

 

http://mxtoolbox.com/blacklists.aspx

http://mxtoolbox.com/BrandReputation.aspx

 

This is only one example however and it may not always be indicative of the reason of the block. The recipient of the mail can reach out to their Cloud support team and review emails stopped to ensure they are not a false positive and also obtain more information on the cause of the block.

[Migration User]

Hi Pronamics - is there any chance you can post the problematic hyperlink that caused your emails not to go through? We are having the same issue, and would like to see if we can find a commonality in any of our links.

[Migration User]

Hi There,

We have the same problem.

Our emails are legitimate and Opt-in Data.

none of the domains or IP's are in a blacklist and the reputations are quite high.

The troubled emails are basically Transactional type emails. (We followed CAN-SPAM Act to prevent spam treatment)

please advice on resolving this issue.

 

Thanks,

Kind Regards,

F24Deliverability

 

 

[Migration User]

Hi F24Deliverability,

Could you send me a private message with the details of the issue you are having? Preferably a copy of a full bounce would be ideal. Once I get that I will look into it further for you.

Regards,

Ben Beaulieu
Senior Technical Support Engineer

[parth patel]

Hello, 
please help us ASAP. 

we are having same issue regarding 553 msg filtered. we are unable to send email to others, specially domain business email users and some time normal gmail users as well. on Some emails, we can send successfully. also we receive the emails successfully. just sending issue. please take a look and help us. we removed signature as well. but not solved.  We got below msg. 

Message blocked

The response from the remote server was:

553 Message filtered. Refer to the Troubleshooting page at https://knowledge.broadcom.com/external/article?legacyId=TECH246726 for more information. (#5.7.1)

Email id:
[e-mail]
[e-mail]

M: [phone]

thank you

[Migration User]

Hi Ben,
I'm hoping you can help.
Today one of my clients is having a lot of trouble sending to many domains that are filtered by MessageLabs.

i.e.
server-2.tower-85.messagelabs.com #553-Message filtered. Refer to the Troubleshooting page at 553-http://www.symanteccloud.com/troubleshooting for more 553 information. (#5.7.1) ##

This is causing many issues and unfortunately the feedback from the bounce doesn't point us in any direction.

Cheers,
Shaun

[Migration User]

Hello Ben,

I am seeing this issue with one of my customers as well.   They are sending transactional e-mails (replies that are point to point) from existing conversations, and as of today, they are getting this error.

    host cluster5.us.messagelabs.com [216.82.242.131]

    SMTP error from remote mail server after end of data:

    553-Message filtered. Refer to the Troubleshooting page at

    553-http://www.symanteccloud.com/troubleshooting for more

    553 information. (#5.7.1)

 

I checked and they are not on any blacklist of any sort.   

 

[Migration User]

the system reply me with a mesage said the the mail deliverty was failed. what should i do now? the following is the mail i received

 

This is the mail system at host mx.oneas1a.com.

 

I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below.

 

For further assistance, please send mail to postmaster.

 

If you do so, please include this problem report. You can delete your own text from the attached returned message.

 

                   The mail system

 

<[e-mail]>: host cluster6.us.messagelabs.com[216.82.251.38]

    said: 553-SPF (Sender Policy Framework) domain authentication 553-fail.

    Refer to the Troubleshooting page at

    553-http://www.symanteccloud.com/troubleshooting for more 553 information.

    (#5.7.1) (in reply to end of DATA command)

 

<[e-mail]>: host

    cluster6.us.messagelabs.com[216.82.249.212] said: 553-SPF (Sender Policy

    Framework) domain authentication 553-fail. Refer to the Troubleshooting

    page at 553-http://www.symanteccloud.com/troubleshooting for more 553

    information. (#5.7.1) (in reply to end of DATA command)

This is the mail system at host mx.oneas1a.com.

 

I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below.

 

For further assistance, please send mail to postmaster.

 

If you do so, please include this problem report. You can delete your own text from the attached returned message.

 

                   The mail system

 

<[e-mail]>: host cluster6.us.messagelabs.com[216.82.251.38]

    said: 553-SPF (Sender Policy Framework) domain authentication 553-fail.

    Refer to the Troubleshooting page at

    553-http://www.symanteccloud.com/troubleshooting for more 553 information.

    (#5.7.1) (in reply to end of DATA command)

 

<[e-mail]>: host

    cluster6.us.messagelabs.com[216.82.249.212] said: 553-SPF (Sender Policy

    Framework) domain authentication 553-fail. Refer to the Troubleshooting

    page at 553-http://www.symanteccloud.com/troubleshooting for more 553

    information. (#5.7.1) (in reply to end of DATA command)

[Migration User]

Hi, Ben.B! We are having the same issue: Three companies that all use Symantec Cloud for spam filtering have started blocking our messages, as of the afternoon of 3/22/16. Earlier that day, we were exchanging messages just fine. We have discovered that if there is URL of any sort in the message TO or FROM them that contains our domain (like an email address in the signature, for instance), the email bounces. Their IT department is looking at it from the client-of-symantec side, but it would be great if we could find the source of the issue and resolve it without depending on the email recipient's technical support resources, since this is obviously a problem with all symantec cloud recipients. Thanks!

[Sym_A]

Hello, 

Looking at the error, your message triggered spam verdict. You can submit a false positive using the below steps.

To analyze a false positive sample, Symantec must receive the original false positive email:

    As an "message/rfc822" email attachment*
    One email attachment per submission**

Send the false positive sample as an email attachment to the following address:

[e-mail]

Instructions on how to attach samples for common email clients can be 

found in the following article:
https://support.symantec.com/en_US/article.TECH233678.html

[Migration User]

Thank you so much for the reply! I submitted a false positive, using that exact message, on Friday, 4/1/16, at 12:38 PM CDT, and yet we are still blocked.

 

 

[Sym_A]

Hello chanyongqian, 

Looking at the error, this message failed due to SPF validation. If your sending IP is not listed on your SPF record, mail would get rejected. To resolve this, you would need to ensure that your published SPF record, includes your sending IPs as authorized servers that can send mail on behalf of your domain. 

[Migration User]

Hi,

Our domain name (industry-dynamics.com) started to bounce back from recipients using Symantec Cloud Messagelabs. We have run all checks on our side and can't find anything wrong with our email setup. Run checks using mxtoolbox.com.

I managed to talk to the IT department for one of our clients and they mentioned that our domain is being blacklisted. I suggested they contacts Symantec Cloud Messagelabs/Brightmail as they are a customer.

Can you please let me know why our domain name industry-dynamics.com is blacklisted? How can we ammend our reputation on Messagelabs/Brightmail?

 

Here is a copy of one of the bounce back messages (I have removed the username part of the email address for privacy reasons):

 

Delivery to the following recipient failed permanently:

 

     @ajg.com

 

Technical details of permanent failure:

Google tried to deliver your message, but it was rejected by the server for the recipient domain ajg.com by cluster4.us.messagelabs.com. [216.82.251.34].

 

The error that the other server returned was:

553-Message filtered. Refer to the Troubleshooting page at 553-http://www.symanteccloud.com/troubleshooting for more

553 information. (#5.7.1)

 

 

[Migration User]

Our domain name (lsbd.ufc.br) started to bounce back from recipients by Symantec Cloud Messagelabs. We have run all checks on our side and can't find anything wrong with our email setup. Run checks using mxtoolbox.com.

Delivery to the following recipient failed permanently:

     j*****@lenovo.com

Technical details of permanent failure:
Google tried to deliver your message, but it was rejected by the server for the recipient domain lenovo.com by cluster9.us.messagelabs.com. [216.82.242.19].

The error that the other server returned was:
553-Message filtered. Refer to the Troubleshooting page at
553-http://www.symanteccloud.com/troubleshooting for more
553 information. (#5.7.1)
 

[Migration User]

My mail is suddenly being blocked to a new client and this is the message we get

Reporting-MTA: dns; xxxx.ketles.com

X-Postfix-Queue-ID: 79D165A0EA5

X-Postfix-Sender: rfc822; [e-mail]

Arrival-Date: Thu, 28 Apr 2016 11:00:56 +0100 (BST)

 

Final-Recipient: rfc822; [e-mail]

Original-Recipient: rfc822;[e-mail]

Action: failed

Status: 4.4.1

Diagnostic-Code: X-Postfix; connect to

    cluster8.eu.messagelabs.com[85.158.139.35]:25: Connection timed out

 

The time from sending to recieving this message was about 4 minutes what does it mean and why is the reciever not getting my emails.

[Migration User]

Hello,,

Message labs seems to be filtering emails we send and we do not receive any bounce back/undelivered.  Tripped upon this when someone in a group email forwarded our email from their gmail account and they received blocked notification.

Same issue as others have noted above - our emails are received if no url to our company is in message - as soon as we add signature with company url, message is not delivered.

Error message member of group received was -

The error that the other server returned was:
553-Message filtered. Refer to the Troubleshooting page at
553-http://www.symanteccloud.com/troubleshooting for more
553 information. (#5.7.1)

also said - server recipient is cluster5.us.messagelabs.com.

We have no clue how wide spread this issue is as we do not receive delivery failure notifications.  This is impacting our business.

We checked spam lists and are clean.

Please help.

[Migration User]

Hi,

Have not received a response to above.  Also submitted a flase positive email plus follow-up email over a week ago.  Also called customer support who said they could not help me because I don't have a message labs account.

Not sure what I should be doing as we receive no undelivered messages when we send emails.  Message labs is filtering us out and we do not know who or why.

Please advise what I should be doing as operating blind right now.

 

Thanks

[Migration User]

Anyone there?  Should I start a new thread?

[Daniel Del Rosario]

Hi jkjsm2010 ,

Could you send me a private message with the details of the issue you are having? A full copy of the bounce back message would be appreciated.  

Thanks,

[Migration User]

Hi,

Our domain name (supplywisdom.com) started to bounce back from recipients using Symantec Cloud Messagelabs. We have run all checks on our side and can't find anything wrong with our email setup. Ran checks using mxtoolbox.com.

Can you please let me know why our domain name supplywisdom.com is blacklisted? How can we ammend our reputation on Messagelabs/Brightmail?

Here is a copy of one of the bounce back messages (I have removed the username part of the email address for privacy reasons):

Subject: Delivery report
To: [e-mail]
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
    boundary="[e-mail]"

[e-mail]
Content-Type: text/plain

Hello, this is the mail server on mail178-14.suw51.mandrillapp.com.

I am sending you this message to inform you on the delivery status of a
message you previously sent.  Immediately below you will find a list of
the affected recipients;  also attached is a Delivery Status Notification
(DSN) report in standard format, as well as the headers of the original
message.

  <@example.com.au>  delivery failed; will not continue trying

[e-mail]
Content-Type: message/delivery-status

Reporting-MTA: dns;mail178-14.suw51.mandrillapp.com
X-PowerMTA-VirtualMTA: mail178-14.suw51.mandrillapp.com
Received-From-MTA: dns;pmta05.mandrill.prod.suw01.rsglab.com (127.0.0.1)
Arrival-Date: Mon, 23 May 2016 06:49:40 +0000

Final-Recipient: rfc822; @example.com.au
Action: failed
Status: 5.0.0 (undefined status)
Remote-MTA: dns;cluster9.us.messagelabs.com (216.82.249.35)
Diagnostic-Code: smtp;553 Message filtered. Refer to the Troubleshooting page at http://www.symanteccloud.com/troubleshooting for more information. (#5.7.1)
X-PowerMTA-BounceCategory: other

[e-mail]
Content-Type: text/rfc822-headers

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=mandrill; d=supplywisdom.com;
 h=From:Subject:Reply-To:To:Message-Id:Date:MIME-Version:Content-Type; i=[e-mail];
 bh=KeGrg+RvfoIh/rCM2eFhYqax34w=;
 b=SSesQf+bpVC9FKZqyWUZXSTy1pbbKr59rcQkXrxKvfK54ZWcHvbd3aPnRk5svXks2pI9J4wC2n3X
   vE5IcOPFyABstzsyKD2ChzWEzJvZwxUXDZkRm+SRfV3vr4NtNBG+BLW42Nuq/V8ftZkD7eiVtgWw
   2tUiEVcizf95j0TrqnI=
Received: from pmta05.mandrill.prod.suw01.rsglab.com (127.0.0.1) by mail178-14.suw51.mandrillapp.com id h8ak0c22s10m for <@example.com.au>; Mon, 23 May 2016 06:49:40 +0000 (envelope-from <[e-mail]>)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandrillapp.com; 
 i=@mandrillapp.com; q=dns/txt; s=mandrill; t=1463986180; h=From : 
 Subject : Reply-To : To : Message-Id : Date : MIME-Version : 
 Content-Type : From : Subject : Date : X-Mandrill-User : 
 List-Unsubscribe; bh=W5iGcr1y14l4SJYbm6tFmQDZBpNQ3qn1g+88bL8U4VE=; 
 b=C+LrWho0UmPw/RBbwP7vxqFgotakamjIkYbdGtd4r4Y0QkKGaMHyqwQ3AITOaB0Qo2HsT8
 SBmcdneTle5D3MEfQKQIDv0v2hJM0VHS6mSxjfFZvpwedXywuF4Iq2GuweWLMocXEvXMsYx6
 k9nBcdO82lJ44uBxWgDs3Q9mpqTAE=
From: SupplyWisdom Alerts <[e-mail]>
Subject: New Alert for India Available, severity: Low
Return-Path: <[e-mail]>
Received: from [54.175.106.228] by mandrillapp.com id 03e79f582898403594d1de785fe897df; Mon, 23 May 2016 06:49:40 +0000
Reply-To: 
To: <@example.com.au>
X-Report-Abuse: Please forward a copy of this message, including all headers, to [e-mail]
X-Report-Abuse: You can also report abuse here: http://mandrillapp.com/contact/abuse?id=30849219.03e79f582898403594d1de785fe897df
X-Mandrill-User: md_30849219
Message-Id: <[e-mail]>
Date: Mon, 23 May 2016 06:49:40 +0000
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="_av-57fdKznGNHv6M2FPaS8arA"

[e-mail]--

 

[Migration User]

Hi,

Any updates on this? 

 

- Sowmya

[Migration User]

Any updates on this issue.

Should I start a new thread for the same issue.

 

- Sowmya

[Migration User]

Emails from my company are getting bounced with the "server-15.tower-179.messagelabs.com #553-SPF (Sender Policy Framework) domain authentication 553-fail. Refer to the Troubleshooting page at 553-http://www.symanteccloud.com/troubleshooting for more 553 information. (#5.7.1) " error. I do have a valid SPF record that was working fine until last night or maybe thing morning. Has anything changed - requirements/format of the record?

v=spf1 mx a mx:mail.mydomain.net -all

[Migration User]

Sorry all for the massively late response,

I did get this resolved in the end and yes it was relating to correct SPF records.

It turned out DNS changes caused my SPF record to be removed. As such it needed to be created again to ensure appropriate server validations.

This also coincided with a change to an online support service for our company which meant the service mail servers were not included either, so remember if you have any external services sending mail on behalf of your domain they need to be authorized as a legitimate source. Usually services will have technical documentation detailing SPF details needed for there products.

As a number of people mentioned mxtoolbox.com is an invaluable resource for confirming everything with your SPF record is working correctly for a domain.

Additionaly I have also found/relied on these sites as regular tools for validating and creating SPF records when changes are required.

* http://www.spfwizard.net - For creating your SPF record. Really simple wizard for building appropriate record.

* http://www.kitterman.com/spf/validate.html - Validation tools for ensuring an email can be sent based on a particular domain and IP sending the email.

 

Again sorry for the lack of earlier replies, I have not actively been monitoring this thread.

[Migration User]

I am facing this issue again. My SPF records are proper. Still my email are getting rejected. This happened last month too during the same period and for resolved by with last month. Can please check why our domain is getting rejected? - Sowmya

[Migration User]

Any updates on these?

[Migration User]

Hello, we have the same issue since 2 days. Before 2 day's ago everything was normal. Now we cann't mail to a couple customers. 
We are not on a blacklist with or servers(mail.cardservices.nl, mx.cardservices.nl, mx1.cardservices.nl, mx2.cardservices.nl)  Or mail setting on the mailservers are not changed! 

Please fix it (add us to your whitlist!).  

<email-address>: host cluster3.eu.messagelabs.com[85.158.137.67] said:
  553-Message filtered. Refer to the Troubleshooting page at
  553-http://www.symanteccloud.com/troubleshooting for more 553 information.
  (#5.7.1) (in reply to end of DATA command)