Spamhaus Issue - 553-mail rejected because your IP is in the PBL. See 553 http://www.spamhaus.org/pbl>

[Richard Brittain]

When you attempt to send an email to a Symantec.cloud customer you may receive the following error message in a bounce back email.

clusterX.XX.messagelabs.com #<clusterX.XX.messagelabs.com #5.0.0 smtp; 553-mail rejected because your IP is in the PBL. See 553 http://www.spamhaus.org/pbl> #SMTP#

In the first instance you should use the Spamhaus IP lookup tool to confirm if your Sending IP is listed (https://www.spamhaus.org/lookup/)

If the lookup tool shows that your sending IP address is not listed on the PBL like so,

XX.XX.XX.XX is not listed in the PBL

and you continue to receive this problem it is still possible your IP address is listed on the PBL,

Symantec has become aware of a problem with the Spamhaus lookup tool where in if a subnet / range of IPs has been added to the Spamhaus Block lists instead of a single IP address, the search tool will not show you this information unless you search using the first usable IP address in your range.

How to find your IP range

Many popular DNS sites such as Mxtoolbox allow you to perform an IP WhoIs or a ARIN Lookup

Performing one of these checks on your sending IP address will return the range of external IPs that your sending IP belongs to

You can then recheck the Spamhaus lists using this IP address to see if the range is listed

XX.XX.XX.XX is listed in the PBL

With any valid entry on the PBL, Spamhaus with provide you with a PLCXXXXXX reference which you can click on to see more information about the listing and confirm that the sending IP in question is containted within the listing

The removal request can be followed as normal from here on out.

 

Ref: PBLXXXXXX

XX.XX.XX.XX/21 is listed on the Policy Block List (PBL)
 

Outbound Email Policy of The Spamhaus Project for this IP range:

This IP address range has been identified by Spamhaus as not meeting our policy for IP addresses permitted to deliver unauthenticated 'direct-to-mx' email to PBL users.

 

 

[Migration User]

I don't understand, my range is listed (210.10.236.0/29), my mail servers ip (210.10.236.2) within that range has already been excluded. I believe it was excluded months ago, and this bounce problem is only recent. Also, the pbl faq says to only remove the ip sending mail, and no more.

I looked up 210.10.236.0, clicked the PLCXXXXXX reference number, tried to remove 210.10.236.2, but it said it isn't listed (because it isn't listed, and hasn't been for months).

I've removed 210.10.236.0 to see if that helps, but at this stage, I believe the spamhaus lookup tool is correct, and the bounces are intermittent, resending 4 or 5 times and the email will get accepted.

 

[Migration User]

Michael Hammer, this is exactly what is happening to me. We got our 210.10.242.216/29 subnet from our ISP six months ago, I delisted the IP address 210.10.242.220 on which our mail server is running. Everthing was working fine until a few days ago. 

 

Like you say, the mail server's IP is already delisted, can't be delisted again. I'm pretty sure this is a Symantec issue.

 

This is causing us serious grief with no solution in sight.

[Migration User]

yeah, it's frustrating Micro, and what's more, it's impossible for me to lodge a support ticket with symantec because they only accept support tickets from their customers, and I'm not a customer.

 

[Migration User]

I have a client using Symantec.cloud so was able to open a case under their name. To Symantec's credit they have stayed on the case but have been unable to fix the issue. Their suggestion now is to approach the ISP (AAPT in my case) to see if they can delist the entire subnet with Spamhaus. The Symantec tech also suggested I delist the subnet IP address. This is against Spamhaus directions but I just did it anyway out of desperation. Will see how it goes.

[Migration User]

I think it's fixed for me Micro, either Symantec fixed it or removing the first IP address in the subnet fix it. So far no bounces today.

 

[Migration User]

Hi Michael,

I just checked the range which was listed yesterday and it has been delisted. The article above helps identify the starting IP of the range in order to request delisting. 

 

Kind regards,

James Clayton

Production Engineering

[Migration User]

Thanks for your help James, I was a bit frustrated yesterday, I'm sorry for being short, but I'm still confused.

I didn't delist the range, there's no mechanism to delist ranges, just single IP addresses. Yesterday I delisted the IP address at the start of the range, 210.10.236.0, but that removes just a single IP address, not the whole range, ie 210.10.236.4 is still listed. 210.10.236.0 never sends mail and shouldn't be delisted.

I still think there are two symantec problems, 1. symantec is using the PBL incorrectly, it should test the IP addresses sending the mail, not the range it's part of, and 2. the bounces are intermittent.

Thanks again James, 

[Migration User]

Hi 

i am getting the same isuue .all my emails are rebounding back to me with this message.

my ip address is 27.32.172.195

my ip address is not listed in your pbl but still its blocking.

Sorry, we were unable to deliver your message to the following address.

 

<[e-mail]>:

553: Message filtered. Refer to the Troubleshooting page at

http://www.symanteccloud.com/troubleshooting for more

information. (#5.7.1)

 

--- Below this line is a copy of the message.

 

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1495611749; bh=FKcU9012ES5yT/8jlOX5F24NMR0NNbYpsO5d/3ONN7I=; h=Date:From:Reply-To:To:Cc:Subject:References:From:Subject; b=Z9aBR90Bian9C8Gs12hKPaKgfCL0wwBhX5pmVNtc9I6qKJm2yjRhbhZDW1JByr0K5VFBkLv/KYxvKOXvULQxOPoE8DLHPL5bsfiIT5HK82wUUH0LRZ6Rjxjq5k+m1e+uPbTISy2SXVaAvSUAN37gvjc/Zp2l3ot30iI2igH8KHfTXfBElm3mF3uKIXHTLMUE3U6fFRoGLgrszx8/au/4E2Sxumly/0vNDsE09Nbf6W9O9NYRGlVymWEnjDGw0jOvad/vz2iULLWRsB4QXJ86CIQiFyxO28X1a5HqQFVV2tRq5rtD8nD1fkDgWmSyge34Rgst2GNXUEUFGHOCKabfkQ==

X-YMail-OSG: uyB_uUIVM1mNRPLibbw9TVdbsK0Jk9IiRuc6ykxbLdjRF_RUpnfFKaQ_0gP0kxx

ci7fsO9cDci_yOZxE1yxRwZ6Cbd7qOOQLZeyqCnYFWRqIvAm6SNihqLwOLMnpdaQLhVsx3w_JkdV

4u2y89SWoHW297OYh2H4aDxgMoUJHn6AmGD0STkyeN2nCX0tARHcFMlKMFegfVXnCQ_IEkCRNeUC

388hPX3kE3oqtcxC2wSgMhdl5G1J1JsPHy3jMnNFIWOsLTVHk5wthd8WlfwcFiWEni9UJRKq2qX8

8f8jEwqK3KoZ6eR2T.Qa7mV_OicLKDKlvnJLhcnvbFK.P3z7N.6r2a4YDC5.MTIRpRFrq0kEJ7rc

8_5G05ru1zOyt0EPss_g95_9YXtwJsmBouXNYeHmYTmMzjbktzNkszZ2FCiLrBKlUiSfme69.SZA

e68x90twcUYpniX_N8qvhcaePXlnJoO65l5KCQPJi8XMPt3JGQn3ufwoA.Fiebb.UJCtGHKSq_cF

K8m8zf03cBo7hYQQ-

Received: from sonic.gate.mail.ne1.yahoo.com by sonic328.consmr.mail.gq1.yahoo.com with HTTP; Wed, 24 May 2017 07:42:29 +0000

Date: Wed, 24 May 2017 07:42:28 +0000 (UTC)

From: areef khan <[e-mail]>

Reply-To: areef khan <[e-mail]>

To: "[e-mail]" <[e-mail]>

Cc: "[e-mail]" <[e-mail]>, 

    Areef Kannan <[e-mail]>

Message-ID: <[e-mail]>

Subject: Attachments of flight ticket evidences for being abroad during

election date for two infringement notices 39764 Areef and 40021Deepa

MIME-Version: 1.0

Content-Type: multipart/alternative; 

    boundary="----=_Part_341552_1495592017.1495611748259"

References: <[e-mail]>

X-Mailer: WebService/1.1.9679 YahooMailNeo Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Content-Length: 9465

[Richard Brittain]

Hi Areefs,

I have responded to you on the other thread

Kind Regards

Richard Brittain
Tier2 Senior Technical Support Engineer,
Symantec Corporation