Themabewertung:
  • 0 Bewertung(en) - 0 im Durchschnitt
  • 1
  • 2
  • 3
  • 4
  • 5
Mails von Sky Ticket werden abgelehnt
#1
Solved 
Hallo,

ein Kunde versucht sein Passwort bei Sky zurückzusetzen und die Mail kommt nicht an.
Wird Permanent abgelehnt.

Hab dann eine Regel angelegt: Malwarescanning /No Content filtering mit from: sky-rt1@realtime.message.nowtv.com to Mailadresse vom Kunden

Abgelehnt wird trotzdem

Mal ein paar Meldungen:
Mit der Absenderadresse 172.82.236.130 ist ein mittleres Risiko verbunden.  Cyren-Referenz-ID kopieren

Die E-Mail wurde permanent abgelehnt mit der folgenden Antwort .
5.7.1 This email was rejected because it violates our security policy
5.7.1  Cyren AntiSpam Services considered this email to be Spam (Reference id str=0001.0A702F1A.62B99101.0049,ss=4,sh,re=0.000,recu=0.000,reip=0.000,cl=4,cld=1,fgs=8.
5.7.1  The reputation filter deemed your email unworthy.


Die eingehende Verbindung wurde nicht durch TLS gesichert.


Wir haben jetzt auch mal ne Mail an diese Adresse gesendet. 

Was kann man tun um die Mails zu bekommen.

Gruß Heiko
Zitieren
#2
Hallo Heiko,
Ist die Adresse immer von sky-rt1@realtime.message.nowtv.com ?
Grüße
Frank


- kein Mitarbeiter von nospamproxy -
Zitieren
#3
Ja das ist die Mailadresse von der dann wahrscheinlich der Link zum zurücksetzen des Passworts kommt
Zitieren
#4
Ist das auch die Adresse aus dem MailFrom ?
Grüße
Frank


- kein Mitarbeiter von nospamproxy -
Zitieren
#5
Wie meinst Du das 
Adresse aus dem Mailforum 

Die Mailadresse ist von einem Kunden von mir
Zitieren
#6
Zeig doch mal bitte hier den MessageTrack.
Ziel Adresse kannst du ja unkenntlich machen
Grüße
Frank


- kein Mitarbeiter von nospamproxy -
Zitieren
#7
{
  "productInformation": {
    "name": "NoSpamProxy",
    "suffix": null,
    "version": "14.0.0.4297",
    "components": [
      {
        "name": "Intranet Role",
        "version": "14.0.22153.1058"
      },
      {
        "name": "PowerShell",
        "version": "14.0.22153.1058"
      },
      {
        "name": "NoSpamProxy Control Center",
        "version": "14.0.21321.1539"
      },
      {
        "name": "NoSpamProxy Command Center",
        "version": "14.0.22153.1058"
      },
      {
        "name": "Message Tracking Service",
        "version": "1.1.11.53587"
      },
      {
        "name": "Management services",
        "version": "14.0.22153.1058"
      }
    ]
  },
  "sender": {
    "localPart": "sky-rt1",
    "domain": "realtime.message.nowtv.com"
  },
  "headerFrom": {
    "localPart": "no-reply",
    "domain": "servicecomms.wowtv.de"
  },
  "mailId": "26c36d74-79cc-405b-9b5b-4de83ba730a4",
  "messageId": "<NM6068E896D0C600360sky_rt1@realtime.message.nowtv.com>",
  "size": 28524,
  "subject": "Jetzt dein WOW Passwort zurücksetzen",
  "signed": "None",
  "encrypted": "None",
  "sent": "2022-06-27T18:17:48.89+02:00",
  "processingTime": "00:00:01.7300000",
  "status": "PermanentlyBlocked",
  "ruleName": "All other inbound emails",
  "scl": 6,
  "validationStatus": "RejectPermanent",
  "rejectReason": "SpamOrVirus",
  "cyrenReferenceId": "str=0001.0A742F1A.62B99255.0049,ss=4,sh,re=0.000,recu=0.000,reip=0.000,cl=4,cld=1,fgs=8",
  "processingGatewayRole": "Gateway Role 2",
  "receiveConnectorName": "SMTP on all addresses",
  "clientIPAddress": "185.15.49.37",
  "wasReceivedFromRelayServer": false,
  "detailsWereDeleted": false,
  "urlSafeguardInfoWasDeleted": false,
  "firstDeliveryAttempt": null,
  "deliveryDurationInSeconds": null,
  "deliveryAttempts": [
    {
      "recipient": "xxx@schleicher-ag.com",
      "deliveryDate": "2022-06-27T18:17:48.89+02:00",
      "status": "PermanentlyBlocked",
      "dane": "None",
      "statusMessage": "5.7.1 This email was rejected because it violates our security policy\r\n5.7.1  Cyren AntiSpam Services considered this email to be Spam (Reference id str=0001.0A742F1A.62B99255.0049,ss=4,sh,re=0.000,recu=0.000,reip=0.000,cl=4,cld=1,fgs=8.\r\n5.7.1  The reputation filter deemed your email unworthy.",
      "sendConnector": null,
      "tlsCipherSuite": null,
      "tlsProtocol": null
    }
  ],
  "levelOfTrust": {
    "domainBonus": 0,
    "addressPairingBonus": 0,
    "messageIdBonus": 0,
    "subjectBonus": 0,
    "dsnPoints": 0,
    "mailIsTrusted": false,
    "scl": 0,
    "senderDomainIsFreeMailer": false,
    "isSenderAuthenticated": true,
    "addressPairingIsWildcardEntry": false,
    "wasHeaderFromAddressUsedForValidation": true
  },
  "actions": [
    {
      "name": "Disclaimer anwenden",
      "time": "00:00:00.0000000",
      "decision": "Pass"
    },
    {
      "name": "Malware-Scanner",
      "time": "00:00:00.2300000",
      "decision": "Pass"
    },
    {
      "name": "S/MIME- und PGP-Überprüfung sowie Entschlüsselung (vorzugsweise eingehend)",
      "time": "00:00:00.0000000",
      "decision": "Pass"
    },
    {
      "name": "32Guards",
      "time": "00:00:00.3300000",
      "decision": "Pass"
    },
    {
      "name": "Greylisting",
      "time": "00:00:00.0000000",
      "decision": "Pass"
    }
  ],
  "attachments": [],
  "filters": [
    {
      "name": "Cyren AntiSpam",
      "time": "00:00:00.0000000",
      "scl": 4,
      "message": "Cyren AntiSpam Services considered this email to be Spam (Reference id str=0001.0A742F1A.62B99255.0049,ss=4,sh,re=0.000,recu=0.000,reip=0.000,cl=4,cld=1,fgs=8."
    },
    {
      "name": "Cyren IP Reputation",
      "time": "00:00:00.1800000",
      "scl": 0
    },
    {
      "name": "Echtzeit-Blocklisten",
      "time": "00:00:00.7800000",
      "scl": 0
    },
    {
      "name": "32Guards",
      "time": "00:00:00.3300000",
      "scl": 0
    },
    {
      "name": "Spam URI Realtime Blocklists",
      "time": "00:00:00.0400000",
      "scl": 0
    },
    {
      "name": "CSA Certified IP List",
      "time": "00:00:00.0000000",
      "scl": 0
    },
    {
      "name": "Reputationsfilter",
      "time": "00:00:00.1800000",
      "scl": 2,
      "message": "The reputation filter deemed your email unworthy."
    }
  ],
  "operations": [
    {
      "created": "2022-06-27T16:17:52.087+02:00",
      "operation": {
        "idStr": "-5932287954691244147",
        "type": "GreylistingActionEntry",
        "data": "{\"$type\":\"GreylistingActionEntry\",\"isSclThresholdExceeded\":true,\"isMailAlreadyRejected\":true,\"isMailActionDeterminedBySenderAddressReputation\":false,\"mailAction\":\"None\",\"senderNetwork\":\"185.15.49.0/24\",\"senderAddress\":\"sky-rt1@realtime.message.nowtv.com\",\"details\":[],\"isActionExecuted\":false,\"typeName\":\"GreylistingActionEntry\"}"
      }
    },
    {
      "created": "2022-06-27T16:17:52.087+02:00",
      "operation": {
        "idStr": "-4522142505438085873",
        "type": "Heimdall",
        "data": "{\"$type\":\"HeimdallValidationEntry\",\"aggregatedAction\":\"None\",\"aggregatedEmailAction\":\"None\",\"emailResults\":[],\"aggregatedAttachmentAction\":\"None\",\"attachmentResults\":[],\"aggregatedUrlAction\":\"None\",\"urlResults\":[],\"typeName\":\"Heimdall\"}"
      }
    },
    {
      "created": "2022-06-27T16:17:52.087+02:00",
      "operation": {
        "idStr": "-2547101493565979525",
        "type": "DmarcValidationEntry",
        "data": "{\"$type\":\"DmarcValidationEntry\",\"effectivePolicy\":\"None\",\"rfc5322FromDomain\":\"servicecomms.wowtv.de\",\"validationResult\":\"Success\",\"organizationalDomain\":\"wowtv.de\",\"dkimResult\":[{\"failures\":\"None\",\"authenticatedDomain\":\"servicecomms.wowtv.de\",\"signatureAlgorithm\":\"RsaSha256\",\"selector\":\"nowtv\"}],\"spfResult\":[{\"result\":\"Pass\",\"domain\":\"realtime.message.nowtv.com\"},{\"result\":\"None\",\"domain\":\"r37.realtime.message.nowtv.com\"}],\"spfValidationStatus\":\"Validated\",\"dkimAlignment\":true,\"spfAlignment\":false,\"applicablePolicy\":\"Reject\",\"arcDmarcOverride\":\"None\",\"typeName\":\"DmarcValidationEntry\"}"
      }
    },
    {
      "created": "2022-06-27T16:17:52.087+02:00",
      "operation": {
        "idStr": "1460644528635058366",
        "type": "DnsValidationEntry",
        "data": "{\"$type\":\"DnsValidationEntry\",\"senderAddress\":\"185.15.49.37\",\"hasMailFromDomainARecord\":true,\"mailFromDomainARecordValue\":\"a.mx.p49.neolane.net (54.216.247.111), b.mx.p49.neolane.net (54.194.136.217)\",\"hasPtrRecord\":true,\"isPtrRecordValid\":true,\"ptrRecordValue\":\"r37.realtime.message.nowtv.com\",\"isPtrRecordForwardLookupValid\":true,\"ptrRecordForwardLookupValue\":\"185.15.49.37\",\"typeName\":\"DnsValidationEntry\"}"
      }
    },
    {
      "created": "2022-06-27T16:17:52.087+02:00",
      "operation": {
        "idStr": "1925942815259604875",
        "type": "ConnectionValidation",
        "data": "{\"$type\":\"ConnectionValidationEntry\",\"isConnectionSecured\":false,\"typeName\":\"ConnectionValidation\"}"
      }
    },
    {
      "created": "2022-06-27T16:17:52.087+02:00",
      "operation": {
        "idStr": "2245823448168135288",
        "type": "CyrenIpReputationFilterEntry",
        "data": "{\"$type\":\"CyrenIpReputationFilterEntry\",\"ipAddress\":\"185.15.49.37\",\"referenceId\":\"tid=0001.0A742F91.62B9D82E.001B\",\"riskLevel\":10,\"recommendedAction\":\"Accept\",\"ipRange\":\"185.15.49.37-185.15.49.37\",\"ipClass\":\"T1\",\"volume\":{\"item1\":0,\"item2\":4,\"item3\":3},\"spamRatio\":{\"item1\":0,\"item2\":0},\"validBulkRatio\":92,\"typeName\":\"CyrenIpReputationFilterEntry\"}"
      }
    },
    {
      "created": "2022-06-27T16:17:52.087+02:00",
      "operation": {
        "idStr": "2781974209339456166",
        "type": "SenderRecipientValidationEntry",
        "data": "{\"$type\":\"SenderRecipientValidationEntry\",\"localAddresses\":[],\"ownedDomainsInHeaderFromDisplayName\":[],\"dnsValidationResultWithAddress\":{\"result\":\"Success\"},\"headerFromContainsAngleBracketsWithInvalidEmailAddress\":false,\"headerFromIsInvalidWithEmptyMailFrom\":false,\"headerFromContainsMultipleAddresses\":false,\"headerFromDisplayNameContainsDomainDifferentFromEmailAddress\":false,\"headerToContainsAtSignOutsideOfEmailAddress\":false,\"headerToContainsAngleBracketsWithInvalidEmailAddress\":false,\"headerToIsEmpty\":false,\"headerFromOrToContainMultipleUnicodeLanguagePlanes\":false,\"headerToDoesNotContainLocalUser\":false,\"typeName\":\"SenderRecipientValidationEntry\"}"
      }
    },
    {
      "created": "2022-06-27T16:17:52.087+02:00",
      "operation": {
        "idStr": "3450297006487783862",
        "type": "MalwareScan",
        "data": "{\"$type\":\"MalwareScanValidationEntry\",\"cyrenZeroHourClassification\":{\"spamClassification\":\"Confirmed\",\"virusClassification\":\"Unknown\",\"threatCount\":0,\"detectedThreatType\":\"None\",\"detectedThreatAccuracy\":\"None\",\"threatName\":\"\"},\"action\":\"Pass\",\"infectedMailParts\":[],\"availableScanners\":\"Cyren, Filebased, CyrenZeroHour\",\"hasAdministrativeNotificationBeenSent\":false,\"typeName\":\"MalwareScan\"}"
      }
    }
  ],
  "urls": []
}
Zitieren
#8
Problem gelöst.

Hab jetzt in der Regel auch mal die IP Adresse eingetragen und jetzt ging die durch.

Danke für die Unterstützung
Zitieren
#9
Hallo,
gerne.
Eventuell auch mal die eingehende Mail die nicht durch gegangen ist als FalsePostive melden.
Grüße
Frank


- kein Mitarbeiter von nospamproxy -
Zitieren
#10
Hallo,
ich hab wieder eine Domain, die sobald die eine Excel schicken permanent abgelehnt werden.

Ich lese aus dem Track irgendwie, dass die Domain auf ner RBL List steht. Konnte das aber nicht verifizieren.

RBL List Check ist grün!!


{
  "productInformation": {
    "name": "NoSpamProxy",
    "suffix": null,
    "version": "14.0.0.4297",
    "components": [
      {
        "name": "Intranet Role",
        "version": "14.0.22153.1058"
      },
      {
        "name": "PowerShell",
        "version": "14.0.22153.1058"
      },
      {
        "name": "NoSpamProxy Control Center",
        "version": "14.0.21321.1539"
      },
      {
        "name": "NoSpamProxy Command Center",
        "version": "14.0.22153.1058"
      },
      {
        "name": "Message Tracking Service",
        "version": "1.1.11.53587"
      },
      {
        "name": "Management services",
        "version": "14.0.22153.1058"
      }
    ]
  },
  "sender": {
    "localPart": "marketing",
    "domain": "landhotel-altes-zollhaus.com"
  },
  "headerFrom": {
    "localPart": "marketing",
    "domain": "landhotel-altes-zollhaus.com"
  },
  "mailId": "649a2da8-f6ca-4f28-aeda-bad34425a170",
  "messageId": "<1656673612.61808713@f36.my.com>",
  "size": 17189,
  "subject": "Fwd: Re: AW: Kasse",
  "signed": "None",
  "encrypted": "None",
  "sent": "2022-07-01T13:06:52.227+02:00",
  "processingTime": "00:00:00.5200000",
  "status": "PermanentlyBlocked",
  "ruleName": "All other inbound emails",
  "scl": 8,
  "validationStatus": "RejectPermanent",
  "rejectReason": "SpamOrVirus",
  "cyrenReferenceId": "str=0001.0A742F1D.62BED54D.001A,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0",
  "processingGatewayRole": "Gateway Role 2",
  "receiveConnectorName": "SMTP on all addresses",
  "clientIPAddress": "185.30.177.236",
  "wasReceivedFromRelayServer": false,
  "detailsWereDeleted": false,
  "urlSafeguardInfoWasDeleted": false,
  "firstDeliveryAttempt": null,
  "deliveryDurationInSeconds": null,
  "deliveryAttempts": [
    {
      "recipient": "xxxxxxxxxxxxxx@xxxx.de",
      "deliveryDate": "2022-07-01T13:06:52.227+02:00",
      "status": "PermanentlyBlocked",
      "dane": "None",
      "statusMessage": "5.7.1 This email was rejected because it violates our security policy\r\n5.7.1  Remotehost is listed in the following RBL lists: NixSpam RBL, SpamCop",
      "sendConnector": null,
      "tlsCipherSuite": null,
      "tlsProtocol": null
    }
  ],
  "levelOfTrust": {
    "domainBonus": 0,
    "addressPairingBonus": 0,
    "messageIdBonus": 0,
    "subjectBonus": 0,
    "dsnPoints": 0,
    "mailIsTrusted": false,
    "scl": 0,
    "senderDomainIsFreeMailer": false,
    "isSenderAuthenticated": false,
    "addressPairingIsWildcardEntry": false,
    "wasHeaderFromAddressUsedForValidation": false
  },
  "actions": [
    {
      "name": "Malware-Scanner",
      "time": "00:00:00.3100000",
      "decision": "Pass"
    },
    {
      "name": "S/MIME- und PGP-Überprüfung sowie Entschlüsselung (vorzugsweise eingehend)",
      "time": "00:00:00.0000000",
      "decision": "Pass"
    }
  ],
  "attachments": [],
  "filters": [
    {
      "name": "Echtzeit-Blocklisten",
      "time": "00:00:00.1000000",
      "scl": 8,
      "message": "Remotehost is listed in the following RBL lists: NixSpam RBL, SpamCop"
    },
    {
      "name": "Cyren IP Reputation",
      "time": "00:00:00.0100000",
      "scl": 0
    },
    {
      "name": "CSA Certified IP List",
      "time": "00:00:00.0000000",
      "scl": 0
    }
  ],
  "operations": [
    {
      "created": "2022-07-01T11:06:55.873+02:00",
      "operation": {
        "idStr": "-4807853949402070425",
        "type": "CyrenIpReputationFilterEntry",
        "data": "{\"$type\":\"CyrenIpReputationFilterEntry\",\"ipAddress\":\"185.30.177.236\",\"referenceId\":\"tid=0001.0A782F93.62BED54D.0006\",\"riskLevel\":10,\"recommendedAction\":\"Accept\",\"ipRange\":\"185.30.177.236-185.30.177.236\",\"ipClass\":\"T1\",\"volume\":{\"item1\":0,\"item2\":5,\"item3\":4},\"spamRatio\":{\"item1\":0,\"item2\":1},\"validBulkRatio\":19,\"typeName\":\"CyrenIpReputationFilterEntry\"}"
      }
    },
    {
      "created": "2022-07-01T11:06:55.873+02:00",
      "operation": {
        "idStr": "-3358635336178798622",
        "type": "MalwareScan",
        "data": "{\"$type\":\"MalwareScanValidationEntry\",\"cyrenZeroHourClassification\":{\"spamClassification\":\"Unknown\",\"virusClassification\":\"Unknown\",\"threatCount\":0,\"detectedThreatType\":\"None\",\"detectedThreatAccuracy\":\"None\",\"threatName\":\"\"},\"action\":\"Pass\",\"infectedMailParts\":[],\"availableScanners\":\"Cyren, Filebased, CyrenZeroHour\",\"hasAdministrativeNotificationBeenSent\":false,\"typeName\":\"MalwareScan\"}"
      }
    }
  ],
  "urls": []
}
Zitieren


Gehe zu:


Benutzer, die gerade dieses Thema anschauen: 1 Gast/Gäste