Mails von Sky Ticket werden abgelehnt

[H.Glohr]

Hallo,

ein Kunde versucht sein Passwort bei Sky zurückzusetzen und die Mail kommt nicht an.
Wird Permanent abgelehnt.

Hab dann eine Regel angelegt: Malwarescanning /No Content filtering mit from: sky-rt1@realtime.message.nowtv.com to Mailadresse vom Kunden

Abgelehnt wird trotzdem

Mal ein paar Meldungen:
Mit der Absenderadresse 172.82.236.130 ist ein mittleres Risiko verbunden.  Cyren-Referenz-ID kopieren

Die E-Mail wurde permanent abgelehnt mit der folgenden Antwort .
5.7.1 This email was rejected because it violates our security policy
5.7.1  Cyren AntiSpam Services considered this email to be Spam (Reference id str=0001.0A702F1A.62B99101.0049,ss=4,sh,re=0.000,recu=0.000,reip=0.000,cl=4,cld=1,fgs=8.
5.7.1  The reputation filter deemed your email unworthy.


Die eingehende Verbindung wurde nicht durch TLS gesichert.


Wir haben jetzt auch mal ne Mail an diese Adresse gesendet. 

Was kann man tun um die Mails zu bekommen.

Gruß Heiko

 

[ffischer]

Hallo Heiko,
Ist die Adresse immer von sky-rt1@realtime.message.nowtv.com ?

 

[H.Glohr]

Ja das ist die Mailadresse von der dann wahrscheinlich der Link zum zurücksetzen des Passworts kommt

 

[ffischer]

Ist das auch die Adresse aus dem MailFrom ?

 

[H.Glohr]

Wie meinst Du das 
Adresse aus dem Mailforum 

Die Mailadresse ist von einem Kunden von mir

 

[ffischer]

Zeig doch mal bitte hier den MessageTrack.
Ziel Adresse kannst du ja unkenntlich machen

 

[H.Glohr]

{
  "productInformation": {
    "name": "NoSpamProxy",
    "suffix": null,
    "version": "14.0.0.4297",
    "components": [
      {
        "name": "Intranet Role",
        "version": "14.0.22153.1058"
      },
      {
        "name": "PowerShell",
        "version": "14.0.22153.1058"
      },
      {
        "name": "NoSpamProxy Control Center",
        "version": "14.0.21321.1539"
      },
      {
        "name": "NoSpamProxy Command Center",
        "version": "14.0.22153.1058"
      },
      {
        "name": "Message Tracking Service",
        "version": "1.1.11.53587"
      },
      {
        "name": "Management services",
        "version": "14.0.22153.1058"
      }
    ]
  },
  "sender": {
    "localPart": "sky-rt1",
    "domain": "realtime.message.nowtv.com"
  },
  "headerFrom": {
    "localPart": "no-reply",
    "domain": "servicecomms.wowtv.de"
  },
  "mailId": "26c36d74-79cc-405b-9b5b-4de83ba730a4",
  "messageId": "<NM6068E896D0C600360sky_rt1@realtime.message.nowtv.com>",
  "size": 28524,
  "subject": "Jetzt dein WOW Passwort zurücksetzen",
  "signed": "None",
  "encrypted": "None",
  "sent": "2022-06-27T18:17:48.89+02:00",
  "processingTime": "00:00:01.7300000",
  "status": "PermanentlyBlocked",
  "ruleName": "All other inbound emails",
  "scl": 6,
  "validationStatus": "RejectPermanent",
  "rejectReason": "SpamOrVirus",
  "cyrenReferenceId": "str=0001.0A742F1A.62B99255.0049,ss=4,sh,re=0.000,recu=0.000,reip=0.000,cl=4,cld=1,fgs=8",
  "processingGatewayRole": "Gateway Role 2",
  "receiveConnectorName": "SMTP on all addresses",
  "clientIPAddress": "185.15.49.37",
  "wasReceivedFromRelayServer": false,
  "detailsWereDeleted": false,
  "urlSafeguardInfoWasDeleted": false,
  "firstDeliveryAttempt": null,
  "deliveryDurationInSeconds": null,
  "deliveryAttempts": [
    {
      "recipient": "xxx@schleicher-ag.com",
      "deliveryDate": "2022-06-27T18:17:48.89+02:00",
      "status": "PermanentlyBlocked",
      "dane": "None",
      "statusMessage": "5.7.1 This email was rejected because it violates our security policy\r\n5.7.1  Cyren AntiSpam Services considered this email to be Spam (Reference id str=0001.0A742F1A.62B99255.0049,ss=4,sh,re=0.000,recu=0.000,reip=0.000,cl=4,cld=1,fgs=8.\r\n5.7.1  The reputation filter deemed your email unworthy.",
      "sendConnector": null,
      "tlsCipherSuite": null,
      "tlsProtocol": null
    }
  ],
  "levelOfTrust": {
    "domainBonus": 0,
    "addressPairingBonus": 0,
    "messageIdBonus": 0,
    "subjectBonus": 0,
    "dsnPoints": 0,
    "mailIsTrusted": false,
    "scl": 0,
    "senderDomainIsFreeMailer": false,
    "isSenderAuthenticated": true,
    "addressPairingIsWildcardEntry": false,
    "wasHeaderFromAddressUsedForValidation": true
  },
  "actions": [
    {
      "name": "Disclaimer anwenden",
      "time": "00:00:00.0000000",
      "decision": "Pass"
    },
    {
      "name": "Malware-Scanner",
      "time": "00:00:00.2300000",
      "decision": "Pass"
    },
    {
      "name": "S/MIME- und PGP-Überprüfung sowie Entschlüsselung (vorzugsweise eingehend)",
      "time": "00:00:00.0000000",
      "decision": "Pass"
    },
    {
      "name": "32Guards",
      "time": "00:00:00.3300000",
      "decision": "Pass"
    },
    {
      "name": "Greylisting",
      "time": "00:00:00.0000000",
      "decision": "Pass"
    }
  ],
  "attachments": [],
  "filters": [
    {
      "name": "Cyren AntiSpam",
      "time": "00:00:00.0000000",
      "scl": 4,
      "message": "Cyren AntiSpam Services considered this email to be Spam (Reference id str=0001.0A742F1A.62B99255.0049,ss=4,sh,re=0.000,recu=0.000,reip=0.000,cl=4,cld=1,fgs=8."
    },
    {
      "name": "Cyren IP Reputation",
      "time": "00:00:00.1800000",
      "scl": 0
    },
    {
      "name": "Echtzeit-Blocklisten",
      "time": "00:00:00.7800000",
      "scl": 0
    },
    {
      "name": "32Guards",
      "time": "00:00:00.3300000",
      "scl": 0
    },
    {
      "name": "Spam URI Realtime Blocklists",
      "time": "00:00:00.0400000",
      "scl": 0
    },
    {
      "name": "CSA Certified IP List",
      "time": "00:00:00.0000000",
      "scl": 0
    },
    {
      "name": "Reputationsfilter",
      "time": "00:00:00.1800000",
      "scl": 2,
      "message": "The reputation filter deemed your email unworthy."
    }
  ],
  "operations": [
    {
      "created": "2022-06-27T16:17:52.087+02:00",
      "operation": {
        "idStr": "-5932287954691244147",
        "type": "GreylistingActionEntry",
        "data": "{\"$type\":\"GreylistingActionEntry\",\"isSclThresholdExceeded\":true,\"isMailAlreadyRejected\":true,\"isMailActionDeterminedBySenderAddressReputation\":false,\"mailAction\":\"None\",\"senderNetwork\":\"185.15.49.0/24\",\"senderAddress\":\"sky-rt1@realtime.message.nowtv.com\",\"details\":[],\"isActionExecuted\":false,\"typeName\":\"GreylistingActionEntry\"}"
      }
    },
    {
      "created": "2022-06-27T16:17:52.087+02:00",
      "operation": {
        "idStr": "-4522142505438085873",
        "type": "Heimdall",
        "data": "{\"$type\":\"HeimdallValidationEntry\",\"aggregatedAction\":\"None\",\"aggregatedEmailAction\":\"None\",\"emailResults\":[],\"aggregatedAttachmentAction\":\"None\",\"attachmentResults\":[],\"aggregatedUrlAction\":\"None\",\"urlResults\":[],\"typeName\":\"Heimdall\"}"
      }
    },
    {
      "created": "2022-06-27T16:17:52.087+02:00",
      "operation": {
        "idStr": "-2547101493565979525",
        "type": "DmarcValidationEntry",
        "data": "{\"$type\":\"DmarcValidationEntry\",\"effectivePolicy\":\"None\",\"rfc5322FromDomain\":\"servicecomms.wowtv.de\",\"validationResult\":\"Success\",\"organizationalDomain\":\"wowtv.de\",\"dkimResult\":[{\"failures\":\"None\",\"authenticatedDomain\":\"servicecomms.wowtv.de\",\"signatureAlgorithm\":\"RsaSha256\",\"selector\":\"nowtv\"}],\"spfResult\":[{\"result\":\"Pass\",\"domain\":\"realtime.message.nowtv.com\"},{\"result\":\"None\",\"domain\":\"r37.realtime.message.nowtv.com\"}],\"spfValidationStatus\":\"Validated\",\"dkimAlignment\":true,\"spfAlignment\":false,\"applicablePolicy\":\"Reject\",\"arcDmarcOverride\":\"None\",\"typeName\":\"DmarcValidationEntry\"}"
      }
    },
    {
      "created": "2022-06-27T16:17:52.087+02:00",
      "operation": {
        "idStr": "1460644528635058366",
        "type": "DnsValidationEntry",
        "data": "{\"$type\":\"DnsValidationEntry\",\"senderAddress\":\"185.15.49.37\",\"hasMailFromDomainARecord\":true,\"mailFromDomainARecordValue\":\"a.mx.p49.neolane.net (54.216.247.111), b.mx.p49.neolane.net (54.194.136.217)\",\"hasPtrRecord\":true,\"isPtrRecordValid\":true,\"ptrRecordValue\":\"r37.realtime.message.nowtv.com\",\"isPtrRecordForwardLookupValid\":true,\"ptrRecordForwardLookupValue\":\"185.15.49.37\",\"typeName\":\"DnsValidationEntry\"}"
      }
    },
    {
      "created": "2022-06-27T16:17:52.087+02:00",
      "operation": {
        "idStr": "1925942815259604875",
        "type": "ConnectionValidation",
        "data": "{\"$type\":\"ConnectionValidationEntry\",\"isConnectionSecured\":false,\"typeName\":\"ConnectionValidation\"}"
      }
    },
    {
      "created": "2022-06-27T16:17:52.087+02:00",
      "operation": {
        "idStr": "2245823448168135288",
        "type": "CyrenIpReputationFilterEntry",
        "data": "{\"$type\":\"CyrenIpReputationFilterEntry\",\"ipAddress\":\"185.15.49.37\",\"referenceId\":\"tid=0001.0A742F91.62B9D82E.001B\",\"riskLevel\":10,\"recommendedAction\":\"Accept\",\"ipRange\":\"185.15.49.37-185.15.49.37\",\"ipClass\":\"T1\",\"volume\":{\"item1\":0,\"item2\":4,\"item3\":3},\"spamRatio\":{\"item1\":0,\"item2\":0},\"validBulkRatio\":92,\"typeName\":\"CyrenIpReputationFilterEntry\"}"
      }
    },
    {
      "created": "2022-06-27T16:17:52.087+02:00",
      "operation": {
        "idStr": "2781974209339456166",
        "type": "SenderRecipientValidationEntry",
        "data": "{\"$type\":\"SenderRecipientValidationEntry\",\"localAddresses\":[],\"ownedDomainsInHeaderFromDisplayName\":[],\"dnsValidationResultWithAddress\":{\"result\":\"Success\"},\"headerFromContainsAngleBracketsWithInvalidEmailAddress\":false,\"headerFromIsInvalidWithEmptyMailFrom\":false,\"headerFromContainsMultipleAddresses\":false,\"headerFromDisplayNameContainsDomainDifferentFromEmailAddress\":false,\"headerToContainsAtSignOutsideOfEmailAddress\":false,\"headerToContainsAngleBracketsWithInvalidEmailAddress\":false,\"headerToIsEmpty\":false,\"headerFromOrToContainMultipleUnicodeLanguagePlanes\":false,\"headerToDoesNotContainLocalUser\":false,\"typeName\":\"SenderRecipientValidationEntry\"}"
      }
    },
    {
      "created": "2022-06-27T16:17:52.087+02:00",
      "operation": {
        "idStr": "3450297006487783862",
        "type": "MalwareScan",
        "data": "{\"$type\":\"MalwareScanValidationEntry\",\"cyrenZeroHourClassification\":{\"spamClassification\":\"Confirmed\",\"virusClassification\":\"Unknown\",\"threatCount\":0,\"detectedThreatType\":\"None\",\"detectedThreatAccuracy\":\"None\",\"threatName\":\"\"},\"action\":\"Pass\",\"infectedMailParts\":[],\"availableScanners\":\"Cyren, Filebased, CyrenZeroHour\",\"hasAdministrativeNotificationBeenSent\":false,\"typeName\":\"MalwareScan\"}"
      }
    }
  ],
  "urls": []
}

 

[H.Glohr]

Problem gelöst.

Hab jetzt in der Regel auch mal die IP Adresse eingetragen und jetzt ging die durch.

Danke für die Unterstützung

 

[ffischer]

Hallo,
gerne.
Eventuell auch mal die eingehende Mail die nicht durch gegangen ist als FalsePostive melden.

 

[H.Glohr]

Hallo,
ich hab wieder eine Domain, die sobald die eine Excel schicken permanent abgelehnt werden.

Ich lese aus dem Track irgendwie, dass die Domain auf ner RBL List steht. Konnte das aber nicht verifizieren.

RBL List Check ist grün!!


{
  "productInformation": {
    "name": "NoSpamProxy",
    "suffix": null,
    "version": "14.0.0.4297",
    "components": [
      {
        "name": "Intranet Role",
        "version": "14.0.22153.1058"
      },
      {
        "name": "PowerShell",
        "version": "14.0.22153.1058"
      },
      {
        "name": "NoSpamProxy Control Center",
        "version": "14.0.21321.1539"
      },
      {
        "name": "NoSpamProxy Command Center",
        "version": "14.0.22153.1058"
      },
      {
        "name": "Message Tracking Service",
        "version": "1.1.11.53587"
      },
      {
        "name": "Management services",
        "version": "14.0.22153.1058"
      }
    ]
  },
  "sender": {
    "localPart": "marketing",
    "domain": "landhotel-altes-zollhaus.com"
  },
  "headerFrom": {
    "localPart": "marketing",
    "domain": "landhotel-altes-zollhaus.com"
  },
  "mailId": "649a2da8-f6ca-4f28-aeda-bad34425a170",
  "messageId": "<1656673612.61808713@f36.my.com>",
  "size": 17189,
  "subject": "Fwd: Re: AW: Kasse",
  "signed": "None",
  "encrypted": "None",
  "sent": "2022-07-01T13:06:52.227+02:00",
  "processingTime": "00:00:00.5200000",
  "status": "PermanentlyBlocked",
  "ruleName": "All other inbound emails",
  "scl": 8,
  "validationStatus": "RejectPermanent",
  "rejectReason": "SpamOrVirus",
  "cyrenReferenceId": "str=0001.0A742F1D.62BED54D.001A,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0",
  "processingGatewayRole": "Gateway Role 2",
  "receiveConnectorName": "SMTP on all addresses",
  "clientIPAddress": "185.30.177.236",
  "wasReceivedFromRelayServer": false,
  "detailsWereDeleted": false,
  "urlSafeguardInfoWasDeleted": false,
  "firstDeliveryAttempt": null,
  "deliveryDurationInSeconds": null,
  "deliveryAttempts": [
    {
      "recipient": "xxxxxxxxxxxxxx@xxxx.de",
      "deliveryDate": "2022-07-01T13:06:52.227+02:00",
      "status": "PermanentlyBlocked",
      "dane": "None",
      "statusMessage": "5.7.1 This email was rejected because it violates our security policy\r\n5.7.1  Remotehost is listed in the following RBL lists: NixSpam RBL, SpamCop",
      "sendConnector": null,
      "tlsCipherSuite": null,
      "tlsProtocol": null
    }
  ],
  "levelOfTrust": {
    "domainBonus": 0,
    "addressPairingBonus": 0,
    "messageIdBonus": 0,
    "subjectBonus": 0,
    "dsnPoints": 0,
    "mailIsTrusted": false,
    "scl": 0,
    "senderDomainIsFreeMailer": false,
    "isSenderAuthenticated": false,
    "addressPairingIsWildcardEntry": false,
    "wasHeaderFromAddressUsedForValidation": false
  },
  "actions": [
    {
      "name": "Malware-Scanner",
      "time": "00:00:00.3100000",
      "decision": "Pass"
    },
    {
      "name": "S/MIME- und PGP-Überprüfung sowie Entschlüsselung (vorzugsweise eingehend)",
      "time": "00:00:00.0000000",
      "decision": "Pass"
    }
  ],
  "attachments": [],
  "filters": [
    {
      "name": "Echtzeit-Blocklisten",
      "time": "00:00:00.1000000",
      "scl": 8,
      "message": "Remotehost is listed in the following RBL lists: NixSpam RBL, SpamCop"
    },
    {
      "name": "Cyren IP Reputation",
      "time": "00:00:00.0100000",
      "scl": 0
    },
    {
      "name": "CSA Certified IP List",
      "time": "00:00:00.0000000",
      "scl": 0
    }
  ],
  "operations": [
    {
      "created": "2022-07-01T11:06:55.873+02:00",
      "operation": {
        "idStr": "-4807853949402070425",
        "type": "CyrenIpReputationFilterEntry",
        "data": "{\"$type\":\"CyrenIpReputationFilterEntry\",\"ipAddress\":\"185.30.177.236\",\"referenceId\":\"tid=0001.0A782F93.62BED54D.0006\",\"riskLevel\":10,\"recommendedAction\":\"Accept\",\"ipRange\":\"185.30.177.236-185.30.177.236\",\"ipClass\":\"T1\",\"volume\":{\"item1\":0,\"item2\":5,\"item3\":4},\"spamRatio\":{\"item1\":0,\"item2\":1},\"validBulkRatio\":19,\"typeName\":\"CyrenIpReputationFilterEntry\"}"
      }
    },
    {
      "created": "2022-07-01T11:06:55.873+02:00",
      "operation": {
        "idStr": "-3358635336178798622",
        "type": "MalwareScan",
        "data": "{\"$type\":\"MalwareScanValidationEntry\",\"cyrenZeroHourClassification\":{\"spamClassification\":\"Unknown\",\"virusClassification\":\"Unknown\",\"threatCount\":0,\"detectedThreatType\":\"None\",\"detectedThreatAccuracy\":\"None\",\"threatName\":\"\"},\"action\":\"Pass\",\"infectedMailParts\":[],\"availableScanners\":\"Cyren, Filebased, CyrenZeroHour\",\"hasAdministrativeNotificationBeenSent\":false,\"typeName\":\"MalwareScan\"}"
      }
    }
  ],
  "urls": []
}

 

[ffischer]

Hallo,
also wenn ich das korrekt seh ist sender IP

"type": "CyrenIpReputationFilterEntry",
"data": "{\"$type\":\"CyrenIpReputationFilterEntry\",\"ipAddress\":\"185.30.177.236\",\"referenceId\":\"tid=0001.0A782F93.62BED54D.0006\",\"riskLevel\":10,\"recommendedAction\":\"Accept\",\"ipRange\":\"185.30.177.236-185.30.177.236\",\"ipClass\":\"T1\",\"volume\":{\"item1\":0,\"item2\":5,\"item3\":4},\"spamRatio\":{\"item1\":0,\"item2\":1},\"validBulkRatio\":19,\"typeName\":\"CyrenIpReputationFilterEntry\"}"

die ist auf der Blacklist
aber auch vom Absender oben ist der MX auf einer Blacklist UCEPROTECTL3

 

[H.Glohr]

Hallo,

ich hab das auch so rausgelesen aber der Kunde musste sich anhören, dass seine IP Profis sein System in Ordnung bringen sollen.
Ich gebs mal so weiter

Danke!
Heiko

 

[ffischer]

Hallo Heiko,
kein Problem.
Kommt die Mail wirklich von dem Absender ?

Einen SPF Eintrag hat der Absender oben mal nicht.
ein Rev.IP DNS Check für die IP bringt auch was komisches raus .. sitzt in den Niederlanden

 

[H.Glohr]

Ja das ist die Mailadresse von der es gesendet wird.
Die senden ihre Buchhaltung und Kassenbuch an Steuerberater und ich denke, dass da Excel Dateien drin sein müssten. Früher schickten die einen kompletten Ordner inkl. exe files. Ich geh mal von aus, dass deren Mailsystem nicht sauber konfiguriert ist.

Heiko

 

[ffischer]

ja das mag sein, aber wenn die das von sich aus schicken warum kommt dann eine Mail IP also Absender IP aus Niederlanden?
Wenn der MailServer des Absenders IONOS ist ?

 

[H.Glohr]

Möglicherweise hängt ein Emaildienst my.com dazwischen.
Keine Ahnung. Ist ja der Absender.
Ich lasse ihm mitteilen, dass mit seiner Mailkonfiguration ganz viel nicht stimmt. 
Dann müssen die handeln und nicht wir beim steuerberater.

Heiko

 

[ffischer]

Ja da gebe ich dir recht, daher finde ich das gut das NSP wenn ihm was nicht passt ablehnt.
Soll der Absender mal um eine korrekte Konfig. kümmern.

 

[H.Glohr]

Sehe ich genauso



Gruß Heiko