TOPIC:

I recently became unable to send email to club aliases. Has MailChannels.net been blocked? Part of bounce message copied below.

Thanks,
Paul
Club #3491 - eastsidetoastmasters.org

<This email address is being protected from spambots. You need JavaScript enabled to view it.>: host
mail.eastsidetoastmasters.org[50.19.253.65] refused to talk to me: 421
Downstream server error
Reporting-MTA: dns; relay.mailchannels.net
X-Postfix-Queue-ID: 07AC6641D4C
Arrival-Date: Thu, 17 Dec 2020 15:51:22 +0000 (UTC)

we are not blocking any of the 4 reporting IP addresses

A-->mx1.mailchannels.net 44.241.163.138
A-->mx1.mailchannels.net 44.230.102.231
A-->mx2.mailchannels.net 34.218.143.220
A-->mx2.mailchannels.net 34.211.70.105

Thanks for your quick response. What about relay.mailchannels.net? Any other ideas why I am unable to send email to the members alias? (I checked with another member, and he was able to send to the alias successfully.)

That does not post as a valid email domain for your email address.
It is not listed as one of your valid MX records.

we are not blocking
relay.mailchannels.net. 300 IN A 216.19.178.99

You need to post the entire email header if you want me to look further.

Here are the full headers:

<This email address is being protected from spambots. You need JavaScript enabled to view it.>: host
mail.eastsidetoastmasters.org[50.19.253.65] refused to talk to me: 421
Downstream server error
Reporting-MTA: dns; relay.mailchannels.net
X-Postfix-Queue-ID: 07AC6641D4C
X-Postfix-Sender: rfc822; This email address is being protected from spambots. You need JavaScript enabled to view it.
Arrival-Date: Thu, 17 Dec 2020 15:51:22 +0000 (UTC)

Final-Recipient: rfc822; This email address is being protected from spambots. You need JavaScript enabled to view it.
Original-Recipient: rfc822;This email address is being protected from spambots. You need JavaScript enabled to view it.
Action: failed
Status: 4.0.0
Remote-MTA: dns; mail.eastsidetoastmasters.org
Diagnostic-Code: smtp; 421 Downstream server error
Return-Path: <This email address is being protected from spambots. You need JavaScript enabled to view it.>
Received: from relay.mailchannels.net (localhost [127.0.0.1])
by relay.mailchannels.net (Postfix) with ESMTP id 07AC6641D4C
for <This email address is being protected from spambots. You need JavaScript enabled to view it.>; Thu, 17 Dec 2020 15:51:22 +0000 (UTC)
Received: from pdx1-sub0-mail-a27.g.dreamhost.com (100-105-161-17.trex.outbound.svc.cluster.local [100.105.161.17])
(Authenticated sender: dreamhost)
by relay.mailchannels.net (Postfix) with ESMTPA id 5233F641D4A
for <This email address is being protected from spambots. You need JavaScript enabled to view it.>; Thu, 17 Dec 2020 15:51:21 +0000 (UTC)
X-Sender-Id: dreamhost|x-authsender|paul@kromann.net
Received: from pdx1-sub0-mail-a27.g.dreamhost.com (pop.dreamhost.com
[64.90.62.162])
(using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384)
by 0.0.0.0:2500 (trex/5.18.11);
Thu, 17 Dec 2020 15:51:21 +0000
X-MC-Relay: Neutral
X-MailChannels-SenderId: dreamhost|x-authsender|paul@kromann.net
X-MailChannels-Auth-Id: dreamhost
X-Industry-Tank: 26761cec3e4b6d04_1608220281592_3543373839
X-MC-Loop-Signature: 1608220281592:2558179006
X-MC-Ingress-Time: 1608220281592
Received: from pdx1-sub0-mail-a27.g.dreamhost.com (localhost [127.0.0.1])
by pdx1-sub0-mail-a27.g.dreamhost.com (Postfix) with ESMTP id 9DEF87F6A3
for <This email address is being protected from spambots. You need JavaScript enabled to view it.>; Thu, 17 Dec 2020 07:51:20 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=kromann.net; h=from
:content-type:mime-version:subject:message-id:date:to; s=
kromann.net; bh=J++MlwO5GyZ/705f8W2y1dZP2Og=; b=G33FNfchUHhEb49m
DQfJafmGMpQo6butFsOR6JwhcUvHmSqVNEs6U7H47BXXWnnwSznqNd+ANi6ixDrR
ULzTL9LnaQvlsnHE+sn3+eZq5+/vhXggcVl7cHE4GElwvEGyJAWIHqtoNoURDJ/U
zZtus2hnVmakc4XUJeJBHFh8Gxg=
Received: from [192.168.1.13] (unknown [50.35.71.179])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
(Authenticated sender: This email address is being protected from spambots. You need JavaScript enabled to view it.)
by pdx1-sub0-mail-a27.g.dreamhost.com (Postfix) with ESMTPSA id 877CC7F113
for <This email address is being protected from spambots. You need JavaScript enabled to view it.>; Thu, 17 Dec 2020 07:51:20 -0800 (PST)
X-DH-BACKEND: pdx1-sub0-mail-a27
From: Paul Kromann <This email address is being protected from spambots. You need JavaScript enabled to view it.>
Content-Type: multipart/alternative;
boundary="Apple-Mail=_A718419B-509E-4FC7-87E1-5CCA59B939E4"
Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.40.0.2.32\))
Subject: Reminder: Prepare for tonight's Winter Holiday Party!
Message-Id: <This email address is being protected from spambots. You need JavaScript enabled to view it.>
Date: Thu, 17 Dec 2020 07:51:18 -0800
To: This email address is being protected from spambots. You need JavaScript enabled to view it.
X-Mailer: Apple Mail (2.3654.40.0.2.32)

Also, my understanding is that the MX records for kromann.net are / should be:

mx1.mailchannels.net
mx2.mailchannels.net

And an SPF TXT record:

v=spf1 mx include:netblocks.dreamhost.com include:relay.mailchannels.net -all

I'm not an expert in mail routing, but my understanding is that this should indicate relay.mailchannels.net as a valid server for kromann.net email.

I have successfully sent email to FTH aliases over the past 6 months. Now something suddenly changed within the past week so that I can no longer send mail using this address. Any idea why my email is being rejected?

We are not blocking
A-->mx1.mailchannels.net 44.241.163.138
A-->mx1.mailchannels.net 44.230.102.231
A-->mx2.mailchannels.net 34.218.143.220
A-->mx2.mailchannels.net 34.211.70.105
or
relay.mailchannels.net. 300 IN A 216.19.178.99

No we will not open every IP dreamhost has in its net block as they host too many spammers. Please use the valid email email relays.

What is a valid email relay? I'm not aware of using an invalid one. Are you suggesting that I not use Dreamhost for email?

I don't know what dream host is doing but this is the IP you sent from

Received: from pdx1-sub0-mail-a27.g.dreamhost.com (100-105-161-17.trex.outbound.svc.cluster.local [100.105.161.17])

Is that IP blocked (and the reason why the connection is refused)?

Here is a line from the headers of a message that sent successfully last week:
Received: from pdx1-sub0-mail-a35.g.dreamhost.com (100-96-87-21.trex.outbound.svc.cluster.local [100.96.87.21])

Is that IP not blocked?

My client uses smtp.dreamhost.com to send email.

Hi,

I'm still unable to send email to aliases at eastsidetoastmasters.org. This is the same issue as posted here: support.toastmastersclubs.org/2011-10-23...-members-alias#82217

But that thread was locked, so I'm creating a new one.

Can you please help me understand whether something has changed that has caused my email to stop working? Are you specifically blocking Dreamhost IP addresses? Can you confirm that you added or changed the block list recently?

My email was working fine for 5 months before December. Now it doesn't. If this is something you can fix on FTH side, I would appreciate it. If you're telling me that this is something that you can't or won't fix, then I will need to look into workarounds.

Thanks,
Paul

The block list is dynamic and is constantly changing as spammers move from datacenter to datacenter.
If your email followed to rules by using IP listed in your MX or A records you would not have a problem.
Datacenters that ask their people to use open blocks of IP know they host spammers and this is their solution until it doesn't work anymore.

This issue has been frustrating for me. Perhaps it's because I see other support requests where you've provided specific information about what happened and managed to find a way to resolve their issue. Meanwhile, I've received opaque responses that fail to point to any specific root cause. Instead, I'm accused of having email that doesn't follow the rules and is hosted by datacenters that are havens for spammers.

I've been using the same email host for almost 15 years without issues, including half a year using FTH. Then suddenly in December it stopped working with FTH. As president of our club, who regularly sends emails to our members, this is very inconvenient for me. I would like to find out why it stopped working.

Do you have any specific information that you can provide to me to indicate what exactly is causing my email to be refused? I would very much appreciate it.

Paul

Your emails are not coming from the advertised IP for your domain.
We are not blocking email from these IP addresses which are the IP advertised by your DNS.

A 208.113.163.242
MX (0) mx1.mailchannels.net
MX (0) mx2.mailchannels.net
A-->mx1.mailchannels.net 44.241.163.138
A-->mx1.mailchannels.net 44.230.102.231
A-->mx2.mailchannels.net 44.230.102.231
A-->mx2.mailchannels.net 44.241.163.138

paul wrote:

This issue has been frustrating for me. Perhaps it's because I see other support requests where you've provided specific information about what happened and managed to find a way to resolve their issue. Meanwhile, I've received opaque responses that fail to point to any specific root cause. Instead, I'm accused of having email that doesn't follow the rules and is hosted by datacenters that are havens for spammers.
Paul

Paul, please do not take any of our posts personally. We know that most people don't realize (or don't consider it) that their email service might be a spammer (or may use a data center that is a spammer) when they choose an email service. It is an unfortunate fact that we sometimes have to be the ones to deliver the bad news when our server gets hammered with spam which triggers the IP address block.

Also, we really have to have the automated email security protection schemes in place for the server to keep the FTH platform viable for the long run. If we loosened our server security, the server would get hammered to the point where it would slow down considerably and none of the system users would want to use FTH anymore. (because they would also get much of the spam that we are currently blocking)

We do the best we can to help our users given what we have to work with, and depending on our users technical savviness and ability to provide us key troubleshooting information. I always tell users to be patient and persistent with us. Remember that we are volunteers and also Toastmasters members like you. I know that Brian does want to help you get your issue resolved and he is the best guy to help you with this. Please hang in there with us.

Brian, Steve,

Thanks for your responses. I'm really trying not to take it personally. I understand you are volunteers, and I already appreciate the support and patience you have provided so far. At the same time, I want to let you know that it's still frustrating having my expectations set by other forum posts that have had similar issues resolved (albeit temporarily) while after all this time I'm still at a loss as to why my emails are being rejected. That being said, I will try to be patient if you will be patient with me. And if you invite me to be persistent, then I will be persistent!

On to the technical puzzle…

From Brian's most recent reply, he suggests that my emails are not coming from the advertised IP for my domain. This suggests that it is not an IP block issue but a DNS/delivery issue. In that case, I have the following questions:

First, email headers from previous emails that I successfully sent to the members alias (and which includes a return to myself) suggest that nothing has meaningfully changed from how my email is delivered to your servers. Why would it suddenly stop working in December?

Second, I don't understand why email delivered to your servers must come from IP addresses that match the MX records of the sender's domain. My understanding is that the MX records are for discovering delivery targets for a domain and does not necessarily have anything to do with how email is delivered from users in a domain. Assuming I have a proper understanding of MX records, why would your servers reject emails that don't come from addresses advertised in MX records? (And it would suggest that you'd have a lot more people unable to send email if you were really doing this, so I'm not convinced that your servers are even doing it.)

Third, my domain should support SPF and DKIM to authenticate sent email. Is this not being used, or is it failing, or is it somehow not sufficient?

I hope you can see where I'm coming from. The issue still seems very opaque to me. The only thing I have is a 421 error that eventually times out after several hours when the relay stops trying. My understanding from internet searches is that this is a common "soft bounce" method of rejecting spammers who would typically not stick around to keep retrying after a 421 error. If this is what your server is doing to my email, why do your servers think my email is spam?

Thanks,
Paul

Please contact Dreamhost and get the EXACT IP addresses that your account will send email from and I will check if those are blocked.

Putting every IP that dreamhost owns is not creating a valid spf record
include:netblocks.dreamhost.com include:relay.mailchannels.net is not a valid spf.

Here are some of the headers from an email recently sent to a hotmail address. Do these help answer your request? Meanwhile, I can ping Dreamhost again.

Authentication-Results: spf=pass (sender IP is 23.83.212.6) smtp.mailfrom=kromann.net; hotmail.com; dkim=pass (signature was verified) header.d=kromann.net;hotmail.com; dmarc=bestguesspass action=none header.from=kromann.net;compauth=pass reason=109
Received-Spf: Pass (protection.outlook.com: domain of kromann.net designates 23.83.212.6 as permitted sender) receiver=protection.outlook.com; client-ip=23.83.212.6; helo=aye.elm.relay.mailchannels.net;

Yes 23.83.212.6 was blocked I have removed the block for that IP.

That is one issue with using cheap shared hosting, you are put on the same services as spammers and hackers.

Thanks. But, I wonder whether this will be sufficient. The mail is being sent via mailchannels.net, and it appears that the IP address could rotate to load balance.

Here is another record from another email with another IP address:
Received-Spf: Pass (protection.outlook.com: domain of kromann.net designates 23.83.209.25 as permitted sender) receiver=protection.outlook.com; client-ip=23.83.209.25; helo=bumble.birch.relay.mailchannels.net;

Is this IP also blocked? If so, I wonder if it's not necessarily Dreamhost that is being blocked but the entire (or most of the) block of relay.mailchannels.net IP addresses. And if so, why? What does it take to get an IP on your blocklist? What would it take to give relay.mailchannels.net the green light again?

As I said using a shared system you are sharing the mail service with spammers. You need to talk to your host to get your email sent from same IP all the time. They are the ones hosting the spammers which we have to defend against.

Brian wrote:

As I said using a shared system you are sharing the mail service with spammers. You need to talk to your host to get your email sent from same IP all the time. They are the ones hosting the spammers which we have to defend against.

Hi Brian,
I'm the CEO of MailChannels. We use extensive technology to get rid of spam and phishing before it goes out the door. If you have any concerns about email received from our netblocks, please send samples to This email address is being protected from spambots. You need JavaScript enabled to view it. and a real human will review the message and make sure it's followed up.

We do ask our customers to configure an all-inclusive SPF record because we send traffic from over 4,000 IPs on behalf of 2.5 million domain owners; the IPs are all shared. No customer has a dedicated IP.

Thanks and good luck.

I will remove your IP blocks for now, but all future spam from mailchannels.com will be forwarded to you personally and the spamming server IP range blocked.

Thank you! I have since sent mail successfully to the member aliases several times.

Paul