O365 - Spamhaus

[CapnPugwash]

O365 & Exchange 2010 in hybrid config.

 

Run the HCF without issue & have dirsync correctly syncing users/passwords with AD.

Got my ISP to open relevant firewall ports (tied to relevant MSoft IP's) & change DNS records.

 

Migrated a test users' mail box from within Exchange Management Console - no issues. logged into O365 as test user and sent emails to internal / external accounts & sent test emails from internal accounts to the test user.

 

Everything is 'proper nice' for ... 40 minutes ... and then emails sent from an internal address to the test user are bounced back with this message:

 

Your message wasn't delivered due to a permission or security issue. It may have been rejected by a moderator, the address may only accept e-mail from certain senders, or another restriction may be preventing delivery.

The following organisation rejected your message: mail.protection.outlook.com.

 

Client host [iP] blocked using Spamhaus; To request removal from this list see http://www.spamhaus.org/lookup.lasso> #SMTP#

 

Checked Spamhaus & the IP (not one of our public facing IP addresses but definitely belonging to our ISP) was on a list.

 

tried sending other test emails from the same address to Gmail, Hotmail, O365 accounts - all went through without issue. The only emails that triggered the Spamhaus bounce back were sent from Exchange to O365...

 

Our ISP put in a request to Spamhaus to have the IP address unblocked and now everything is fine... but I don't understand : why it happened in the first place; why it happened shortly after having our DNS records changed (but not immediately) and why it seemed to only affect emails sent from [email protected] to [email protected] where user1 has an onsite Exchange mailbox and user2 has an O365 mailbox...

 

Merry Christmas!

[CapnPugwash]

Ah... all sorted. Something went slightly wrong when I migrated the test mailbox (it ended up with the wrong SMTP address)

 

The IP address that triggered the message from Spamhaus is a router that our ISP push all 'badly configured' email through.

 

I've migrated a bunch of other test mail boxes now with no issue.

 

Phew

[CapnPugwash]

But ... not ... quite

 

"The IP address that triggered the message from Spamhaus is a router that our ISP push all 'badly configured' email through"

 

so, this router that our ISP push 'bad' email through gets blocked by Spamhaus. But then someone will request the IP be unblocked and everything will seem fine. Until it's blocked again. And this goes on and on.

 

So I thought I had my issue resolved but it wasn't, the IP of the honeypot router was just taken off the Spamhaus block list for a few hours.

 

Digging deeper into my problem, I could see that (1) my ISP routes all email through a smart host and (2) my O365 send connector wasn't pointing to it. That's why the internal emails from an the an on-site mail account to a mail account in our O365 cloud were classed as 'bad'

 

So I added the address of the smart host to the O365 outbound send connector & now emails sent from an onsite mail account to a O365 account... don't seem to go anywhere.

 

I enabled verbose logging on the O365 outbound send connector, sent a test emails and checked the log. The outward bound email hits the smart host but doesn't get any further because:

 

"Connector is configured to send mail only over TLS connections and remote doesn't support TLS"

 

I opened a telnet session and connected to the smart host and sent an EHLO testing message... connection was successful but I don't get any info back about TLS (no STARTTLS etc)

 

I have to say , this has all been very... trying.

[CapnPugwash]

Just been through this with Microsoft support (who, to be honest, have been consistently good throughout this process - put in a support request & it's guaranteed that someone will phone within an hour or so) & created a new send connector with TLS turned off & everything *seems* to be working fine

 

Hope someone, some day, finds some of this useful!