Helo PaperCut

[HCC]

Hi,

 

We use the PaperCut scan to email functions on a fleet of Sharp copiers, and its worked great for years. Recently scans and emails from PaperCut have started getting blocked by SpamHaus XBL list

Delivering scan images for scan job jobId failed with an error: Failed messages: javax.mail.SendFailedException: Invalid Addresses; nested exception is: com.sun.mail.smtp.SMTPAddressFailedException: 550 5.7.1 Service unavailable, Client host [External IP] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/[External IP] (AS16012611) [prod.protection.outlook.com] . See more details in the server log.

 

l can manually allow the external IP in this XBL list, but it then gets blocked again after a few days.

I manually allowed to get it to work again, then looked at an sent email header. I think the cause is the HELO=printserver.domain.local rather than being the external Public IP that's being used. This is what is described as the issue in the XBL IP lookup.

The listing of this IP is because it HELOs as a bare IP address (A bare ip address looks like: "54.33.33.5"). It is not HELO'ing as itself. Not only is this a violation of RFC2821/5321 section 4.1.1.1, it's even more frequently a sign of infection.

 

I've contacted PaperCut support but they suggested it's a network config problem. I've tried making a few changes to the PaperCut config - We use Office 365 and I remember it being a pain to set up in the first place but has been working for years. I have no access to the network config of the external IP addresses as that's at our ISP.

I can't find any way of setting the HELO in the email config of PaperCut

 

Does anyone have any ideas, how to permanently resolve so scanned emails work again without me often having to keep modifying a SpamHaus list?

[gds64]

Are you using the integrated scanning option within PaperCut, or just using PaperCut to provide user email details?

[robyholmes]

We moved to sending from a single account which authenticates directly with O365. If you can do this it'll save work trying to make exceptions in your spam filter.

[HCC]

This is using the integrated scanning option within PaperCut, but also effects any notification messages and emailed reports from PaperCut as well.

I have specified a 365 auth account in the PaperCut config but I'm not sure if this is used as we have it set up as Direct Send Option 2 described on this page.

Why can't Papercut just use a specified send account using modern auth rather than from email sender impersonation? I'm not surprised the antispam doesn't like what it's doing.

The other unknown is that the Public IP is used by other local schools, so it might not even be Papercut messages that are causing it to be blacklisted.

[robyholmes]

This is using the integrated scanning option within PaperCut, but also effects any notification messages and emailed reports from PaperCut as well.

I have specified a 365 auth account in the PaperCut config but I'm not sure if this is used as we have it set up as Direct Send Option 2 described on this page.

Why can't Papercut just use a specified send account using modern auth rather than from email sender impersonation? I'm not surprised the antispam doesn't like what it's doing.

The other unknown is that the Public IP is used by other local schools, so it might not even be Papercut messages that are causing it to be blacklisted.

On your scanning page you can set a single email with is how we do it with account authentication.

[Rob_D]

When we tried to use Office 365 account authentication it wouldn't work unless the auth account had send-as permissions for all our scan to email users.

 

This was the point we just switched over to scan to home drive and scan to onedrive (both of which work fine).

[Big_Ted]

It might be worth checking with spamhaus that your mail server is not flagged for sending spam. Pretty sure you specify an account for the "from" when using 0365 instead of impersonation. If it did work and nothing changed with papercut it would point to a config issue