Schools broadband/Netsweeper setup - Our now SMTP relay server not working

[MrWu]

Hi all

 

Been with this with schools broadband back and forth for a week tweaking settings with no success.

 

We have migrated over to their new lease line and cloud fortigate, and have restored ADFS, azure replication, WAP one by one by turning off Deep packet inspection, turning Netsweeper filter off for that server etc.

 

It’s just the SMTP relay server we use to forward copier scanning, finance notifications via email etc

 

We have turned Netsweeper filter off, allow port 25 for mail relay via schools broadband but still email is not relaying through the smtp server ...

 

We haven’t asked SB to turn off Deep packet inspection yet but could this be the cause ?

 

Any other settings I should ask them to turn off or tweak?

 

Many thanks !

[snagrat]

You definitively using port 25 and not 587?

[MrWu]

You definitively using port 25 and not 587?

 

Yes port 25 . Switching to my old ISP backup line on my smtp server for now (which is still running) as a test ...I’m sure it still sent stuff until the switch over to the new leaseline ..

[rich_tech]

have you added any spf entries into the external DNS entries for the IPs of the lines ? i had issues with an office365 mail relay when we changed our external IP address a while back

[MrWu]

have you added any spf entries into the external DNS entries for the IPs of the lines ? i had issues with an office365 mail relay when we changed our external IP address a while back

 

Ah I have the standard office spf txt record on our host, do I add our new external facing IP address to that record too?

[Blue_Cookeh]

What SMTP server are you using? If you're using postfix or something on a Linux box the logs should be quite verbose in what it's having trouble with. If you can see it's successfully connecting to Office365 (I'm just assuming you have a postfix server talking to Office365 like we do for relaying) then the issue is with Office365 and there should be more logs in your admin center for example.

 

You can see problems with `mailq` or by looking in somewhere like /var/log/postfix

 

If SPF was failing I'd expect mail to still arrive, but end up in spam.

[MrWu]

What SMTP server are you using? If you're using postfix or something on a Linux box the logs should be quite verbose in what it's having trouble with. If you can see it's successfully connecting to Office365 (I'm just assuming you have a postfix server talking to Office365 like we do for relaying) then the issue is with Office365 and there should be more logs in your admin center for example.

 

You can see problems with `mailq` or by looking in somewhere like /var/log/postfix

 

If SPF was failing I'd expect mail to still arrive, but end up in spam.

 

It’s a win2012 R2 box with IIS6 ... none has gone into SPAM but I will know for sure once swap the gateway to the old isp temporary (those old firewall rules worked before) if smtp Mail flows again, then I will know for sure Schools broadband is blocking it somewhere ...

[Blue_Cookeh]

Enable logs and take a look to see if it can even connect out: How To Check SMTP Logs in Windows Server (IIS)?

[MrWu]

Thank you all, you guided me to the right place..

 

looked into the BADMAIL folder and found Office 365 was rejecting SMTP:

 

Final-Recipient: rfc822;[email protected]

Action: failed

Status: 5.7.606

Diagnostic-Code: smtp;550 5.7.606 Access denied, banned sending IP [xx.xx.xxx.xxx]. To request removal from this list please visit https://sender.office.com/ and follow the directions. For more information please go to http://go.microsoft.com/fwlink/?LinkID=526655 (AS16012609) [DB5EUR03FT024.eop-EUR03.prod.protection.outlook.com]

 

have requested to have the public facing IP delisted and will wait and see...

[rich_tech]

Ah I have the standard office spf txt record on our host, do I add our new external facing IP address to that record too?

 

https://docs.microsoft.com/en-us/office365/SecurityCompliance/set-up-spf-in-office-365-to-help-prevent-spoofing

 

If you are using relays, you need to get your external IP into the SPF record else your mail with O365 gets declared as junk or blocked repeatedly

 

You will likely need to add an entry in its record to allow the IP address also in the SPF record.

[MrWu]

https://docs.microsoft.com/en-us/office365/SecurityCompliance/set-up-spf-in-office-365-to-help-prevent-spoofing

 

If you are using relays, you need to get your external IP into the SPF record else your mail with O365 gets declared as junk or blocked repeatedly

 

You will likely need to add an entry in its record to allow the IP address also in the SPF record.

 

Thanks, after registering for delisting the external IP with office 365 emails from smtp server are coming through...

 

Do I still need to enter this public facing IP addresss to the SPF record as well now for good practice?

 

ie

 

Modify my spf record to this :

 

v=spf1 a ip4:xxx.xxx.xxx.xxx include:spf.protection.outlook.com -all

 

I have hybrid exchange 2010 at the moment but mail is delivered through office 365

[nickbro]

Yes you do. Microsoft use the spf record for these checks

[MrWu]

Yes you do. Microsoft use the spf record for these checks

 

Thanks, I used an spf generator to grab an example, advising that I also use an smtp internal server uses the public facing IP address to send mail ... does this look right ? (IP X out for privacy on the forum)

 

 

v=spf1 a a:xxx.xxx.xxx.xxx include:spf.protection.outlook.com -all

 

 

I did think that from ms docs you prefix using IP4 but might be me misunderstanding

[nickbro]

That doesn't look quite right

 

v=spf1 ipv4:xxx.xxx.xxx.xxx include:spf.protection.outlook.com -all

[MrWu]

That doesn't look quite right

 

v=spf1 ipv4:xxx.xxx.xxx.xxx include:spf.protection.outlook.com -all

 

That does look more like how I read up on other forums ... and I’m quite sure that when my smtp internal server sends email it will be via the external public facing IP

 

Will give that above format a go, thanks !