none
OFFICE 365 - Remote Server returned '550 5.7.501 Service unavailable, Client host blocked using Spamhaus. RRS feed

  • Discussão Geral

  • Hello!

    We're having this issue with our email, it  at the beggining of our office 365 trial and the events that follow are described here. As this problem is becomming a narrative, i'm gonna explain it in chapters.

    CHAPTER 1 - THE BEGGINING OF OUR TRIAL

    we've started the trial scenario for the office 365 with a pack of 25 E3 accounts, this scenario has been configured in a hybrid deployment with our exchange on premisses server.

    CHAPTER 2 - THE BEGGINING OF THE PROBLEMS

    after setup the enviroment, all the services work fine (yammer, office, etc) except the e-mail. we are getting this erros intermitently when we try to send emails.

    "Remote Server returned '550 5.7.501 Service unavailable, Client host blocked using Spamhaus. To request removal from this list see http://www.spamhaus.org/lookup.lasso (AS16042849)'"


    CHAPTER 3 - THE FIRST CASE

    After investigating the problem, we've a diagnostic that the originating ip of the host computer that was accessing the outlook at web was the "blacklisted" ip. Our first questions were: 

    1- "why the e-mail server is checking the ip of the client at spamhaus? doesnt make sense, this lists are intented to check the ip of the email servers, not the clients."
    2- "how can we guarantee that all ips from all our clients are not listed on spamhaus? we're talking about public ips that are assingned by que service provider, we dont have control on them"

    then, we open our first case, and the suggestion of the level 1 enginner was "delist this ip", considering the questions above, this is not a solution. So we ask the case to be escalated to another level. The level 2 enginner seems to had understant the problem, and send us two suggestions and a new important information:

    (THIS IS A INFORMATION FROM MICROSOFT ENGINNER:

    This issue is known to affect customers working with trial O365 subscriptions. Since the customer confirmed that the service being used to send test emails is OWA, the there exist only two solutions for this issue:
     
    1. Request delisting from Spamhaus blacklists
    2. Subscribe to Office 365)

    This solution makes more sense! maybe microsoft have different servers and configurations to trial and to production licenses? idk, but the last thing we coult try was to subscribe, so we did it (considering that we have configured all the hybrid enviroment, otherwise we would had cancel the trial and move to another solution.)

    TREE ADICIONAL CONSIDERATIONS:

    1- YES! WE KNOW THAT OUR INTERNET IP IS BLACKLISTED! BUT MORE THAN 4000 CLIENTS USE THIS SAME IP AND IF ANY OF THEM IS INFECTED BY A VIRUS OUR IP WILL BE LISTED AT SPAMHAUS. WE CAN NOT CONTROL THAT.

    2- YES! WE HAVE EMPLOYEERS ALL OVER THE COUNTRY, THEY RECEIVE IPS OF PUBLIC PROVIDERS AND 4G NETWORKS. WE CAN NOT CONTROL THAT.

    3 - THERE IS MANY CASES EXACTLY LIKE THAT DISCRIBED AND NONE HAVE A SOLUTION.

    4 - TICKET NUMBER IS #30126-6313849

    CHAPTER 4 - VALIDATING THE "SUBSCRIBE SOLUTION"

    Before subscribe to the service, and validade that the problem is only with trial enviroments, we have make one check:

     i've tried to send one email using another office 365 domain (from the same client ip address), but using a paid account and it works normally. the problems seems to happen only on my domain and maybe its related to the trial situation.

    the trial tenant seems to use email servers like these:

    FR1P15201MB2501.LAMP152.PROD.OUTLOOK.COM
    FR1P15201MB2438.LAMP152.PROD.OUTLOOK.COM

    the paid tenant seems to use email servers like these:

    SC1PR80MB1742.lamprd80.prod.outlook.com
    SC1PR80MB1742.lamprd80.prod.outlook.com

    look that the e-mail domain is realy different. trial uses LAMP152.PROD.OUTLOOK.COM and paid services use lamprd80.prod.outlook.com

    this doesnt meens anything but maybe its a clue.

    CHAPTER 5 - SUBSCRIBING

    After some days we've decided to make our partner (that is offering the poc) pay for the subscription so we can validade if the problem is gone (or not). its been past 20hours since we've activated the paid service and the issue continues.

     

    BAD END - NO SOLUTION SO FAR :(

    any ideas or someone with the same problem??

    Sorry about the english, if it was 9gag i would send you a potato.

    Regards,

    Caulí Medeiros

    terça-feira, 12 de setembro de 2017 15:05

Todas as Respostas

  • Here are one of the many NDR that we get. I REPEAT: THE ORIGINATING IP IS BLACKLITED! BUT PLEASE READ WHAT I SAID ABOVE! (some parts of the NDR are in portuguese)

    Informações de diagnóstico para administradores:
    Servidor de origem: FR1P15201MB2438.LAMP152.PROD.OUTLOOK.COM
    marcus@ilandsolucoes.com.br
    Remote Server returned '550 5.7.501 Service unavailable, Client host blocked using Spamhaus. To request removal from this list see http://www.spamhaus.org/lookup.lasso (AS16042849)'
    Cabeçalhos de mensagem originais:
    Authentication-Results: ilandsolucoes.com.br; dkim=none (message not signed)
     header.d=none;ilandsolucoes.com.br; dmarc=none action=none
     header.from=rhp.com.br;
    Received: from FR1P15201MB2501.LAMP152.PROD.OUTLOOK.COM (10.165.12.15) by
     FR1P15201MB2438.LAMP152.PROD.OUTLOOK.COM (10.165.49.20) with Microsoft SMTP
     Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id
     15.20.13.10; Wed, 6 Sep 2017 20:11:27 +0000
    Received: from FR1P15201MB2501.LAMP152.PROD.OUTLOOK.COM ([10.165.12.15]) by
     FR1P15201MB2501.LAMP152.PROD.OUTLOOK.COM ([10.165.12.15]) with mapi id
     15.20.0013.018; Wed, 6 Sep 2017 20:11:26 +0000
    Content-Type: application/ms-tnef; name="winmail.dat"
    Content-Transfer-Encoding: binary
    From: =?Windows-1252?Q?STI_-_Analista_de_Redes_=28Caul=ED_Medeiros=29?=
          <cmedeiros@rhp.com.br>
    To: Marcus Carvalho - iLand <marcus@ilandsolucoes.com.br>
    Subject: Enc: Ticket #30126-6313849 - Arquivando seu caso
    Thread-Topic: Ticket #30126-6313849 - Arquivando seu caso
    Thread-Index: AdMmmIgo8eU468qKS/CMVDBbhh/SsQAs8Z/z
    Date: Wed, 6 Sep 2017 20:11:26 +0000
    Message-ID: <FR1P15201MB250147442D8325CCF940517F8C970@FR1P15201MB2501.LAMP152.PROD.OUTLOOK.COM>
    References: <BN6PR21MB0274FCD2ED987C15785348F489960@BN6PR21MB0274.namprd21.prod.outlook.com>
    In-Reply-To: <BN6PR21MB0274FCD2ED987C15785348F489960@BN6PR21MB0274.namprd21.prod.outlook.com>
    Accept-Language: pt-BR, en-US
    Content-Language: pt-BR
    X-MS-Has-Attach: yes
    X-MS-TNEF-Correlator: <FR1P15201MB250147442D8325CCF940517F8C970@FR1P15201MB2501.LAMP152.PROD.OUTLOOK.COM>
    MIME-Version: 1.0
    X-Originating-IP: [187.115.146.146]
    X-MS-PublicTrafficType: Email
    X-Microsoft-Exchange-Diagnostics: 1;FR1P15201MB2501;35:/KscGld9VPt4hkiWvReI+PsSW7jbe5uPY0Ov6+/pLD2nWSZcMbOu1x1+kLaUXjxkgFCa3yWv6xI4MLniYVj5rQ==
    X-MS-Exchange-Antispam-SRFA-Diagnostics: SSOS;
    Return-Path: cmedeiros@rhp.com.br
    X-MS-Office365-Filtering-Correlation-Id: 1422018e-7744-45ec-ece5-08d4f563744c
    X-Microsoft-Antispam:
     UriScan:;BCL:0;PCL:0;RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(300000502095)(300135100095)(22001)(2017030254152)(2017082002075)(300000503095)(300135400095)(2017052603199)(49563074)(201703131423075)(201702281549075)(300000504095)(300135200095)(300000505095)(300135600095)(300000506095)(300135500095);SRVR:FR1P15201MB2438;
    X-Microsoft-Exchange-Diagnostics:
     1;FR1P15201MB2438;3:ELNWXXdBTZTxrliLEOsRVcupD3liYu61eT/CzQLZ8qoeB2T3qQqXp0lgp35lmFd5qMrO8bD6cLQJPKMRbY4qXf+if1/1Ux/Q2pv2xNilnk7mMDYTa/5tJp2Gyolw1tTctYu5N3xU+UcTxaU002zRu71t9T74VmA00wWOY6QVJHEgRssELdy+20RPhMXnocrnehtQbJ3PFZFjSbTKwwebwkjSWiI1o8Qurd7aQcI22E+Gph2msjr3hCA1SQfbaIqc;25:Ss5Uu/gCjDqRFpr2QxUvO+2lWAyThLIhQZSXYmpk7GhOMT5BsrDutXPS36p/kB3HZEdV9grL0TbXi9gOAwunpWg8OOoG8PWJ6d/1HquaPkYqPKguXcXqJ2Byywxdk3fKJYZOVxCtYbFAQKTVBwKOATCF1smhMLB3mO1nQeWeKRI1N7OI1sWm86Fg+A/nC3LztLaE7P3TE24YhFgdQIBL0c4JwqX5z6dj8oYQdNkE6DyZN5ysYwrrKBC1U0NxPiZ0afZkNgJzGWISLaMthD53exMZO/Apao6xtIA2lk1vBbEUrt6iVzLU63UGCJWhOnmsorELkN2lUygoYfVZn+ljUQ==;31:yJqbLkVP7gIQ9FTiOcRbvGYtJaaRXDMufji9xDLH6UwP2toPEmjALzwWNXx7+DeWSmIb2XSBkDXD02+cwK7HcghPWw0kJ/EKzFpYxSo8/V6awYWcMLSYVlWzo15BDWENTp03vFDUI6+FVUQC1oVA9d8AwC4aWYsPrYLoBv9bXHq8+vdEDJRA8YiLjoImBU0OJhNC844gfCuKqZauWH1W+f1BDjITpPkh/HR1kQIwQFY=
    X-MS-TrafficTypeDiagnostic: FR1P15201MB2438:
    X-Exchange-Antispam-Report-Test:
           UriScan:(158342451672863)(89211679590171)(209352067349851)(268704632989789)(189930954265078)(277809949798613)(166494164430575)(219752817060721)(194151415913766)(194204677036638);
    X-Microsoft-Antispam-PRVS:
     <FR1P15201MB24380CE4B59EBA4BAA87CC518C970@FR1P15201MB2438.LAMP152.PROD.OUTLOOK.COM>
    X-MS-Exchange-OutboundSpamHaus: true
    X-Exchange-Antispam-Report-CFA-Test:
        BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(102415395)(6040450)(2401047)(2017060910097)(8121501046)(5005006)(10201501046)(100000703101)(100105400095)(3002001)(93006095)(93001095)(6041248)(201703131423075)(201703061421075)(201703151056150)(6059035)(20161123560025)(20161123558100)(20161123562025)(20161123555025)(16040078)(20161123564025)(2016111802025)(16043105)(16042156)(6043046)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:FR1P15201MB2438;
    X-Microsoft-Exchange-Diagnostics:
     1;FR1P15201MB2438;4:zCH33MOWe3uEKtbUXFrqtul8H16Imp7KTwLQ7lK1W5zdFE37R2x2HBmVIfhTVO7P2e7lpq6SKpFnvDxmt5BRZ8xv4u1X71jvAn3BVyIIlvUAkqwWipdnkr15TE8Is5EC8GNKfkqV9ZPnHb6jOimSwuPQJklc7DMl8z6sgCH+1VATKxCsU+48oNdPSvd6rY+HcJArJynR26kcHOkRhPVxikrrcBOSV59nAER3TA0MXtOJRmqAEAYsoEisJbY57CCtcrtEHZr4lUneug7KYP6h0+ZGcCgf+keroAit+OhDRfMXDXEyJ0FQwYNOZSkWpQ1x9LvoHedYHPm11HEGA/uiexycksUXi3ZnsPTFYMZAaUXWiVbbQmpvdjmb0Ur+vej7o7x43Gv++0ZkKHCJV6/iiOXqAbeVeW33NsZC/VfOkaC05GIJghS2+iBNrZ28pRi37Va8r7A9nLTZrVwvcXq9taxWQJyavdjFfTq4pGgDLytKEJdpCGIrWwZ1ZOJHR7zZn/y3bua0abgN0xaOerm8KDQI0sIcdh6Y3h/dZ0dK2sHiuPREf7xOzwnsQtXVGLxdtWIiLPuFnkrg1N4JDCUuz2hgM72NOsokROHrS55fxMQ=;23:Fz6PQxgUlW0ZzoNjwabSyupDXj0rAwrR6yV74rhRPkttWW20kx2qX7GVENVqHlPaE3MczPY7vXtiDoZ1FtHFjYpagQbHweBOyIeSFKwVYoxLLPLwT7ZBof5Z7hOst+Sdf73dXe7m1fqSO4ux2N6dIcgzq8st30spHc+J6sNE+1x/BqGU5RA318i5qqmm9kCB5M9nHWWRd95uTX6J71ME/A==
    X-Forefront-PRVS: 0422860ED4
    X-Microsoft-Exchange-Diagnostics:
    terça-feira, 12 de setembro de 2017 15:05
  • Update 

    The issue gone away 2 days after subscribing to service and also manually cancel the trial package.

    This is the reply from the escalated services engineer:

    "We opened a request with the Product Group team who informed us that by design there are certain limitations placed on o365 trial subscriptions compared to full/paid O365 subscriptions. This is the reason why the NDR affecting the customer was only happening when they had a trial O365 subscription."

    We can conclude that this is a policy from microsoft that only applies to trial subscriptions.

    ps. case number is Ticket #: 30126-6359374

    segunda-feira, 18 de setembro de 2017 19:41