Conversation

Jul 29, 2021

I'd appreciate it if someone at Microsoft could get both mail.grapheneos.org IPv4 addresses removed from the SNDS spam list: 51.161.8.140 (static IP of the server) 51.222.17.218 (newly assigned floating IP so we can avoid dealing with this in the future by moving it around)

Show this thread

Device integrity monitoring

An alternative is that I could keep buying floating IPv4 addresses from OVH until they give me one Microsoft hasn't blacklisted. It's not that expensive but I find the concept ridiculous. I should probably just do this so attestation.app alert emails work for those users.

attestation.app

Hardware-based remote attestation service for monitoring the security of Android devices using the Auditor app.

If we switch to a new sending IP address, it's possible it will be blacklisted elsewhere. It's ridiculous since they've never received spam emails from our domains and we have DNSSEC + enforcing DMARC so they can see it's from us. It should bypass a blacklisted IPv4 address.

They don't support IPv6 so we have to use these recycled IPv4 addresses to send them email. Zero issues with any provider other than Microsoft and Office 365, etc. are fine with us. It's only hotmail.com / outlook.com with their broken IP blacklist system.

A temporary workaround would be swapping the mail server with one of our web servers without a blacklisted IPv4 address. I want a long-term solution though which means having a floating IPv4 address that's not blacklisted, which means playing the lottery ordering more of those...

Replying to

when I’ve been through this with other providers, their floating pool was more tainted than their fixed/management IP pool. your strategy of swapping the mail and web server IPs is exactly what I’ve had to do to get around this

Replying to

and

unfortunately, the situation is pretty dire. the large providers don’t care to address it because they’d rather deal with a small number of large senders than a large number of small senders

Replying to

It's incredibly annoying. They should know how to check the PTR record of the IP address, confirm that the A record points to it and use the domain reputation for emails passing an enforcing DMARC policy. We've also had these IP addresses for months already without it expiring.

Replying to

ah, that’s the neat part. they don’t expire it. I had a previous colo’d server for 5+ years without the IP reputation issues expiring. and why would they when from their perspective you ought to be using SES or whatever the Azure equivalent is anyway?

Replying to

and

I would suggest that in a well-functioning regulatory state, this is the sort of behavior that would attract attention, but alas I doubt there even is such a thing as a SMTP market regulator