Mailserver - Negative reputation

September 10, 2019, 7:31 am

≫ Next: Forward Copy of all messages to another server oder address

≪ Previous: Bypass content filtering policy with Sender ID failed

I need a solution

Hello,

We have trouble with Symantec from one of our IPs. We are blocked each day for those reason :

The IP address 192.99.45.94 was found to have a negative reputation. Reasons for this assessment include:

The host has been observed sending spam in a format that is similar to snow shoe spamming techniques.
The host is unauthorized to send email directly to email servers.

We have checked several DNS black lists and the ip is not listed there. We have checked the ougoing email and we are not observing any abnormal email deliveries. Does anybody know why our reputation is negative? I tried to remove the IP using the reputation tool and it worked, but after a few hours it got a negative reputation again.

Everything appears to be in order, can you provide more information for us to fix this issue?

I've sent one email to investigation@ with no follow-up for now.

Thanks for your help.

↧

Forward Copy of all messages to another server oder address

September 10, 2019, 7:34 am

≫ Next: Disarm in pdf document

≪ Previous: Mailserver - Negative reputation

I do not need a solution (just sharing information)

Hi,

ist there a way to forward a copy of all clean messages ( NO Spam, Malware etc.) to another server or E-Mail Adress?

- Forward or adding a BCC Address

Regards Tobi

↧

Disarm in pdf document

September 11, 2019, 8:17 am

≫ Next: IPs with bad reputation - Delisting request

≪ Previous: Forward Copy of all messages to another server oder address

I need a solution

Hi pls.

if i set disarm and pdf document have certificate signature, the certificate is removed. In disarm is selected pdf and checkbox javascript. Is solution how deliver signed pdf document without changing if document not contain javascript ? If contain javascript java script is removed this is ok.....

thanx

↧

IPs with bad reputation - Delisting request

September 11, 2019, 10:06 am

≫ Next: its posible to block specific domain mail for one user ?

≪ Previous: Disarm in pdf document

I need a solution

We are an e-mail provider. Last July 15th, we acquired 8 IP addresses (5.196.181.216/29) from OVH (ovh.com), and all of them have negative reputation with Symantec:

https://ipremoval.sms.symantec.com/

Only one of these addresses is currently in use (5.196.181.217), and we plan to use all other addresses in a short while. Any bad reputation may exist on such IP is not caused by our services, by us, or simply be intentional.

.127 is our email server which is secured and uncompromised.

We have filed a delisting request several times in the last few days, to no avail.

This is causing disruptions and frustration to our customers.

We need help to get all our IPs (5.196.181.216/29) delisted from all Symantec Mail Security Reputation systems.

Thank you.

↧

its posible to block specific domain mail for one user ?

September 11, 2019, 11:21 pm

≫ Next: Need Solution for Phishing Emails

≪ Previous: IPs with bad reputation - Delisting request

I do not need a solution (just sharing information)

Hello All

Its posible to block specific domain mail for one user ? (version 10.6.6)

tnx

↧

Need Solution for Phishing Emails

September 12, 2019, 10:09 am

≫ Next: Connection to cluster3.eu.messagelabs.com Issue

≪ Previous: its posible to block specific domain mail for one user ?

I need a solution

Recently we had a phishing attack where attacker triggered each email from different email ID with different Subject. Here the common point is he sent .pdf in all emails and password for each file is again different. here is the details format

Sender address: wedvgyeda@outlook.com

Subject: firstname.lastname : password (here firstname and lastname are reciepient's)

Is there any way to block these type of emails in future?

↧

Connection to cluster3.eu.messagelabs.com Issue

September 13, 2019, 9:05 am

≫ Next: Setup a third party app to send outgoing email through the Management portal

≪ Previous: Need Solution for Phishing Emails

I need a solution

Hi,

One of our mailservers is currently unable to connect to cluster3.eu.messagelabs.com which prevents our cleints from sending emails to their partners and other clients.

Could you please review and whitelist 195.154.78.56

1i8O5D-001MF4-Un: H=cluster3.eu.messagelabs.com [85.158.142.99]: SMTP error from remote mail server after initial connection: 501 Connection rejected by policy [7.7] 22428, please visit www.messagelabs.com/support for more details about this error message.Connection to cluster3.eu.messagelabs.com

I have checked the blacklist and could not find any entries for that IP.

I'd appreciate a quick response and solution.

↧

Setup a third party app to send outgoing email through the Management portal

September 16, 2019, 3:47 am

≫ Next: Bad IP Reputation on ISP block

≪ Previous: Connection to cluster3.eu.messagelabs.com Issue

I do not need a solution (just sharing information)

Anyone have a quick link to how to setup a third party app to send outgoing email through the Mail Management portal

↧

Bad IP Reputation on ISP block

September 18, 2019, 12:28 pm

≫ Next: IP with bad reputation - Delisting request

≪ Previous: Setup a third party app to send outgoing email through the Management portal

I need a solution

I work for an ISP that purchased an IPv4 /21 from an IP broker.

About a year ago we purchased the /21. At the time we were told that the CIDR was “clean” and it seemed to pass all blacklist checks. We have recently had many downstream business customers complaining of their emails not going though, or getting bounce backs. It seems to lead to a larger CIDR that our /21 is within being on the Symantec bad rep list.

When doing a look up at https://ipremoval.sms.symantec.com/ipr/lookup I have found that IPs within that /21 that have never been used within our network are on the list. It appears that IPs that are in the /19 or maybe even greater are all on the bad reputation list. What steps do I need to take to prove ownership of the /21 block, and that it is “clean” so I can get it removed from the list and resolve the issue for my downstream customers.

↧

IP with bad reputation - Delisting request

September 19, 2019, 7:59 am

≫ Next: Addon to Messaging Gateway

≪ Previous: Bad IP Reputation on ISP block

I do not need a solution (just sharing information)

Hello,

we currently have no product on Symantec, but our mail server is blocked by the Symantec Global Bad Sender list. The Online Removal Tool (https://ipremoval.sms.symantec.com) says we are not on the blacklist, but mail servers using Symantec's Messaging Gateway block us anyway. But when that Online Removal Tool says our IP (195.98.222.229) is not on the blacklist, we have no chance to request a removal of our mail server IP.

I hope anyone can help us.

In the Following Thread the same Problem is described:

https://www.symantec.com/connect/forums/symantec-global-bad-sender-0

regards,

Stefan Taute

↧

Addon to Messaging Gateway

September 27, 2019, 10:30 am

≫ Next: POLICY GROUPS FOR NON-LOCAL RECIPIENTS

≪ Previous: IP with bad reputation - Delisting request

I do not need a solution (just sharing information)

Hi,

Currently we are doing test on Messaging Gateway VM on premise and wanted to have advance threat protection for current solution. What can be added to Messaging Gateway (Onpremise).

Do we need Content analysis for Sandbox and Email Threat Isolation.

Please suggest !!!

↧

POLICY GROUPS FOR NON-LOCAL RECIPIENTS

October 15, 2019, 3:14 am

≫ Next: Apply the whitelist for sending/receiving large size of emails

≪ Previous: Addon to Messaging Gateway

I need a solution

Policy groups for non-local recipients

I currently use content filters to perform certain actions for non-local recipients (for outbound flow). However, I want to create a policy group for a non-local recipients and only apply certain content filters to this policy.

It appears however that policy groups can ONLY be used for local recipients. And for this, I use them extensively with great results (as in my current policy groups with content filters work perfectly for local recipients).

Anyone have any insight. Thanks again.

↧

Apply the whitelist for sending/receiving large size of emails

August 22, 2019, 8:04 am

≫ Next: Help with Policies

≪ Previous: POLICY GROUPS FOR NON-LOCAL RECIPIENTS

I do not need a solution (just sharing information)

Dear All,

I would like to apply the white list from Symantec Security Mail Gateway. Hereafter are my ideas:

- White list will be created and included some of internal email user.

- All users in white list can send/receive large size email (for example up to 20 MB).

- Other users will be limited at under 10 MB of email.

Is there any suggestions or solution for this?

Many thanks.

Hung Nguyen (Kenneth)

↧

Help with Policies

October 22, 2019, 12:51 am

≫ Next: How to check what addresses are in the Fastpass table?

≪ Previous: Apply the whitelist for sending/receiving large size of emails

I do not need a solution (just sharing information)

Hello Everyone, can anyone help me with the below polcies which I would like to create.

1) Quarantine if email sender is blank

2) Quarantine if the email subject is blank

3) Quarantine if the email body is blank

4) Quarantine if the SPF Validation fails

5) Quarantine if DKIM Validation fails

Appreciate if you can share the steps to create polcies with the above requirements. Thanks

↧

How to check what addresses are in the Fastpass table?

October 22, 2019, 4:55 am

≫ Next: Problem with viruses, high system resource usage!

≪ Previous: Help with Policies

I do not need a solution (just sharing information)

We have SMG 10.7.1-6. Many verdict is Fastpass...

I want to review the addresses which might get this tag. I want to see the content of Fastpass table and F.Trial table. I don't find any guide to that. Can you help?

↧

Problem with viruses, high system resource usage!

October 24, 2019, 7:16 am

≫ Next: Adding Space to existing Scanner Disk

≪ Previous: How to check what addresses are in the Fastpass table?

I need a solution

Hello,

Need help!

On 18 October the SMG discovered significant increase in amount of malware threats/viruses, (inbound email message summary):

Also, I am getting some emails, SUBJECT: "Symantec Messaging Gateway Alert - Outbreak detection"

======================= ALERT NOTIFICATION ================================               

The system detected 453415 viruses in the past 1 day.  

Virus: 453415
Worms: 0
Encrypted attachment: 4
Suspect Virus: 0
Adware and Spyware: 0

Our scanners are dealing with lot of virus messages and the system resource usage is pretty high:
Sometimes CPU Usage are between 80-100%:

All Scanners: processor cores: 4, total memory: 12 GB, disk: 120 GB. (Backup scanner means that MX record is not defined).

And emails like that: SUBJECT: "Symantec Messaging Gateway Alert - Swap space utilization exceeds the configured limits"

The swap space utilization on the following hosts has reached the threshold (60%):  
-------------------------------------------------------------------------------------------------------------------
Host                     Swap used                Swap free                Date
-------------------------------------------------------------------------------------------------------------------
xxx               6,950,740 KB (66%)       3,583,492 KB (34%)       Thu Oct 24 14:30:02 EEST 2019
------------------------------------------------------------------------------------------------------------------

Are there any good ideas out there? How to avoid or reject these massive virus overload...

↧

Adding Space to existing Scanner Disk

October 26, 2019, 11:03 pm

≫ Next: End of services Antispam SMG

≪ Previous: Problem with viruses, high system resource usage!

I need a solution

Hello everyone, we are recieving alerts from one of the scanners getting its disk around 80% filled. Is there any way we can add more space to the existing disk in VMware for our virtual scanner ? Thanks

↧

End of services Antispam SMG

October 25, 2019, 3:05 pm

≫ Next: How to add the images in Disclaimer

≪ Previous: Adding Space to existing Scanner Disk

I do not need a solution (just sharing information)

Hello, I need help.

I have heard that service of Antispam (SMG) of symantec will no longer provide SMG services for small companies. That it true?

According to internet publications Symantec only will sell product SMG for 500 company biggers. We have Symantec Messaging Gateway version 10.7.1 and I am worried about this topic.

Thank a lot and sorry for my English.

↧

How to add the images in Disclaimer

October 31, 2019, 2:01 am

≫ Next: Denied by Policy. TLS conversation required

≪ Previous: End of services Antispam SMG

I need a solution

Hii,

How to add the images in Disclaimer

↧

Denied by Policy. TLS conversation required

September 2, 2019, 10:09 am

≫ Next: How to add the images in Disclaimer

≪ Previous: How to add the images in Disclaimer

I need a solution

Hello everyone. When a external partner is trying to send us an email he is getting an NDR saying that Denied by policy. TLS conversation required. However accept TLS connection is already enabled under inbound configuration is scanner settings. All the other domains can send us fine over TLS. This is happening with only one domain that is trying to send to us. Is this issue on my side or their side and what needs t o be done to fix this?

My SMG scanner is mail3.saib.com.sa

↧