Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Outlook/Hotmail is no longer blocking my mail server

taoshu.in

Post reply on HN
Print view View original

231–240 of 257 posts

Re: Outlook/Hotmail is no longer blocking my mail server

#231

Post by justsomehnguy »

Avamander wrote: post #190
justsomehnguy wrote: post #168

Earlier quoted context omitted.

> SpamHaus always has really good reasons Ah, yes, blocking entire /18 and demanding money for the delisting. I guess 'Guilty by association' is a 'good reason'.

I haven't ever heard of them asking money for delisting. Surprising. Considering their track record it must be serious. A bulletproof host range? Traffic from those is absolutely guilty by association as the hosts are enabling abusive behaviour.

> Traffic from those is absolutely guilty by association as the hosts are enabling abusive behaviour.

I guess if you would be barred from entering Walmart because you live on the same street as someone with 'abusive behaviour' you would be 'oh, yes, totally my fault, sorry for disturbing you'.

Re: Outlook/Hotmail is no longer blocking my mail server

#232

Post by sheikheddy »

Dylan16807 wrote: post #225
sheikheddy wrote: post #223

Earlier quoted context omitted.

Oh man I think around 2 years ago there was a 3x spike in Europe outbound spam and the fraud team had to disable like 200k+ tenants from some shady cloud VPS. We didn’t have a long term plan for the abuse back then besides playing whack-a-mole, and if we have one now, I haven’t heard of it. Dumb question, but wtf is the solution even? I’m confused about what you expect us to do. I haven’t thought about the problem mu…

Did I accidentally give the impression I have a particularly good solution to spam in mind? I don't. My main suggestion here is just that an established reputation for a specific IP/domain should override the reputation of the IP block it's inside of.

You didn’t make any mistakes encoding, I just screwed up my decoding, it happens :D

Thanks for clarifying, ok, hmm… that seems hard to do if you can check the IP block by using a subnet mask but the specific IP isn’t resolved until later in mailflow. It might not actually work like that in… ProtocolFilterHub? I always get this mixed up, wait… I think this might be something that we are already working on. And have been working on for a while, wow. Looks hairy. It’s stuck since the guy working on it transferred to another team, and no one picked it up, but some PM noticed before I did and put it up for vote in semester planning. Always creepy to see engineers get referred to as “resources”.

Re: Outlook/Hotmail is no longer blocking my mail server

#233

Post by sheikheddy »

BLKNSLVR wrote: post #67
sheikheddy wrote: post #47

I work on Microsoft's anti-spam team, AMA!

What kind of tiers are there for filtering? Eg. Known bad domains, known bad IP addresses, incorrectly setup DKIM / SPF, no reverse DNS, non-matching reverse DNS, and that's before even looking at content to determine whether spam.

For privacy and compliance reasons (read: “oh boy wouldn’t wanna get sued, eh?” reasons) we actually don’t snoop into the message body much. Hooray, good job on not doing the maximally big brother thing for once, MS!

My hot take is that this prolly won’t last because every org descends to doing a creepy level of data collection eventually so I have a textbook on privacy preserving ML downloaded for when we join the “surveillance but we found a way to make it technically legal” squad. We haven’t done that yet though.

What do you mean by tiers, exactly?

Re: Outlook/Hotmail is no longer blocking my mail server

#234

Post by yobbo »

inglor_cz wrote: post #46
yobbo wrote: post #21

Earlier quoted context omitted.

> In a capitalist system, that means companies, and it leads to consolidation and monopolization. No, a "capitalist system" does not lead to consolidation and monopolization.

[Citation needed] I am a big fan of free markets, but the trend towards consolidation, at least in activities that profit from efficiencies of scale, is unmistakable, to the degree that it often kills the market unless prevented. You probably cannot "consolidate" a market of book authors and musical bands, because quality of artistic expression does not scale with money. But the market of publishers and recording com…

> But the market of publishers and recording companies is quite consolidated, because money buys more efficiency there.

Not quite. Publishing/recording depends on specific laws (intellectual property) to disable the competitive-market mechanisms. For example, copyright being extended to 95 years, but there are many other mechanisms surrounding copyrights that have enabled the current monopolies in publishing/recording.

Re: Outlook/Hotmail is no longer blocking my mail server

#235

Post by yobbo »

vouaobrasil wrote: post #25
yobbo wrote: post #21

Earlier quoted context omitted.

> In a capitalist system, that means companies, and it leads to consolidation and monopolization. No, a "capitalist system" does not lead to consolidation and monopolization.

That is true, but an unbridled capitalistic system that has relatively weak controls for protection of the commens DOES lead to such things frequently. I am not against capitalism, but against the form of capitalism we have today, which is focused on arbitrary and endless growth with relatively little controls to prevent pathologies like Google.

I'm not saying you are wrong, but it's maybe too early to describe Google as an example of "market failure" or "pathology".

One could debate if it's fair (or legal?) to let one side of the business (search ads) subsidise another (gmail) in order to crowd out competitors.

But that is neither an argument for or against "capitalism".

Re: Outlook/Hotmail is no longer blocking my mail server

#237

Post by csnover »

vel0city wrote: post #163
csnover wrote: post #152

Earlier quoted context omitted.

I guess my question is can you please fix your braindead blacklisting? Several times per year—I can practically guarantee it’ll happen sometime in December, and indeed had to deal with this just five days ago—I end up with a bunch of users whose email notifications stop working because Microsoft have started blocking the entire netrange where my server lives. I don’t have control over other Linode customers, guys! I…

> I don’t have control over other Linode customers, guys! You do have control over being a Linode customer though. If Linode isn't doing enough to prevent abuse, they deserve to be blocked.

Linode respond swiftly to abuse reports[0], block outgoing SMTP by default, and prevent so many people from even registering for services that it is the #1 question people ask on their IRC channel. What more should they do? What is “enough”?

90% of the spam that I receive from a DMARC-validated sender comes from Google; should every Gmail user be punished because Google aren’t “doing enough”?

[0] Linode twice threatened to shut off services within 24 hours due to some vigilante scanning the internet with a broken virus scanner and automatically sending reports: https://virtuallyfun.com/2014/04/23/dumbass-of-the-year-awar... (n.b. this is not my site)

Re: Outlook/Hotmail is no longer blocking my mail server

#238

Post by csnover »

sheikheddy wrote: post #222
csnover wrote: post #152

Earlier quoted context omitted.

I guess my question is can you please fix your braindead blacklisting? Several times per year—I can practically guarantee it’ll happen sometime in December, and indeed had to deal with this just five days ago—I end up with a bunch of users whose email notifications stop working because Microsoft have started blocking the entire netrange where my server lives. I don’t have control over other Linode customers, guys! I…

My guess is that the effectiveness issue isn’t actually due to SNDS and is probably related to sender reputation having famously high false positive rates. I read a paper a while back which introduced a different algorithm with tighter bounds on regret, I didn’t really understand it tbh, but I can implement it behind a flight and run a data study to see if it works better. The problem is that most graph based stuff d…

Whatever the problem is, all I know is that last year Linode said they tried and failed to get Microsoft to actually fix the problem[0], apparently despite assurances and multiple requests for a root cause analysis. Everyone else seems to have figured out how to not be overrun by spam and also not block entire netranges, so I’d say it is well past time for Microsoft to figure out how to do that too.

Thanks and good luck!

[0] https://www.linode.com/community/questions/22287/550-57511-a...

Re: Outlook/Hotmail is no longer blocking my mail server

#239

Post by currysausage »

sheikheddy wrote: post #224
Dunedan wrote: post #71

Earlier quoted context omitted.

Why do you put mail servers on your block list which never sent spam? And why do you make it nearly impossible to get unlocked once on that list?

Yo I’m not even gonna apologize about this, it would be so wack if we didn’t do that: a) if a mail sever looks like it’s gonna send spam, then you gotta block it. I personally have philosophical hang ups about this, like it’d be wrong to sentence someone to prison for crimes they didn’t commit just because a system added up some points and made a prediction with high confidence, but in real life, you absolutely need…

The way you implement this, low-volume senders (nerdy individuals or small projects that can't use SES/Mailgun/… for GDPR reasons), even if they manage to get off the list once (olcsupport.office.com, escalate), never get the chance to build up reputation in the long term (I'd have to contact olcsupport again in a few months and that's just not sustainable for a small-time postmaster).

I get it, you're afraid that some VPS from a cheap cloud provider suddenly floods the inboxes of thousands of Outlook.com customers. I realize that a fresh IP that sends dozens of emails out of the blue has to be blacklisted.

But why don't you allow my VPS to send, say, 16 emails a day to Outlook.com inboxes? And if ⅛ of the recipients report junk, I get blacklisted. But if all 16 recipients are happy, my IP can now send 16+16=32 emails/day for the next few months (as long as the non-ISP hostname matches; otherwise, it might be a new VPS customer), and so on.

This way, your customers are happy (I don't think spammers rent/hack a fresh VPS in order to send 16 emails, and I don't think they are very good at building up IP reputation), and I'm happy (my personal VPS can send a few emails to my Outlook.com contacts every few weeks/months, and my project VPS can gradually build up and maintain the reputation it needs).

I'm obviously being naive about that approach, but I don't remember having trouble reaching Gmail inboxes or those of local providers, and at least for Gmail, I know that they have pretty effective spam filtering too, so I reckon that they use some approach like the one I described.

For a side project, I have just given up contacting olcsupport and instruct Postfix to send through our @outlook.com address instead, but that is a wobbly workaround at best. For personal email, I now relay through SMTP2GO because GDPR doesn't matter that much, but it makes me sad to have that gaping hole (called Outlook.com) in my decentralized email fantasy, after having spent so much time researching, configuring, diagnosing.

Re: Outlook/Hotmail is no longer blocking my mail server

#240

Post by vel0city »

csnover wrote: post #237
vel0city wrote: post #163

Earlier quoted context omitted.

> I don’t have control over other Linode customers, guys! You do have control over being a Linode customer though. If Linode isn't doing enough to prevent abuse, they deserve to be blocked.

Linode respond swiftly to abuse reports[0], block outgoing SMTP by default, and prevent so many people from even registering for services that it is the #1 question people ask on their IRC channel. What more should they do? What is “enough”? 90% of the spam that I receive from a DMARC-validated sender comes from Google; should every Gmail user be punished because Google aren’t “doing enough”? [0] Linode twice threate…

> Linode respond swiftly to abuse reports[0], block outgoing SMTP by default

One instance of them supposedly responding quickly to an email abuse report isn't showing they're consistently responsive to abuse reports. I don't know if they are or are not. I don't even know that this blog post even refers to Linode, they're not mentioned once.

And its not true they always block outgoing SMTP by default. Loads of old accounts do not have SMTP blocked. New accounts since 2019 sometimes have it blocked, but given the last few times I've made an account and didn't have any blocks it doesn't seem that often. Maybe I just got lucky though.

And don't get me wrong here, I'm not intentionally singling out Linode here. There's loads of cheap VPS providers that enable this kind of abuse. They're not necessarily better or worse in this regard to many others.

> 90% of the spam that I receive from a DMARC-validated sender comes from Google; should every Gmail user be punished because Google aren’t “doing enough”?

Yes. Just like those telephone companies originating most of the spam phone calls should get disconnected. If they're going to enable abusers, they should get cut off.

Post reply on HN