Users fume at Outlook.com email 'carnage'

Microsoft spent last week rejecting emails to Outlook recipients after what appears to be either a fault or overzealous blocking rules. The problem affects certain IP addresses, whose emails are rejected due to falling foul of reputation rules or appearing on a block list. A Register reader told us, "At the back end of …

[K555]

OVH

Pretty sure they had all of OVH Europe on a block list.

[Mishak]

Re: OVH

Wouldn't surprise me, as a high percentage of the spam that come my way if from there...

However, blocking the IP used for shared hosting isn't really smart...

[kmorwath]

Re: OVH

Mail servers aren't run from shared hosting servers, although a mail server can be used by several domains.

And if one of the domains starts spamming, the whole server can end in a blacklist.

[kmorwath]

Re: OVH

Let me know how multiple users can install their own mail server on the same IP.... even a web server as well.... without controlling the whole server, since only one can bind the required ports.

Shared hosting uses systems set up by the vendor, which routes requests to your little web site using SNI. Mail servers as well can route email using the domain name.

But maybe some very small hosting, they are not installed on the same machine - for management, performance and security reasons, and not managed by you.

Moreover, mail servers are not proxied like web server ones, or SPF/DKIM/DMARC won't work. They are end-to-end systems.

Anyway, you get what you pay for. If you use a shared IP, you risk to be blaclisted if any other user does bad things. Just like CG-NAT, one user does something wrong and all the other ones behind the same IP gets blocked.

Of course that can be resolved using IPv6, as long as you're not able to jump IPs - but if you hosting doesn't allow you, that would work. And if it does, it could see the whole prefix banned, and should start to lose customers and get out of business....

But of course IPv6 is baaaaaad..... the interweb says so....

[bombastic bob]

Re: OVH

aren't they using SPF records? Don't they have a dedicated mail server to send mail?

Outlook SHOULD allow anything through with a valid SPF (or other sender verification)

[Anonymous Coward]

Re: OVH

SPF, DKIM, DMARC and all the other items in place. They still ignore it.

This has hit one of my clients since Thursday. No email getting to hotmail and outlook.com addresses. Just 550 bounces. Simple personal email messages, not bulk. Check mailserver and not on any blocklist even though it is a shared server. Emails get to gmail fine.

A different client of mine use Infusionsoft\Keap to send bulk mail responsibly. Complete with unsubscribe links, list sanitising, and all that jazz. Microsoft keeps blocking those servers without a care that things are being done properly.

Their blocking is almost random. I wonder if all they are doing is checking people who hit the "junk" buttons in Outlook, and add in some AI randomness. Then totally ignore that the numpty who hit the button didn't click the unsubscribe link on the mailing list they signed up to.

[coredump]

Re: OVH

> SPF, DKIM, DMARC and all the other items in place. They still ignore it.

I've seen similar from gmail and (occasionally) yahoo mail as well. While being pretty permissive about spammy content originating from their own networks and domains.

Aside from the technical causes, I suspect part of the motivation is Microsoft and Google simply wanting to preserve their walled gardens. The concentration of email service into a small number of providers' hands is worrisome.

[Diogenes8080]

Re: OVH

SPF just says you authorise the server to act for your domain (or to be more precise, the domain of the envelope your mail uses). Mangling the record just gives a PERMERROR but failing to declare a server you are using will cause a HARDFAIL or SOFTFAIL depending on how you terminated. Adding stupidly wide ranges because your ISP is free to move you anywhere around their ASN will not endear you to pro players either (after Zink).

DKIM would sort out the mess arising from a shared server, if it can be trusted to apply that signature reliably. I saw a 5k fraud last year through a certain German ISP who trades elsewhere on the continent, all properly DKIM signed. The ISP's relay server was vulnerable to some sort of replay. I have no idea how widespread that problem is and tend to assume that DKIM is reliable but does not discount the possibility of a breached sender. PhishPoint, anybody?

DMARC just says what to do when either of the above does not align. It doesn't help your deliverability, but getting it wrong will definitely hinder.

Sharing an IP for sending or even having a dedicated resource from an ISP regularly appearing in spam buckets is always going to be fraught. After enough grief, various admins are going to conclude that your neighbourhood is a bad risk and "escalate" their action. That's been the way of blocklists for many years now, and it's only frustrating if the receiving technology is opaque as it is in the case here.

[Antifa - Ost]

Re: OVH

I personally wouldn't click on an "Unsubsribe" link in an email I'm not 100% certain is not spam.

[ElPedro100]

Re: OVH

100% right

[M.V. Lipvig]

Re: OVH

"Their blocking is almost random. I wonder if all they are doing is checking people who hit the "junk" buttons in Outlook, and add in some AI randomness. Then totally ignore that the numpty who hit the button didn't click the unsubscribe link on the mailing list they signed up to."

I am that numpty. I put all into spam, and never check unsubscribe. All that does is verify that my email is valid, making it more profitable for spammers to sell. I also never sign up for email, and always uncheck the box that says I want to be on a mailing list, for all that box is a BMW driver's turn signal - you still get stuck on their mailing list, and they get reported for spam.

[Lon24]

Re: OVH

A Zen mailserver also made the blocklist. Blocking one of UK's most respected ISPs is mighty weird. But then if Microsoft can't get me one way they do get me another ...

Still smarting when doing a Win11 update which sits on my main Debian dual boot took it out of action for over 12 hours. 12 hours for an update - not 12 minutes! Time to get rid of it as it was there 'just in case'. And I haven't had any 'cases'. Cowboys!

[kmorwath]

Re: OVH

They only identify the server that is sending email as a legitimante one for such domain, and tell what to do for mails sent by not legitimate servers. They do protect the sender, not the receiver that much. I can tell to every compliant system "these are the servers for my domain, bin everrything that is not from them, since they are spoofing me".

But they are not enough to ensure the server is not spamming or the like. Since all those settings are made by the mail server owner without any third party vetting, they can be set up for any mail server easily. The bet was that spammers won't take the effort to set them up, but it's very easy to do so. Especially now with AI agents....

Thereby any postmaster is free to blacklist servers regardless of the presence of SPF/DKIM/DMARC - if other data indicates the server is sending

[Keith Langmead]

Re: OVH

Spot on. Or a spammer has compromised a legitimate mail server that has SPF/DKIM/DMARC setup, or an individual mailbox on that server, at which point the spams they send will pass those tests.

[K555]

Re: OVH

I'm behind CG-NAT at home (cheap service). I have a little OVH VPS I use in order to get a private fixed IP for services like e-mail. DNS, PTR, SPF, DKIM, DMARC etc all set correctly.

It's been on a few arbitrary blacklists based on subnet, I get that... it's a cheap VPS. I've been able to delist the specific IP with most if I run into a block. Can't do it with Microsoft services, so I just live with not being able to e-mail them.

I totally get that OVH are 'known for it' and I could run up a 2nd IP elsewhere if I was that bothered. But, by the same logic, every time an M365 account gets hacked and sends out a phishing link to everyone in it's address book with a link some hookey file hosted on sharepoint, everything will have come from a Microsoft IP.... I might blacklist those ;)

[Steve Foster]

Re: OVH

As OVH are fairly well known for failing to contain spammer activity, doesn't everybody?

[Anonymous Coward]

Re: OVH

If there was a complete list of their IP addresses I'd also block them from websites - in general, there's rarely a positive reason you get a connect from a hoster. That's usually not a user.

[Steve Foster]

Re: OVH

You can use ASN registration/block searches to find most of their IP ranges.

[IGotOut]

Re: OVH

First rule in my Cloudflare protection is drop all from OVH

The attacks on my site dropped about 75% from then onwards.

[rg287]

Re: OVH

Similar.

My employer currently hosts on OVH (no outbound mail from there!), but we do the exact same for Digital Ocean and a few others. Our API access is basically allow-listed, since we sell to a relatively small number of corporate clients and we can keep on top of their access points. The web/portal services we provide have a pretty extensive blocklist in CF from both certain countries, and then from ASNs that belong to hosters, since those services should only ever get hit by humans.

[Chloe Cresswell]

Every few months a client of mine (a recruitment company) has their emails rejected like this for their payslips.

One response from was really helpful: the emails which are individually generated and sent need an unsubscribe option for the mailing list.

That's right, we need to fake an unsubscribe option for the mailing list they aren't on, to improve our reputation.

[Anonymous Coward]

Sounds like they are assuming that the emails are marketing emails (which should have unsubscribe information), rather than adminsitrative emails - which payslips clearly are, and don't need any opt out details as normally the recipient cannot opt out.

[The Indomitable Gall]

Yes indeed -- that sounds exactly like what the previous poster was telling us was happening.

[OhForF']

That event still looks strange to me. So far every company that employed me provided a business email address and sent administrative stuff there and expected me to pick it up from the company email server. That way the mail never leaves the company network neatly avoiding issues with spam and privacy.

Sending pay slips to private email addresses and probably in plain text doesn't look like a professional setup.

[MJB7]

Re: Payslips

Sending payslips to a corporate email account doesn't work well for the payslips from your three months gardening leave after you have resigned and been blocked from corporate email. It's also not great for looking back at your payslips from six years ago.

[Chloe Cresswell]

Re: Payslips

Also, it's a recruitment company.

They have 12 members of staff, and over 1000 people signed up to them looking for work.

Factory comes to them and wants 4 staff for 4 weeks, and the client is meant to provide them an email account to send their payslip to?

This week they will send 395 payslips for those staff.

[OhForF']

Re: Payslips

>Factory comes to them and wants 4 staff for 4 weeks, and the client is meant to provide them an email account to send their payslip to?<

The employer is required to provide the pay slip in a way that keeps personal information private.

Sending a pay slip in a plain text to an external mail server would put you in hot water with local privacy laws. Most likely not something you can do anywhere where GDPR or an equivalent is in place,

[Chloe Cresswell]

Re: Payslips

"would put you in hot water with local privacy laws" Really?

Because it's fully compliment with the provisions of both GDPR and DPA (2018)

"Sending a pay slip in a plain text" You're the one assuming plain text.

Please inform the class what part of "Attached is your payslip in an Adobe PDF document, You will need a copy of Acrobat or Acrobat Reader to open is" is in such a violation of the law that it needs to be called out?

That is the plain text you are so upset about.

The PDF itself is password protected.

Stop projecting how badly _you_ would do this onto other people.

[Roland6]

Re: Payslips

Good practise is not to send payslips by email but to send a notification: “your latest payslip is now available from the employee portal”.

I suspect all those people experiencing this problem are sending emails from non-MS mail servers ie.rejection is deliberate MS policy.

[Chloe Cresswell]

This is a recruitment firm. You think we set every single person they find a job for on a site a company email account with the client's company?

If someone comes to them for a cleaner's job in a factory for 4 weeks, you expect them to have a recuritment company's email account, or the factory's email account?

Or maybe, you know, the client sends the payslip to the _person_

On Wednesday they will send 395 emails for payslips.

They have 12 permanent staff members.

You think we should provide email to those 395 people? Setup their devices to access the client's email server?

Plus we'd have to lock down every account to prevent it being used to send email, after all, they'd all be sending from the company's mailserver, with a company email address, how more ligitimate looking can you get?

[Phil O'Sophical]

Sounds like the credit reference agencies who tell you that you can improve your credit rating by borrowing money and getting deeper in debt

[Mishak]

Unfortunately

Unfortunately, that's how it seems to "work".

My daughter is 18 and wants to get a credit card so she can start to build up a credit rating.

She can't get a card because her credit rating is only "average". I spoke to an "agent" (appeared to be a Real Human (TM)) and was told she needs to prove she can service debt before she can get one. They were not able to answer the "how can she do that if she can't get any"?

What I don't get is why there appear to be no cards out there that have a hard credit limit of (say) £200 that can be used to prove the ability to manage a (tiny) amount of debt. There are a load that claim they are "available" for people with no or a poor rating, but they all said "no", even though she satisfied the minimum income requirement.

[Steve Foster]

Re: Unfortunately

It used to be the case that making a purchase of a few hundred pounds on store credit was one of the most effective ways of doing that, as retailers finance arms/subsidiaries were traditionally a bit more willing to lend than banks (because it helped make the sale). I do not know if that's still the case.

Buying an Atari ST that way is what got my credit score established nearly 40 years ago.

[kmorwath]

Re: Unfortunately

Get a debit card baked by an account with enough money - or get a "rechargeable" card.

That's what we do here, so we don't also pay absurd interests over the "credit"...

[Mishak]

Re: Unfortunately

She has had a debit card / Apple Pay for a number of years and uses them to pay for most things.

Hasn't made any noticeable difference.

[robinsonb5]

Re: Unfortunately

When I was a teenager (many years ago) Barclays quite happily gave me a credit card (albeit with a modest credit limit) but wouldn't give me a *debit* card because I wasn't a well enough established customer yet! (I think that was weasel-word for "We'll make way more money out of you if you get into the habit of using a credit card"!)

[kmorwath]

Re: Unfortunately

Move to a country not run by financial services.... how people can accept that way of living is beyond my understanding.

I don't have a credit card and don't need it - my "credit score" is build on my income and the fact I pay bills on time - not how much debt I can take....

But of course having people pay more for anything they buy it's a very easy way to move more money from the bottom to the top.

[Cliffwilliams44]

Re: Unfortunately

Most debit cards won't report to the credit report companies (unless you overdraw your account).

Honestly, the best and easiest way to build credit is buy a car! Yeah, it sounds like overkill but most car dealers will issue credit to just about anyone who is breathing and has a paycheck. You would probably need to co-sign for it.

Another option is check with your bank and see if you can open a joint card, Where you are primarily responsible for the debt.

The bottom line is, you can get her started but not without you taking responsibility for her if she doesn't pay the debt.

If you do get a card, make small charges and pay them off ASAP. Always make sure the available credit on the card is higher than any balance at the end of the billing period. (debt to credit ratio) This is how credit score is determined.

[IGotOut]

Re: Unfortunately

@mishak

I've helped plenty of people sort out credit.

1st up, is she on the electoral roll?

Does she have a mobile phone contract in her name? That counts.

Sign up with someone like credit kama and it will give you a list of ways to improve your score.

Barclays as mentioned before will usually offer cards with lower limits.

If she gets a card, just spend day £10 a month on it, and pay it if each month (set an auto pay direct debit to ensure no missed payments)

[M.V. Lipvig]

Re: Unfortunately

Take her to a bank and have her open an account, and take out a thousand dollar/pound, 6 month personal loan. Put the money into the account and have the bank autopay the note. The bank, since it's unsecured, may or may not restrict access to the account for the life of the loan. Bam, 6 month, and she has a 4 digit unsecured bank loan paid off for the cost of 6 month's interest. My kids were able to establish their own credit this way.

Icon, for a banky looking feller.

[PRR]

> ........you can improve your credit rating by borrowing money and getting deeper in debt

True. When I took a car loan (first in my life) my FICO Score jumped to 850. For months. As soon as I paid it off the score fell back.

I will say that new car dealers can be motivated to get you a loan. If you want a new low-price car the interest is not-bad. (My personal bank quoted 3X the rate of Toyota. Not counting the few months when Toyota was promoting ZERO% on RAV4s.)

[Anonymous Coward]

Car salesdroids get commission on the loan contract as well as on the sale.

[Mast1]

Re : Car salesdroids get commission on the loan contract as well as on the sale

And look where that has ended up in the UK: a new round of ambulance chasers offering to chase compensation for mis-sold loans.

A few years back, when dealing with a local family garage who were agents under a major car brand, I had to sit through while the poor salesman had to tick fill tick boxes to prove that he had tried to get me signed up to a loan.... on a 9-year old small car (30,000 miles on the clock). The salesman was very apologetic, but it appeared that he had to evidence his attempts back to his franchise manager.

They lost their franchise, but not their business. Their local reputation as fair dealers is too well established.

[MarkTriumphant]

Re: Re : Car salesdroids get commission on the loan contract as well as on the sale

>> And look where that has ended up in the UK: a new round of ambulance chasers offering to chase compensation for mis-sold loans.

What is even more frustrating is that the loan companies in this one MUST contact people who they see as being owed money, so the ambulance chasers are less than necessary.

[kmorwath]

Especially, the car company gets more money for the same car. Once they used offering you a discount if you paid the whole sum, now they want to force you into a loan because they make more money with no effort, even if they risk people stopping paying. But that's why they want to have cars that can be disabled remotely.

It's not different from the subprime story.... and that's why car prices became higher - let more people take debt and pay interests, and if governments starts to use taxpayers money to subsidize sales, the better!

[FirstTangoInParis]

It wouldn’t matter if Toyota were offering minus 10%APR on Rav 4s, I still wouldn’t buy another one. The ones in the late noughties drank oil, ate tyres and needed servicing every 10k miles. Compare with similar Volvos now that will go 25k miles on a set of front tyres.

[Roland6]

Works until the finance company decides because you don’t have a monthly (employee) pay cheque refuse finance…

[kmorwath]

Probably an automated system that sees bulk email sent from a specific IPs, and checks it against bulk emails policies - the unsuscribe options is one of them.

The system is unable to tell apart payslips from sleep pills, evidently.

[jake]

One wonders ...

.. how many Billions of dollars has Microsoft-induced downtime cost corporations world-wide in the last year? The last five years? The last decade? Two decades?

How much would your company have saved in downtime alone (after re-training costs & etc.) had you switched to BSD & Linux thirty years ago?

What kind of colossal microsoft screwup will it take for your company to stop being the boiled frog?

[Anonymous Coward]

Re: One wonders ...

Not going to happen.

Even when the expensive dinners would end, the people who took that decision are not going to own up to taking a decision without the skills to do so. Add to that the aggressive entanglement like getting people to use MS Dynamics and it isn't going to stop, ever. Even if you could show they have been engaged in intercept for decades.

[CrazyOldCatMan]

Re: One wonders ...

stop being the boiled frog?

You do realise that that's an urban myth? A frog put into water that's being slowly heated will, like any sensible organism, jump out as soon as it gets uncomfortable.

[jake]

Re: One wonders ...

"You do realise that that's an urban myth?"

So say today's green-and-granola scientists, none of whom have actually tried it.

Experimentation in the 19th century suggests if the water is heated slowly enough, the frog doesn't move and dies. See specifically the work of Carl Fratscher from 1875.

You can accept that folks who came before you actually knew what they were doing, or you can take the word of modern, namby-pamby so-called "scientists" who are afraid to make soup.

Or you can make that soup for yourself. The experiment isn't exactly difficult to set up. Personally, having read the methodology of Fratcher, I see no reason to doubt his results.

[Pete 2]

Productivity boost

> Email flow slowed or stopped by mysterious forces

Would that be the business imperative to actually get some work done?

[Groo The Wanderer - A Canuck]

"Mysterious forces?" More lke their Artificial Ignorance systems screwed things up again...

[lglethal]

I dont believe it...

As a user of Hotmail, I cant believe this is real. Defintely not.

Not that Microsoft could screw this up so badly. Oh that I believe. No I cant believe that microsoft do ANY filtering...

The dozens of spam and phishing emails that plop into my account daily says otherwise.

But I absolutely can believe that microsoft couldnt find the correct filter function if it came up and punched them in the face, because their in-built filter tools dont work. Tell it to block all emails featuring the word casino. Whats the next email that will come through, one featuring casino. Tell it to block all emails from all subdomains of firebase.app (I get dozens of these per day) or at least claiming to come from those domains. Nope... It's about as useful as fly screen windows on a submarine.

It is probably about time I moved. Anyone got any suggestions for other email providers, that are not useless? How is Proton these days?

[Doctor Syntax]

Re: I dont believe it...

"Anyone got any suggestions for other email providers, that are not useless?"

Mythic Beasts - get them to register a domain for you and manage the mail.

Having said that I found that Hotmail/Outlook filtering eventually seemed to work most of the time but erratically. Stuff would be filtered for a while but the emails - mostly from "companies" who couldn't quote their name or domain name and used gmail addresses that again had nothing resmpling a company name but could improve my unspecified website etc - would start appearing again for a while.

[Boothy]

Re: I dont believe it...

Yup, I've got an ancient Hotmail account that I use as a general dumping ground, typically using aliases for anywhere I sign up with.

I've just checked, and I have 40+ junk mails, and whilst a couple of them are false positives (e.g. there is one from gog.com that looks likely to be real), but the other 95% of them all follow the same pattern, emotes in the subject, names like Costco, FedEx, Starbucks, Lowe's, Walmark etc, with none of the From email addresses being valid (for the few I checked) and subjects like Exclusive offers, or Congratulations for winning something etc etc. In other words, very easy to recognise as actual junk.

But all of these junk messages have a red 'Unverified' label, so why pass them on to me in the first place? Just filter them out!

[I could be a dog really]

Re: I dont believe it...

But all of these junk messages have a red 'Unverified' label, so why pass them on to me in the first place? Just filter them out!

You've mentioned yourself about false positives - and I can assure you that filtering out false positives and not delivering them is a real problem that all the big oligopolists have built into their systems. It's really not hard to do "check a message and reject (refuse delivery) if it fails" filtering - and if everyone did that then spam would be a lot less of a problem. Or rather, the collateral damage from dealing with spam would be a lot less of a problem. As I've noted elsewhere, being able to look in your server logs and see a message was accepted - but know that the user might not get it - is "very irritating".

But if they all either delivered what they accept, or reject what they won't deliver, then life would be a lot simpler.

And "junk folders" are another complete p.i.t.a. which I turn off as best I can on any system I use. I'd rather filter the junk out of my inbox than find I've had something important sat there for weeks and I've not seen it. Even worse are those users who just nuke everything that's "junk" without even looking.

[Jamie Jones]

Re: I dont believe it...

100% this!

The thing that has made email unreliable is not the spam itself, but the braindead way some people deal with it.

Reject at source. DO NOT BLACKHOLE EMAIL. FFS, I share your pain... Having to prove to the recipient that the problem isn't my end, by sending them the transaction id the remote machine gave when accepting the email still doesn't convince many.

I've ranted about this before. Whoever ran the Swansea Council social services email about 15 years ago (it was a commercial third party whose name i forget now) should be criminally liable for the stuff they blackholed... Long story short, I was in contact with a social worker about someone, and important emails didn't get through. I did some testing, the word "penis" caused the email to be blackholed.

I even reported it to the company, starting clearly why this was an inappropriate block for this department. They refused to deal with me because i wasn't their customer, and the non-techie social worker didn't want to create waves.

Again, ditto on the junk folder bollocks. The only email address I use by someone else is gmail, and there were too many false positives. You couldn't even just switch the spam filter off, but there were ways around it (i can't remember offhand, but it was a rule something like "if email delivered to spam label, move it to inbox label"

[Anonymous Coward]

Re: I dont believe it...

Did you hear the one about the house of commons?

Someone decided to filter email on key words.

Apparently it made certain MPs and committees very upset.

[M.V. Lipvig]

Re: I dont believe it...

"Even worse are those users who just nuke everything that's "junk" without even looking."

AHHHH-CHOOOO!!!! Hasn't caused me a problem yet!

[Anonymous Coward]

Re: I dont believe it...

The problem with rejecting spam is, what is the sender supposed to do with something time-sensitive needed by the recipient?

Just getting the message passed around to the recipient to bug their provider about a filter issue can take days.

[Jamie Jones]

Re: I dont believe it...

Sure, it's far from ideal, but it's better then the email being quietly deleted. - At least the sender knows their email hasn't gotten through.

It used to be the case (probably still is formally, but no-one cares these days) that a mail server didn't send the final OK-RECEIVED message until it was sure the message had been written to disk, so short of a very badly timed disk crash, you could all but guarantee an email would be received, or bounced. In fact, sometimes if there was a "race" where machine crashed at the worst time, you could end up getting a message duplicated.

The charlatans who became "mail server experts" from the 2000's onwards threw all that away, turning email into the chain-letter upside down quoted unreliable slop started by Microsoft Outlook, and made permanent by Google. And with the dumbing down, the people in charge were dumbed down too.

(And please don't think I mean "made easier to use" when I say dumbed down - this isn't some sort of elitist geek rant, it's just another example of enshittification)

[I could be a dog really]

Re: I dont believe it...

"The problem with rejecting spam is, what is the sender supposed to do with something time-sensitive needed by the recipient?"

Ring them, go to see them, send snail mail, send a carrier pigeon, anything but assume they've got it and wonder why nothing happens. At least you know they didn't do it so can try and mitigate the problem.

[I could be a dog really]

Re: I dont believe it...

I can only assume from the downvotes to this and an earlier post that there are people who actually do think it's a good idea for a mail server to accept messages "yes, I'll take that and deliver it" - but then just toss it in the virtual bin. The mind boggles at the mindset who would rather have no idea if their message wasn't delivered than get a response (from their own mail server) to inform them about it. OK, there may be nothing you can do about it, but at least you know if it wasn't delivered.

[I could be a dog really]

Re: I dont believe it...

Seems I've reached that height of ElReg commentard status that I have my own downvote bot. I take that as an accolade.

[Anonymous Coward]

Re: I dont believe it...

Anyone got any suggestions for other email providers, that are not useless?

First off, get yourself a domain. That way you're independent of a provider and can move at will by just changing the MX (mail exchange) record. Do NOT get this from GoDaddy - ever.

Next, depending on what you want to do you could either get yourself an email package (you could, for instance, register with EasyDNS who do both domains and email), or get a small hosting package which tends to come with a couple of accounts included.

You could also use Google who will probably read your email but who did buy Postini and integrated its filtering technology into their service - the result is that they're quite well filtered, and they do support having your own domain (so you could leave Google again when you get bored with someone reading along with your email).

[ForthIsNotDead]

Re: I dont believe it...

Yeah - I got a domain name and mail hosting from Namecheap about four years ago. It's reasonable enough and works well. I get minimal spam, but I don't send many emails from that account either. I don't bother to use a mail client - their online browser-based mail thingy is perfectly fine. Outlook on my phone connects to it just fine though, but I don't bother with that any more.

[coredump]

Re: I dont believe it...

TIL Namecheap offers email service. :-)

I've been using them to register domains for a few years, after finally switching off Network Solutions (should have done it much earlier), but hadn't looked at Namecheap's other offerings. Not an immediate need but might be useful down the road, so cheers for that.

[CrazyOldCatMan]

Re: I dont believe it...

First off, get yourself a domain. That way you're independent of a provider and can move at will by just changing the MX (mail exchange) record. Do NOT get this from GoDaddy - ever

I've had a personal (family) domain for many years (got it as a freebie on a Sun training course pre-y2k). I used to run the server myself (initially on Ubuntu, then FreeBSD then Proxmox Mail Gateway). Eventually I got bored with running the server and migrated my domain over to Zoho. Which, kind of, just works. And I don't get panicked phone calls at 6am from my brother that he can't get his email..

If Zoho start to suck I'll move it elsewhere - there's not a shortage of EU based providers.

[Jamie Jones]

Re: I dont believe it...

Working for a while in a role that also involved email admin (for corporate users, not an ISP) I vowed never to rely on anyone else for email when i saw how badly the other staff dealt with issues (if there was a corruption or disk errror they'd just blindly zap the whole queue, and hope no-one notices, rather then fix the one corrupt message and/or do any salvage/notification to sender/recipient)

[Jurassic.Hermit]

Proton

It's way better than it used to be. Let's remember that it was a small project by CERN techies that caught on and has grown to now be a vry popular and secure mail product, despite its tiny budget compared to Microslop and Giggle. It's now my main personal email system and I only use my outlook.com for shopping and other guff.

[Rivalroger]

Ip address blocking

Some bright spark will decide that the following ranges are not to be trusted.

192.168.1.0/16

172.16.0.0/16

10.0.0.0/8

[Voice of Salinity]

Re: Ip address blocking

There's a single IP address that has been used to send every single piece of Spam ever transmitted: 127.0.0.1

MS should block that address on all their servers.

[I could be a dog really]

Re: Ip address blocking

Nah, from observation, all spam originates in the block 0.0.0.0/0 - so just block that and be done with it.

[Homo.Sapien.Floridanus]

Re: Ip address blocking

HEY! That’s MY IP!

[IGotOut]

Re: Ip address blocking

Well I think I've found the issue. We seem to have the same IP address

[Rivalroger]

ipv4 downvoter

Hey what is with the downvoter?

Do you want us to propose blocking ::1

[that one in the corner]

Re: ipv4 downvoter

> Hey what is with the downvoter?

He[1] just checked his own PC's config and every one of those messages mentioned one of *his* IP numbers, then two others claimed that they owned *his* IP, so now he thinks we are all trying to "hack" him.

[1] it is going to be a he, shes are too sensible and would have RTFMed first

[Anonymous Coward]

That's actually a positive change

They normally just silently drop emails rather than rejecting or delivering (even to the junk box)

That's a lot harder to track than emails actually being rejected.

Yes, I'm signed up to their SNDS/JMRP

[I could be a dog really]

Re: That's actually a positive change

Indeed, they run a broken by design system - but strangely, few people seem to think that there's anything wrong with accepting messages and then not delivering them. It shows how good the "we'll deal with your spam problem" marketing has worked.

It's a real problem in that I can look at my server logs and see a message has been accepted, but have no idea if the user will actually see it. It's hard to get angry about non-replies (like paying a bill) when you know it might be as simple as them never having received it because I have the temerity to not use one of the oligopolists enshittified systems.

[heyrick]

Block lists are only useful...

...when handled correctly. I don't use my ISP mail address because a certain list provider had a tendency to block the entire subset of ISP addresses "to make a point". Given that dealing with spammers is basically whack-a-mole, the point they made was probably not the point they wanted to make. By all means shut down spammers, but when one is happy to bring in lots of collateral damage, that's when one crosses from being useful to being arseholes.

[hmv]

Re: Block lists are only useful...

Block lists are a bad way of solving this problem (and others), but in the absence of anything else, they do a half-decent job. Just time out entries :) (I run one but for naughtier folk than spammers)

[Tron]

Microsoft support was not helpful.

Colour me shocked.

It's not just Outlook. The other night Opera urged me not to go to Microsoft's own security update site, as it was regarded as a source of phishing. Non-techies would have been scared off.

[LateAgain]

Re: Microsoft support was not helpful.

Microsoft support have NO idea why any email is blocked.

The "reputation" database is someone else's department.

It was a mystery before.

Now it's probably all AI so no-one will know what did what.

[StinkyMcStinkFace]

Re: Microsoft support was not helpful.

What is this Microsoft Support you speak of?

[captain veg]

debatable

"A block list is a good thing."

Is it?

It's debatable at best.

If someone maintained such a list that was guaranteed not to contain any false positives or collateral damage and was kept up to date *very* regularly, then maybe. But it still doesn't address the actual problem, which is that this crap gets sent in the first place, wasting internet resources which we all end up paying for. I care much less that it is blocked from being delivered into someone's mailbox.

On the odd occasion that I get spammed I report it to the upstream providers and anyone else I can identify as having the service abused by these scumbags. This is the correct response, not putting your fingers in your ears and shouting I CAN'T HEAR YOU!

-A.

[kmorwath]

Re: debatable

Sure, in in ideal world blacklist won't be needed. abuse@ addresses would reply quickly and disable the offender. It doesn't happen. There are bulletproof services that are built to help criminals, there are ISPs that don't care because that effort costs money, sysadmin that route abuse@ to /dev/null, and so on. There are real money to be made offering services to spammers and the like.

You occasion to be spammed may be just "odd" - but other systems receive milliions of spam emails (even my small mail server gets thousands per day, since some email addresses have benn around for 26 years) - daily. And to save resources, you have to block them as soon as they connect, when possible. Then for those that pass this stage, you perform more complex and resources consuming checks on sender addresses, and the mail content itself.

Collateral damages are always possibile if you use shared resources or use cheap vendors that make money cutting corners and don't remove bad actors.

[Anonymous Coward]

This has been happening for a long time now

Small business here, and this has been happening with one of our email systems for years now. I first started tracking it in Dec. of 2023. It's happened six times since then, and there were at least two occurrences before I started tracking it. Exact same set of circumstances, but it's not limited to the personal domains, it blocks everything, including to companies who are having email under their own domain hosted with Microsoft. No reason for it, JMRP has no issues with us, sometimes it's gone several months between occurrences, other times it's been just under a month. I've settled into a routine and have "form letters" that I'll use to fill out the required form, respond to the auto-response from that form that says that there's no reason it can see that we shouldn't be able to send email to their customers, etc. Usually takes around 24-48 hours, but depends on how many emails I send that they just delete without responding to. In a few cases, it's taken up to four days before they've addressed the problem. In every case, they respond saying they're "implementing mitigation". I've asked for an explanation, even including the specific dates that this has happened since I've been tracking and either get no response at all or some BS response about not being able to discuss how their spam filtering works.

I had pretty much come to the conclusion that this was their way of "encouraging" us to not have the audacity to send email from our own systems, but from the sounds of this article, it's happening to larger senders than us as well. Still not sure that it's anywhere near enough to get any attention, especially judging from the way they responded to TheReg ... same way they do to me. Just another cog in the wheel of us moving everything possible away from them as fast as we can...

[Ne body]

Re: This has been happening for a long time now

Same. Run my own mail server. Last week is was blocked for email to hotmail addresses but NOT outlook addresses due to part of my ISP's network being on their block list! Fill in the MS form. MS respond that there's no reason why mail should not be deliverable from my IP and ask for the error message (which I supplied back at the start when filling their form). Replied and copied the error message AGAIN. Within 24 hours normal service to hotmail addresses resumed as they had "mitigated the IP".

[hayzoos]

Re: This has been happening for a long time now

I work for a small business. They are using MS for stuff. I don't pry, just surmise from evidence. They use a local IT company for computer stuff which set them up with MS. They have been having problems sending emails. We provide industrial services and are scheduled ad hoc and last minute at times. As such we receive our work schedules at end of workday via email. Local IT co. has advised not to give field workers company email addresses (I guess too much admin overhead for local IT co.) So we field workers have gmail addresses created for us in a specific form. Their service email originates from {coname}.onmicrosoft.com. Months ago email to gmail was delayed from half hour to never. I requested an old outlook.com addy of mine be added to the list. I found the outlook.com addy never delayed. I suggested setting up field workers with outlook.com addys in lieu of gmail. Never happened. Last week or so, no schedule email received by anybody without a company domain email address. I bit the bullet and logged into the outlook web client, found emails had been sent to junk mail folder. I had been relying on forwarding. The headers indicated MS flagged the mail as junk almost immediately. Why does MS send emails all over their server estate before sending to the internet? So, my outlook addys for everybody idea would not have worked. I suggested co domain addys for everybody, nope, not gonna happen. They are dividing up the list and sending two or three separate emails for the work schedule. No hope in ditching MS either.

[kmorwath]

Microsoft believes the world needs only two mail providers...

... so why do you insist on running your own email server? Why do you deny them all those juicy data to train AI?

[coredump]

Re: Microsoft believes the world needs only two mail providers...

Well, only one, really. But Google believes the same thing.

Thing is, they're both wrong.

[kmorwath]

Re: Microsoft believes the world needs only two mail providers...

I believe Nadella and Pichai are much more friendlier than it looksì - and still having one "competitor" allows for taming the antitrust.

Anyway, today email is a very vast trove of different kind of data and documents to feed AIs. Swallowing as much as possibile will become more and more important once they have swallowed all available online contents. So I expect a strong push against other mail services.

[Anonymous Coward]

Yep I got chased up just the other day for an invoice that never appeared. TBH Outlook is very good at silently losing emails.

I'm sure whatever change led to the cockup was appropriately approved generated by coprolite thus producing adequate shareholder value

[Chris Hills]

Am email provider above a certain size should not be allowed to outright block emails. They can certainly mark them as spam and allow their users to filter them themselves. I certainly would not want my mailman to decide who can and cannot send mail to me.

[Pascal]

The only acknowledgement I saw from Microsoft about the issue is that they added a big yellow-background "we are aware of an issue ..." header to their deliveribality support form at https://olcsupport.office.com/ recently.

An anecdote is that across a few tickets we created for various IPs and domains last week, over the course of one hour, the ticket # counter went up by about 2 per second.

[Kevin McMurtrie]

Email is broken

Email used to be reputation based. Keep your network clean and servers accept your mail. Keep spammers and it's all refused.

Along comes the megacorps with the attitude that they're too important to ever be blocked. At least for the period of time when that's true, it makes filtering a nightmare. Blocklists need manual adjustment. Inbound mail has to be accepted and queued into an unreliable heuristics filter. That later dumps mail into a spam folder or trash. Either way, lots of spam gets through and lots of legitimate mail is silently lost.

So here we are today with email that rarely works. Thank the big corps Yahoo (died), Google (dying), SendGrid (dying), and Microsoft (barely hanging on).

[Anonymous Coward]

Microsft Borkage is not new at all

I've been fighting this issue on and off for nearly 5 years now. 2 different Virtual Private Servers with dedicated IP addresses provided through 2 different providers - each having the problem on and off at different times.

Typical scenario is go and check my server IP address reputations - always fine.

Submit the form asking them nicely to unblock the IP address.

Their response: We're not blocking you.

My response: Oh, yes you are.

Their response: We've added a mitigation to fix this.

Whenever I've asked them to fix the problem permanently, or asked them why they keep doing it, I either get no response at all, or they say that they can't discuss it.

For a long time, I've been unsure whether it's maliciousness or just incompetence. Maybe it's malicious incompetence. Typical Microsoft.

And people wonder why I hate Microsoft so much.

[kmorwath]

Re: Microsft Borkage is not new at all

I can uderstand they don't disclose why one gets blocked exactly - because that knowledge could be useful for spammers to get around filters.

But that's no excuse for not being helpful if they actually understand the filters are wrong - but such large companies have a lot of little competence in cheap frontline help desks.

[DCEdinburgh]

This happens every few months….

Our organisation suffers this email blocking every few months by Microsoft.

Microsoft use AI to calculate email threat blocking…AI gets it wrong then Microsoft put their hands up every time and unblock our Mail server IP.

The hilarious thing is our Mail server IP is in Azure and it’s Sendgrid (also in azure) and it never changes and has a globally high reputation.

Microsoft just doesn’t appear to learn.

[Anonymous Coward]

Re: This happens every few months….

Learning is for AIs now, allegedly

[AJames]

Same error - but between Outlook and Gmail

I saw this 550 error occurring last week when I sent a reply email to a client who had set up forwarding from Outlook to Gmail. But the Error 550 bounce email was from Google, not Outlook, with Google saying that Outlook could not be authenticated.

[Anonymous Coward]

Re: Same error - but between Outlook and Gmail

Reminds me of an issue I had a couple years ago, registering people for an event. A woman ended up phoning me because she hadn't received any of the confirmation emails, though her husband had gotten his. She was on Outlook.com, he was on Hotmail.com (or maybe the other way 'round). Messages not in the "spam" folder; just... not there. No bounce messages to me. Other MS addresses were receiving ok. We spent 20 minutes sending test messages before I believed it.

She also had a Gmail account (that she accessed through Outlook). So we sent her emails to ther Gmail address; worked fine. Made me very superstitiious about sending emails.

[Luiz Abdala]

The day I made a Hotmail...

...it had spam, before I told anyone I had a new email address. I hadn't typed that address anywhere, but it already had spam in it.

Before whitelists, blacklists, rules, integration with Exchange (or becoming Exchange?) and even before being POP3 (imap? whatever) addressable so you could actually use Outlook Express to read it, it had spam on the inbox, and had no spam folder.

Blocking stuff before being in any rule, 30 years later, is somehow not surprising.

[Anonymous Coward]

Spam blocking for the basic stuff

1 if it's got "emoji" characters

2 any prices in dollars (I'm not in America)

3 any reference at all to bitcoin

4 anything that say's I've won something

5 no actual readable text

[ecofeco]

Again?

Outlook has always been a pain in the ass. Exchange made it even more so.

When they finally ended Exchange, they somehow manage to keep the garbage.

M$ always gonna M$. SUCKERS!

[Uh, Mike]

There's a five letter word

There's a word for passively being dominated by someone who ignores your best interest for their own pleasure.

Starts with "B" and ends with "H."

[StinkyMcStinkFace]

Malicious incompetence. That's microsoft.

First off, WE block outlook.com and hotmail.com. Microsoft blocks me? Ask me if I care.

I would not be sending emails to someone using their service in the first place, I deal with professionals here.

[EL Senor Red]

Try being a university...

...that is sending out acceptance emails to prospective students.