OK, so I'm a small time email admin. I work for a company with approximately 700 email users, nothing too big or exciting. We send and receive several thousand messages a day, and block many thousands of SPAM messages a day. Recently, we noticed that our outbound queues were backing up. Of course there's always some traffic hung up outbound, people practising greylisting, email address typos, mailboxes that are full or temporarily unreachable, but we set a threashold and send alerts when the outbound queue goes over. When we started getting alarms this time I went in a took a look a noticed that 90% of the mail in the outbound queue was to Yahoo.com addresses. Things only went downhill from there.
Our email systems is nothing special, we have about 500 email users using Exchange internally, and all outbound email is sent via one of two chokepoints (we block all outbound SMTP except via these servers). These servers are RHEL5 boxes running Sendmail in concert with Mailscanner and a couple of anti-virus scanners. We scan and log every outbound message, and have policies that attempt to identify and alert on outgoing spam through the gateways. In other words, we scan our outbound mail for SPAM just like inbound mail, using the same rules and everything. We use SPF records, and DKIM signatures on our outbound mail. In other words, I think we make reasonable efforts to be good email citizens.
Still, Yahoo was deferring our messages. In the logs we were seeing errors like the following:
stat=Deferred: 421 4.7.0 [TS02] Messages from xx.xx.xx.xx temporarily deferred due to user complaints - 4.16.56.1; see http://postmaster.yahoo.com/421-ts02.html
stat=Deferred: 421 Message from (xx.xx.xx.xx) temporarily deferred - 4.16.50. Please refer to http://help.yahoo.com/help/us/mail/defer/defer-06.html
I checked to see if somehow our servers or IP addresses were somehow being used to SPAM Yahoo. Nothing seemed unusual. There were only about 100 or so emails sent to yahoo.com for the entire day. Most were small, simple messages with things like grocery lists, or boring idle chit-chat. I didn't look through every message, I guess I'm not a big fan of looking at people's personal messages, although we're an employer and employees know we can, especially for the purposes of troubleshooting. The messages in the queue seemed pretty innocuous, some pictures, a PDF brochure for a local event, nothing special.
So why has Yahoo decided we're the bad people? A search on Google turned up plenty of people with similar experiences so that didn't bode well, but I decided to fill out the online form Yahoo has for assistance with deferred mail. That's when most ridiculous part of this experience started.
The form asks for you to provide your name, contact address, and then provide details of the issue with deferrals, specifically, domain name, IP address of the server, logs, etc. I provided all of this information and waited. About 24 hours later I received the following reply:
I would appreciate it if you could provide more information to help us
troubleshoot the issue. Please note that if you are not the system
administrator for the mail server(s) affected, we encourage you to
contact the administrator so they can address the possible issues
regarding mailings from the mail server.
Please reply to this email with the following information:
Explain the details of one event with the delivery problems to Yahoo!
Mail. Please provide the entire message, including the full text of the
error message returned, and full header information.
Within a Yahoo! Mail account, you can display this information by
clicking the "Full Headers" link located within the message in the
bottom right-hand corner.
The specific server_domain name and IP address of the email server(s)
that have the delivery issue to Yahoo! Mail.
IP Address: xxx.xxx.xxx.xxx
Mail Server Domain Name: server_name.domain.com
Log messages from your mail server showing which IP you connected to
and what responses you got from the remote server at the time you
received the corresponding failures/timeouts for the event you are
reporting.
The results from a plain text message, sent to Yahoo! Mail, without
HTML, links, graphics or attachments, from the server having delivery
issues. Is the email delivered to Yahoo! Inbox?
We appreciate your assistance. This information will be helpful in
determining the reason why you are having issues when delivering mail to
Yahoo! Mail accounts.
What the was the point of filling out the online form? For the most part they just asked for all the same information that was required when submitting the form. I decided that they did at least ask for a few things additional things like mail headers, so sent them a response that included the mail headers, IP address and server name again, as well as the other information. 24 hours later I get this response:
Without any specific SMTP error message, I am unable to effectively
troubleshoot the issue.
Occasionally, interruptions or disruptions in email transmissions over
the Internet will render a message undeliverable. While this is very
rare, it does happen. If you continue to experience this delivery issue,
in order to troubleshoot it, we would appreciate it if you could provide
a full SMTP thread that represents the connection that resulted in the
delivery failure. Please provide:
The output of a manual SMTP test (typically with telnet) from your
mail server to our servers showing the SMTP conversation leading up to
and including the rejection message.
Log messages from your mail server showing which IP you connected to
and what responses you got from the remote server at the time you
received the failures.
What? Are you kidding me? I sent specific information, including the exact error message. I sent logs of an SMTP session, I sent logs with the IP information of both my server, and the various Yahoo SMTP servers I connected to. I repeated this process once more, only to get yet another response for the same thing another 24 hours later. At this point I decided that either it's just a braindead computer at the other end, or the most overworked, underpaid and useless tech support staff ever.
So, I took a new tact. I decided to send all of our outbound mail via our secondary mail gateway. It uses a different ISP and has a different IP address, and is located in a different state. This worked for about a day before Yahoo decided to throttle that connection. It took approximately 100 messages in a 24 hour period, what looked mostly small simple message to friends and family, before Yahoo throttled that IP address. Seriously, 100 messages in 24 hours is what it takes to get throttled? With 500 users, it doesn't really surprise me that we see 100 messages a day to Yahoo since they're so big, yet Yahoo thinks we must be spammers. Even better, when mail does finally get through it is many times thrown in the "Spam" folder even though the headers show verified DKIM signature and SPF record. I have no idea how to prevent that.
This is not really a big deal for me, it's just Yahoo Mail (we have no problem whatsoever sending to other big hosts). But if you use Yahoo Mail you should know that Yahoo themselves could care less whether you get your mail or not. They intentionally design the system to make it difficult for legitimate mail to be deliver by using techniques that are only marginally useful to stop actual SPAM from getting to you and when legitimate admins attempt to work with them to correct false positives it's an impossible divide to cross. Maybe that's why my wife's Yahoo account is pretty much 100% SPAM. Of course maybe that makes a Yahoo Mail account perfect for those times when you have to give out an email address but don't want to actually receive anything from that contact. In other words, Yahoo Mail may make the perfect "trash" account service, that's probably all it's good for.
Thursday, March 4. 2010 at 04:08 (Reply)
Monday, April 26. 2010 at 23:38 (Link) (Reply)