Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[Ontramail]

Hi All,

Around 7/15 my company started failing SPF at Hotmail about 30% of the time. Upon further inspection of the received headers I found that Hotmail was internally relaying the emails for spam checking, then trying to authenticate our SPF against their internal IP instead of the actual sending IP. Of course this soft fails SPF.

Has anyone else had this same issue recently?

Here is one of the headers for reference.

^{MIME-Version: 1.0
Received: from BLUPR12MB0420.namprd12.prod.outlook.com (10.162.92.13) by
 BLUPR12MB0417.namprd12.prod.outlook.com (10.162.91.30) with Microsoft SMTP
 Server (TLS) id 15.1.225.19 via Mailbox Transport; Fri, 31 Jul 2015 15:18:31
 +0000
Received: from DM3PR12CA0028.namprd12.prod.outlook.com (10.164.12.166) by
 BLUPR12MB0420.namprd12.prod.outlook.com (10.162.92.13) with Microsoft SMTP
 Server (TLS) id 15.1.225.19; Fri, 31 Jul 2015 15:18:30 +0000
Received: from BL2FFO11OLC008.protection.gbl (2a01:111:f400:7c09::111) by
 DM3PR12CA0028.outlook.office365.com (2a01:111:e400:599f::38) with Microsoft
 SMTP Server (TLS) id 15.1.225.19 via Frontend Transport; Fri, 31 Jul 2015
 15:18:30 +0000
Authentication-Results: spf=softfail (sender IP is 10.173.160.30)
 smtp.mailfrom=ontramail.com; hotmail.com; dkim=pass (signature was verified)
 header.d=ontramail.com;
Received-SPF: SoftFail (protection.outlook.com: domain of transitioning
 ontramail.com discourages use of 10.173.160.30 as permitted sender)
Received: from COL004-MC1F33.hotmail.com (10.173.160.30) by
 BL2FFO11OLC008.mail.protection.outlook.com (10.173.160.143) with Microsoft
 SMTP Server (TLS) id 15.1.231.11 via Frontend Transport; Fri, 31 Jul 2015
 15:18:29 +0000
Received: from mail8.ontramail.com ([66.205.189.34]) by COL004-MC1F33.hotmail.com with Microsoft SMTPSVC(7.5.7601.23008);
 Fri, 31 Jul 2015 08:18:07 -0700
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=default; d=ontramail.com;
 h=Date:From:To:Reply-to:Subject:Sender:MIME-Version:Content-Type:List-Unsubscribe:Message-ID; i=11103@ontramail.com;
 bh=bLDPmkC95891Bi4dPyKlLLcQR50=;
 b=Pzn5mXwW7G3GK0w6BiZqQ1UqEUfugxOl8sZo7po6WbQgjtcw1FWetotUwiE51WuMauIhna/NK2ya
   0+FZlNGcSFjXQMIjJls6ptaCnEO5CpUueeb/Te14zZPvZaz2RlTjzxyYAlibGDtprvGwmXkjYDFR
   xZdP6MtkRoAMObe1mmM=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=default; d=ontramail.com;
 b=Q5jmheGC2jWG11Vk3JlcrBeCygLWzS+H5GiRK1uJ8IBdpK5+xOWGYjHpJZCyrfl5rcD7lDIUeFYL
   /hLzG+M2Nz67hx55OhGWxdNkKZsIgDKBdVCRIjEDlG39YNI/eAxJv+apY8WnHzvHLqk0q2fhMjii
   Kp2IimYxm7b7TQ5moKA=;
Received: from mail001.production1.lan (127.0.0.1) by mail8.ontramail.com id hne8qu17gc4q for <aaronschuster250@hotmail.com>; Fri, 31 Jul 2015 08:18:07 -0700 (envelope-from <11103@ontramail.com>)
Date: Fri, 31 Jul 2015 08:18:07 -0700
From: "Marni Battista" <support@first100kcoachacademy.com>
To: aaronschuster250@hotmail.com
Reply-to:
Subject: Last Chance - Early Bird Discount Expires TONIGHT}

[ReyM]

I would think one of two things looking at the headers.

1 - Hotmail was having an issue with one or more of their MTA's
2 - It could be possible that the hotmail recips you sent to had a forward to another hotmail account and it was looping through the system

The last time I saw tons of internal relaying was due to the old vacation reply to a vacation reply (until the disk filled).

Are the other examples the same? Same internal MTA's?