how to uncover e-mail IPs for non-deliveries

[DougLass]

I was on Sender as a listserver, and gave that up because they assigned me a blacklisted IP, and wouldn't fix it. E-mail deliveries to many of my subscribers were denied. I'm now on MailerLite, which is a LOT better, delivery-wise, but still not perfect.

I'd like to understand more about why my e-mails are being denied. In many respects, this comes down to establishing the IP that they are being sent from. Of course, when an e-mail bounces, you don't get a record of what IP sent it! That is, you can't ask the recipient target what IP it came from, because they never got it.

MailerLite will only tell me RANGES of IPs that they use. What's confusing is that when I send these MailerLite e-mails to myself with different mail servers (Comcast, Outlook, gmail, etc) they all seem to arrive from different IPs, and not necessarily even ones that MailerLite say they use. Why is that? Gmail is the only one that seems to report a real MailerLite IP.

It would be nice to understand a real strategy for investigating the role of blacklisted IPs in e-mail non-delivery. I haven't figured one out. Having done that, and establishing a blacklisted IP, how do you fix it? Trend Micro (mail-abuse.com) does seem to offer limited unblacklisting for their own spam lists.

[jarland]

Your SMTP provider knows which IP was used. But you shouldn't just scan an IP for blacklisting and then declare any listing to be the problem, despite all popular advice. Misinformation as advice is extremely common for email. Most email services don't even use most blacklists. There's thousands of public facing blacklists, I'd wager, and most email services use a number of them between 0 and 2.

Instead ask your provider why RecipientA didn't get an email, let them explain why and what needs to be fixed for them to have received it. It's their job.

IP blacklisting is much less common of a problem these days. Gmail doesn't use them. Hotmail only uses Spamhaus (and only their domain lists I think). All of the major services have their own content and IP filtering, and you can't check for those on any blacklisting check site. You have to treat every delivery failure as individual and learn from documentation what they mean, and what recommendations are for dealing with it. Every one of them is separate if you've done the basics (SPF, DKIM, etc). It's also not unusual for them to not be documented for the sole purpose of not helping you get past their filters.

Also I'll have to double check but I'm pretty sure I recall MailerLite being a source of almost exclusively spam.

[DougLass]

Well, I asked MailerLite, and all they could tell me, for a given e-maiI sent, was only the RANGE of IPs, as in xxx.xxx.xx.x/24 that was used. That's 256 IPs! I can't check all of them!

But yes, it seems that you can't go to any one blacklist to check. https://mxtoolbox.com/SuperTool.aspx will do a blacklist check for a single IP against some 80 blacklists, but I have to assume that doesn't cover everything. Yes, I suspected that many blacklists would be private specifically so you couldn't challenge them.

And yes, I've started a ticket with MailerLite.

MailerLite is pretty highly rated, and out of about 800 subscribers, only a dozen or so of my subscribers are rejecting. It was several hundred with Sender.

But why are these e-mails being received, by different recipient servers, from different IPs? Is the sending IP getting handed off to others by the e-mail client server? Now, does the fact that gmail doesn't do IP blacklisting mean that the IP that gmail received from is,in fact, the IP that it was sent out on?

[jarland]

Originally Posted by DougLass

Well, I asked MailerLite, and all they could tell me, for a given e-maiI sent, was only the RANGE of IPs, as in xxx.xxx.xx.x/24 that was used. That's 256 IPs! I can't check all of them!

But yes, it seems that you can't go to any one blacklist to check. https://mxtoolbox.com/SuperTool.aspx will do a blacklist check for a single IP against some 80 blacklists, but I have to assume that doesn't cover everything. Yes, I suspected that many blacklists would be private specifically so you couldn't challenge them.

And yes, I've started a ticket with MailerLite.

MailerLite is pretty highly rated, and out of about 800 subscribers, only a dozen or so of my subscribers are rejecting. It was several hundred with Sender.

But why are these e-mails being received, by different recipient servers, from different IPs? Is the sending IP getting handed off to others by the e-mail client server? Now, does the fact that gmail doesn't do IP blacklisting mean that the IP that gmail received from is,in fact, the IP that it was sent out on?

I think I can actually change your perspective of that for the better. I think you'll like this.

So 48-50% of all outbound mail my customers send every day goes to Gmail. I assume other mail services see roughly the same, my sample size isn't very small. Because of this, Gmail ends up being the driving force behind most changes and configurations and understandably so. Hotmail/Outlook/Office365 trails in a distant but very significant second place, meaning that they become the next in line for "why we do things the way we do."

Gmail rate limits incoming email from IP addresses. So if you send any reasonable volume of email to Gmail and you only use one IP address, either a whole bunch of your emails bounce back or you'll configure your mail system to keep trying and a bunch of your emails will be delayed for several hours on a regular basis.

Hotmail/Outlook/O365 builds up IP reputation based on how often an IP address is seen and it's statistical correlation between desired and undesired emails (decided by customers marking emails from the IPs as spam).

So you need enough IP addresses in your outbound pool to avoid Gmail rate limiting, but not so many that Microsoft never sees a single IP address often enough to build up a reputation for it.

For my customers, we've drilled our outbound pool down to a /24 as well, it's somewhat of a sweet spot to balance the needs of Gmail and Microsoft, and that accounts for most of the email our customers send.

Also a note of warning: Be careful with mxtoolbox. A few years ago they added a fake RBL to their list which caused every IP to return as blacklisted. I have my speculations on why they act the way that they do, but it is my observation that their primary function is to confirm negative bias against your hosting provider. It could be that they're biased, incompetent, or that they're angling for you to think they're useful enough to want to pay for their paid services: https://mxtoolbox.com/Public/Content...ature-selected

Personally, I think it's the latter. I think that's why mxtoolbox almost always wants to tell you that something outside of your control is wrong and broken. I know they come highly recommended, but recommendations and advice on email delivery are so consistently poor across the internet that you want to be skeptical of everyone. You can test me on that: Ask around if backlisting on UCEPROTECT L3 will cause your emails to be blocked or filtered to the spam folder by Hotmail. Almost everyone in the industry, even respected industry professionals, will tell you "Yes it will cause that." It doesn't. It's 100% false. That's the state of advice and recommendations across the internet when it comes to email delivery. Some days I feel like it's just me vs a mob of misinformation (not to say I always get everything right).

[DougLass]

That's good info about mxtoolbox. They are selling a service, and they sure want to make it look like you need their service!

Now, my subscribers are probably only 20% gmail.The rest are mostly industrial, and my understanding is that they often use Microsoft (Outlook) or Trend for e-mail management. That is, when you go to them and say "Why are you rejecting my e-mails?!" they say "Don't look at us, we outsource all that crap."

I only send each subscriber 3 e-mails a week. So I'm not going to kick off any rate limits, I think.

But again, if MailerLite sends out e-mails with one IP, how come many of my e-mails are received by subscribers as coming from different IPs, and ones which MailerLite claims to never use? That is, to the extent IPs are being rejected,I don't know which one is being rejected.

[jarland]

Originally Posted by DougLass

That's good info about mxtoolbox. They are selling a service, and they sure want to make it look like you need their service!

Now, my subscribers are probably only 20% gmail.The rest are mostly industrial, and my understanding is that they often use Microsoft (Outlook) or Trend for e-mail management. That is, when you go to them and say "Why are you rejecting my e-mails?!" they say "Don't look at us, we outsource all that crap."

I only send each subscriber 3 e-mails a week. So I'm not going to kick off any rate limits, I think.

But again, if MailerLite sends out e-mails with one IP, how come many of my e-mails are received by subscribers as coming from different IPs, and ones which MailerLite claims to never use? That is, to the extent IPs are being rejected,I don't know which one is being rejected.

They're not sending from just one IP. They're doing the same as I do with my /24 and for the same reason. While you may only send to a few Gmail users, consider that these IPs aren't dedicated to you and they're part of a pool that all of their subscribers use (with exception of maybe some subscribers that pay them extra for dedicated IPs).

Side note:

If you're ever interested in working with me on this mailing list, I think it'd be cool. I don't want to come across as trying to sell my service, I just really enjoy deliverability puzzles and I like working with customers that have a hard time getting things delivered. I couldn't promise to do any better of a job, very possibly couldn't, but I can quickly and very honestly give feedback as to why I think some recipients are failing. Most SMTP services will check logs and escalate over a long period of time, I audit rejected emails every single day because I want to learn every scenario and what (if anything) I can do to mitigate them. It's fun when a hobby becomes a business.

[DougLass]

Well, to the extent that one company is blocking my e-mails, and to the extent that the subscribers in that company have no clue what IP is being blocked, because they're not getting the e-mails, and the listserve provider is sending out to my subscribers on many IPs, I'm not sure what my recourse is. I can't ask to have a particular IP unblocked, because I don't know what that particular IP is. I guess my only option is to work with the provider (in this case, MailerLite), tell them precisely who is getting blocked, and hope that they can figure it all out.

[SideshowBob]

Originally Posted by jarland

IP blacklisting is much less common of a problem these days. Gmail doesn't use them.

I'm curious as to how you know that.

[jarland]

Originally Posted by SideshowBob

I'm curious as to how you know that.

Process of elimination + contacts at Google. They do use their own "safe browsing" blacklist which might correlate to other blacklists (entirely plausible for two blacklists to see the same problem at the same time) but doesn't pull from them. But if you trigger that there won't be any room for interpretation, you'll know. It won't just be like "I landed in the spam folder and I think this is why."

Knowing what Google does and doesn't do is pretty much key to my work at MXroute, I'm always experimenting with their responses, gathering data around them, etc. I don't like to keep it to myself, always happy to share it.

You can also learn a lot by observing and interacting with key players here: https://www.mailop.org/

[DougLass]

I'm still trying to understand why I receive my listserve newsletter from MailerLite, at several different e-mail addresses (Outlook,Comcast, etc.) from IPs that MailerLite says it doesn't use. When I get it at gMail, it IS from an IP they say they use. Is this what is called an email "forwarder"? I know Microsoft (Outlook, etc.) does that.

One would like to believe that if an e-mail is forwarded, it is judged spam-benign by the forwarder, and is forwarded to an IP that is also unblacklisted.

What is e-mail forwarding, and why is it done?

Also, that's interesting about mailop.org. Is that a forum like what we're participating in here?

[jarland]

Originally Posted by DougLass

I'm still trying to understand why I receive my listserve newsletter from MailerLite, at several different e-mail addresses (Outlook,Comcast, etc.) from IPs that MailerLite says it doesn't use. When I get it at gMail, it IS from an IP they say they use. Is this what is called an email "forwarder"? I know Microsoft (Outlook, etc.) does that.

One would like to believe that if an e-mail is forwarded, it is judged spam-benign by the forwarder, and is forwarded to an IP that is also unblacklisted.

What is e-mail forwarding, and why is it done?

Also, that's interesting about mailop.org. Is that a forum like what we're participating in here?

If your recipients are forwarding email then it would make sense that a recipient further down the line is receiving your emails from an IP address that mailerlite wouldn't use. That's the only scenario that makes sense to me.

I hate email forwarders, but I've long since accepted that people desperately want to be able to do it, and that's why a "reject" rule on your DMARC record can often be more problematic than it's worth, because it breaks a lot of email forwarding implementations. Even though those implementations can be considered broken in themselves, it's often better to choose the path of least resistance.

[DougLass]

I don't think recipients are doing forwarding. I suspect that the services they're hiring to manage their e-mail, e.g. Outlook,Trend, are doing it. For what reason, I can't imagine.