Incoming email rejected with error 421 Message failed: 452 ***** Content deferred (TT991)

[perplexed2]

I have my own DNS domain that I use for email and I use the email forwarding service forwardemail.net to redirect emails addressed to that domain to my TalkTalk account. All my forwarded emails are now being rejected by TalkTalk with the error message

421 Message failed: 452 4.2.0 eyxgriSFmlGKkeyxhriuMv Content deferred (TT991)

where the random string in the middle changes for each email. This started happening on 27th February at 3:01pm, suggesting something changed at 3pm. Is there any way to stop this happening? Having worked through the forwardemail.net logs for the failed messages I can't see any that I would want rejected. I can still send emails directly to my TalkTalk account. It is only emails going via forwardemail.net that are affected but given how many important services are sending email by that route (e.g. I see HMRC and my bank in the logs) this is a major problem for me.

[Ady-TalkTalk]

That's excellent news. Thanks for posting back to let us know. 

Ady

[perplexed2]

Just to let you know, email appears to be working again. At first only very simple emails were getting through and even those were delayed by 20 minutes but gradually more emails got through and as of Sunday it seems back to normal. Now I just have to work out if there was anything important that I missed in the 5 days it wasn't working.

[Ady-TalkTalk]

Hi, the 7 day scans show no rejected mail to the 2 receiving mail addresses provided. I've got more scans queued for the  sending addresses. I'll post back once those complete.

Ady

[Gondola]

Request for a CloudMark check is made to TalkTalk Community Support.

[perplexed2]

I've added information to my Community Profile Personal Information Private Notes as requested and included the headers of three recent failed emails.

[Gondola]

Feels like forwardemail.net may have been sending spam or malware and therefore TalkTalk's CloudMark / ProofPoint system is not allowing mail through. The original notification 452 4.2.0 is a temporary fail code.

We can ask TalkTalk to check for the previous 7 days to try and identify what's happening. They'll need to know the actual mail sender domain if not forwardemail.net as well as your personal domain and one of the originating senders' domains for completeness. If you add those to the Community Profile Personal Information Private Notes and let us know when that's done and I'll make a request for you.

[perplexed2]

Thanks for the reply. There is no personal domain mail hosting service behind my domain. I'm trying to avoid having to pay extra to have one.  Things have been working well up to now and TalkTalk providing email is the major reason for staying with them. (I've been a customer of TalkTalk and its precursors for about 30 years.) There doesn't seem to be anything temporary about this  appearance of TT991. I was receiving emails up to 14:04 on 27th February and as of the next email at 15:01 they are all failing to be delivered no matter the contents, even simple test emails with just one line of text.

[Gondola]

Hi @perplexed2 

TT991 is an indication that mail delivery has been deferred for scanning. It's a notification of a temporary delivery delay not a permanent block. However, if the mail does not get delivered then it's been dropped at the scanning stage.

Forwardemail.net does use the Sender Rewriting Scheme (SRS) to authenticate forwarded emails so in theory this should offer sufficient authentication even if the original sender does not allow other mail services to handle its mail. Banks and government services do not allow other mail services to handle their mail to avoid fraud.

Is there any reason why you cannot collect mail from your personal domain mail hosting service? Mail collection is more reliable than auto forwarding even with SRS applied, assuming that SRS is working at forwardemail.net.