Not receiving some emails

[ClareB8]

Someone has tried sending me an email 4 times and it still hasn’t come through! What can I do? How can I check if I’m not receiving other emails too? Thank you!

[Gondola]

I will come back and tell you. So when I know you'll know.

But if you find out before me do let me know!

[ClareB8]

Many thanks for the update. When will I know it’s been resolved?

[Gondola]

It's a TalkTalk issue in having to respond to high levels of spam being sent via Microsoft mail servers. It's a Microsoft issue to improve the reputation of their mail servers by eliminating or better control of the sending of spam at source. My Gmail account dumped Outlook mail into the spam folder as a precautionary measure.

These issues are usually temporary. But during an incident, whether caused by high volumes of spam or a failure of full authentication which is also treated as spam, it does cause us all some inconvenience.

[ClareB8]

So do you think this is a talktalk issue? Will you let me know when it’s been resolved? Thank you for your assistance.

[Gondola]

It's been reported. Feel free to call TalkTalk yourself if you wish to be reassured.

[CliffW1]

Do we know whether Talktalk staff have picked up on this yet? How are they informed? Do we just hope they keep an eye on this forum?

[ClareB8]

I have asked another friend with a @hotmail.co.uk to send me a test email and that also did not come through. She said she got the TT992 error message. What can be done if @talktalk.net email accounts cannot receive emails from @Hotmail.co.uk email accounts? Who can assist?!

[Barney23]

Thanks, interesting to know. I’ve just sent hotmail to gmail and it arrived to the inbox ok. It’s a conundrum, but so far from my tests at least the issue seems limited to hotmail (outlook) to talktalk. Not sure if other domains are affected.

[CliffW1]

From the testing I did between 3 talktalk, 2 outlook and 2 gmail accounts, plus other information posted here, it seems to me that the problem is the talktalk (and hotmail?) servers are rejecting emails from outlook accounts (but still accepting gmail). I can send emails from talktalk to outlook, so it is only the receiving of outlook messages by talktalk (and hotmail?) that is affected. 

I don't know if it will help, but here is the source data for the email sent from my outlook account that was rejected by talktalk - as it appears in my outlook sent box (email addresses partially redacted with **** s)

Received: from [192.168.1.104] (2603:10a6:600:315::16) by

 DBAP191MB1180.EURP191.PROD.OUTLOOK.COM (2603:10a6:10:1ce::15) with Microsoft

 SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

 15.20.7135.21 via Mailbox Transport; Fri, 29 Dec 2023 16:33:34 +0000

Message-ID:

 <DBAP191MB1180CE128D90309EE0FADE00889DA@DBAP191MB1180.EURP191.PROD.OUTLOOK.COM>

Date: Fri, 29 Dec 2023 16:33:26 +0000

User-Agent: Mozilla Thunderbird

Content-Language: en-GB

To: C******* <m********w@talktalk.net>

From: C******** <c*************5@outlook.com>

Subject: test

Content-Type: text/plain; charset=UTF-8; format=flowed

Content-Transfer-Encoding: 7bit

X-MS-Exchange-Organization-ExpirationStartTime: 29 Dec 2023 16:33:35.1685

 (UTC)

X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit

X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000

X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit

X-MS-Exchange-Organization-Network-Message-Id:

 1f753468-e01c-4622-52a1-08dc088be72c

X-MS-Exchange-Organization-AuthSource: DBAP191MB1180.EURP191.PROD.OUTLOOK.COM

X-MS-Exchange-Organization-AuthAs: Internal

X-MS-Exchange-Organization-AuthMechanism: 06

X-TMN: [/nJvr9VHecewzKVch7tbqQ092IGeV4jE]

X-ClientProxiedBy: LO4P265CA0228.GBRP265.PROD.OUTLOOK.COM

 (2603:10a6:600:315::16) To DBAP191MB1180.EURP191.PROD.OUTLOOK.COM

 (2603:10a6:10:1ce::15)

X-MS-Exchange-Organization-MessageDirectionality: Originating

Return-Path: cjwhittaker125@outlook.com

X-Microsoft-Original-Message-ID:

 <d393a044-58f7-4c41-b59f-e220dc1ede57@outlook.com>

MIME-Version: 1.0

[Gondola]

I've also now tested with Outlook.com, however, the results are not entirely conclusive.

Mail from Outlook.com to Gmail gets dumped into Gmail's Spam folder with the comment

Why is this message in spam?

Lots of messages from outlook.com were identified as spam in the past.

The message is fully authenticated and clearly not spam but obviously Google are not scanning for spam and taking a simple approach of declaring all outlook.com mail as spam until the user chooses to Report as not spam.

Mail from Outlook.com to TalkTalk Mail gets a TT992 spam protection bounce. The header information suggests that the sending IP address is not authenticated. However, the IPv6 address is not the same as the IPv6 address authenticated by Gmail and is not one of the designated sender addresses given in the SPF files.

My feeling is that I'm not seeing or not being shown the actual original sender IP address in the supposed original header displayed by the Microsoft bounceback servers.

[Barney23]

I’ve done more testing and got two known hotmail (aka outlook) users to send me test emails to my talktalk. Both failed as undelivered. That rules out my hotmail/settings being at fault.

I’ve tried sending hotmail to a friend on talktalk. Again, undelivered TT992. That rules out it being isolated to between my talktalk and hotmail.

I’ve successfully sent hotmail to other domains, so hotmail is working fine outside of TT.

My talktalk will successfully receive emails from other domains.

So the problem appears to be with talktalk unable to receive from hotmail (outlook) specifically and tests indicate it may affect everyone, particularly as this thread has contributors with the same issue. But, I can’t be certain, testing was consistent but limited. Other providers might be affected, just not found any.

I can assume talktalk are aware, or hope so. Maybe they’ve had to take a temporary security measure or it’s a glitch and dealing with it. Who knows.
I’m not going to mess with any settings, I don’t think it will help and possibly make more problems. Hopefully TT will resolve internally in due course, or provide information.

[Gondola]

There is the ability to view an email header - on the outlook.live.com website:

• Select the email
• Select the triple dots (ellipsis icon top right of the message)
• From the menu select View
• From the sub-menu select View message source
• Copy the email header from the modal that opens

But the header will not necessarily be from the hotmail.com outgoing mail servers just from the bounceback servers so not helpfully conclusive.

[Gliwmaeden2]

I signed into Hotmail via the web just now, and all I can see is the same muddle from the two test messages I sent myself. 

The only difference is that on webmail it shows the attempt for them to  notify me at Talktalk. Odd. As though they tried to send it to my Talktalk address. 

Whereas, on the mobile app, I only saw it addressed to and from Postmaster.

Otherwise identical, @Gondola.

And there's no menu on the webmail version that takes ne to the diagnostics etc.

[Gondola]

Thanks for the assist. So far no joy with determining a root cause. I don't use Microsoft Mail so unable to test.

Looking back, in addition to the Microsoft DNS fail with SPF authentication in August there was a similar incident for inbound mail to TalkTalk from Microsoft reported in May 2023 here. Apparently not affecting all Microsoft Mail which suggests either mail was being rate limited as spam protection (ties in directly to a TT992 bounce) or one or more Microsoft mail senders are not fully authenticated (ties in indirectly to a TT992 bounce).

However, the incident in May 2023 looks to have been transient. The root cause then was not given via that particular Community topic.

[Gondola]

The only IP addresses I see so far are Outlook server IPv6 addresses that don't match to the only IPv6 addresses in one of the hotmail SPF 'includes' and those designated sender addresses start with 2a01.

[Gliwmaeden2]

One further patch from around the middle, @Gondola but probably simply repetition:

(Removed from public view)

 

[Gliwmaeden2]

A couple more bits from further down:

(Removed from public view)

 

 

[Gondola]

Yes that is helpful but what I've seen so far doesn't tell me the sending IP address although it does say in the ARC authentication results that spf=none dmarc=none dkim=none and arc=none

Which tells me that either there's no authentication at all for the original hotmail email (which would be unusual) or that their new ARC system isn't operating.

[Gliwmaeden2]

There is this sort of stuff in the detail of the original error message:

(Removed from public view)

 

It goes on for ages, @Gondola. Hope that's a help.

[Gondola]

The apps are of no help for diagnostics in issues like this.