Rejected emails : TT992

[symphony1010]

This  is happening with emails sent from my email account hosted by Zen Internet. Any of my recipients with Talktalk addresses reject my emails so I'm having to use alternative accounts to correspond with them. This TT992 error seems to have occurred quite frequently at Talktalk. I should add that my account has been checked for blacklisting and it works just fine with all other ISPs.

[Ady-TalkTalk]

I've checked the last 7 days for all 3 of those email addresses. We're showing no blocked incoming mails for any of them. 

Ady

[symphony1010]

Thanks. I've sent you a private notification with details of the addresses that return TT992 errors.

[Ady-TalkTalk]

Hi symphony1010, I've run a check over the last 7 days and we've blocked nothing. If there are specific email addresses please add those to your profile and I'll run the check on those too.

Ady

[Gondola]

I fear you're making too many assumptions. Google advice on DMARC. A clean bill of health from MX toolbox only means that there is an SPF file and it's in the right format.

We'll see what TalkTalk Support find when they do a check of incoming mail from your domain. You'll get a reply right here. Let's hope it turns out to be a false positive.

[symphony1010]

From what I can tell the IP address is 82.71.205.2. I note that very few email providers add DMARC as standard including Google! An SPF check + the IP address on Mx Toolbox gave me a clean bill of health.

Zen assure me that everything that can be done at their end is fine and I repeat, I have no other issues with other providers so if anything else in the setup was incorrect I'm sure I would be receiving TT992 errors from elsewhere.  Having gone through this for 15 minutes with their Tech support team there is really nothing more I can do this end.

[Gondola]

OK, the DMARC policy, such as it is, i.e. 'none' is now in place. What about the SPF record? Is that correctly specifying the actual Zen Internet mail sender? As I mentioned, I don't know if the MX server IP address is good or not as mail senders can be on the MX server. But the definitive way to tell is by looking at the received header to see what the IP address is for the mail server delivering mail into TalkTalk.

Did you identify from the MX Toolbox mail headers analysis?

TalkTalk can look at the incoming mail from your domain clarinet.org.uk over the last 7 days to see what the reason is for the TT992 spam protection bounce. It'll be interesting to see if it's an SPF fail / IP address block / Spam or virus detection. 

[symphony1010]

Zen have now called me and one of their tech people has corrected my DMARC record as I had added the domain to _dmarc. as detailed by mxtools. This gave _dmarc.clarinet.org.uk.clarinet.org.uk which obviously duplicated the domain details.

It now comes up OK in the check but my emails to TalkTalk clients still come back with TT992. Zen have confidence that other customers on the servers are not having issues - they would soon tell them. I have no TT992s from other people. Noting previous issues with TT992 errors I would have to conclude that the problem lies with TalkTalk. I note you are presently dealing with other commentators about the same issue.

[Gondola]

Unusual for Zen Internet to not get this right as the technical team are usually very good. The "48 hours" thing is DNS propagation which is the sort of delay to be expected before all DNS servers around the world replicate relevant DNS records for your website from the authoritative name server at Zen Internet. It's not relevant for SPF and DMARC for your email hosting unless that's just an internal Zen Internet delay.

As for checking SPF and DMARC you'll find that TalkTalk's policy is no different to Gmail, Yahoo Mail, BT Mail etc. The use of CloudMark sender intelligence is what TalkTalk use to control spam and other mail services use other services so that's where there can be a difference in whether mail is scanned and passed as safe, flagged as spam and put into a users' Spam folder or just blocked.

I have now moved this topic to its own topic in order to allow the original topic owner to follow up on their query.

I will recheck the SPF and DMARC for clarinet.org.uk in 24 and 48 hours to see if there are any changes. See if you can identify the Zen Internet mail server from the received email header. You can use the MX Toolbox tool to analyse headers and this may help to identify the Zen Internet server sending mail to the TalkTalk MX server. https://mxtoolbox.com/EmailHeaders.aspx

[symphony1010]

Yes, but if it's such a big deal then why only TalkTalk? I have myself put a DMARC file in place and Zen seem to confirm it so I am VERY confused. Apparently they can take up to 48 hours to migrate - perhaps that's it. 

[Gondola]

Your header, so far as I can see, has not been added here. May have been picked up by Comment spam filtering and you would have been notified of that but I cannot access the Comment spam folder.

Yes, you're absolutely right that users that receive a TT992 bounceback will have had mail blocked by the network filtering because of issues. And one of those issues is that the SPF file and DMARC policy, when checked by the TalkTalk inbound mail servers, indicate there are authentication problems.

At the moment I don't see any changes to the SPF file and MX Toolbox is still reporting that there is no DMARC policy.

[symphony1010]

It looks as though my header posting has been removed! I have to say at this point that it's still only TalkTalk producing these errors and I have never received them before, from any source. I also note you responding to the same TT992 error complaints back in 2020.

I lost many hours over the last 2 days trying to sort this. I thank you for your help but must now move on. If the problem remedies itself I will post again.

What it has caused me to do is not only think about TalkTalk but also reconsider my options in terms of hosting and email providers. If features such as DMARC, SPF and everything else are essential then they should be there from the start and not have to be implemented by the inexperienced user. By the end of yesterday Zen had me editing advanced DNS settings - that's just crazy.

Again, many thanks for your continued efforts to assist and understand the problem.

[Gondola]

When I use the MX Toolbox DMARC lookup and I'd assume inbound mail servers would do the same, I see no DMARC record.  https://mxtoolbox.com/SuperTool.aspx?action=dmarc%3aclarinet.org.uk&run=toolpage

To find the IP address of the Zen mail sender look in the received header for a line that's Received: from your domain ({IP address here}) by mx.XXX where XXX is the receiving mail server for the email address you're sending to. Hint: if the SPF file is correct then the IP address will match 82.71.205.2

May be easier to copy and paste the whole header here after redacting personal email addresses.  

The IP address you quoted and edited out is the TalkTalk server smtp-out-2.tiscali.co.uk so that's definitely not the Zen Internet outgoing mail server.

[symphony1010]

Zen confirmed the record is present.

https://mxtoolbox.com/SuperTool.aspx?action=dmarc%3a_DMARC.clarinet.org.uk.clarinet.org.uk&run=netwo...

Not sure about the IP address issue.

Thanks!

[Gondola]

No I don't see a DMARC record yet.  What I think needs clarifying is the actual sender IP address. The SPF file has the IP address of the MX server / website hosting server but it already includes the mx server in the SPF file.

I'm not saying the IP address in the SPF file is wrong, as the mail sender may well be on the MX server. But it would be worth looking at the header of one of the received mail messages to double check the sender IP address. The current SPF file is: v=spf1 +mx +a +ip4:82.71.205.2 ~all  but I believe some Zen Mail users will add in include:_spf.zen.co.uk

[symphony1010]

I have added a DMARC txt file through the Zen Customer Portal as they use that route rather than CPanel. However 2 out of 3 emails sent still receive TT992 errors. One does seem to have got through! Can you now see the DMARC in place? Just wondering if I did everything correctly!

If it doesn't sort I will move the domain elsewhere. Thanks again.

[symphony1010]

Well this has certainly taken me down a few rabbit holes!

I should point out firstly that I know next to nothing about this so was kind of hoping it would all have been in place if necessary. In the past hour I have learnt quite a lot.

My copy of cpanel does not include the Zone Editor although I was able to find a link to the ‘new zone editor’ from elsewhere in the panel. I noted that the cpanel version seems quite old 102.0.31 whilst my Krystal cpanel is stated as 106.0.18. Once I found some kind of Zone Editor it only permits the uploading of MX records and not TXT. Is this the same? I didn’t like to risk it although I was able to create a DMARC record ready for uploading.

Many thanks for your help and suggestions. I pay Zen quite a lot of money for my domain and associated emails so I'm quite surprised by any omissions!

[Gondola]

I don't see any DMARC file.

I see the SPF file that links to a Zen Internet IP address for one of their hosting servers. Is IP address 82.71.205.2, the hosting server address, also the mail sender address? There's 730 other hosted domains on that server. If they all use that same mail sender IP address then the most likely issue is that TalkTalk has detected suspicious activity from one of the domains so is scanning your mail and for some as yet unknown reason has rejected your mail. 

[symphony1010]

The domain is clarinet.org.uk. I have established on cpanel that there is a DMARC record and SPF is in place. Also reverse DNS (PTR)

Thanks for your help.

[Gondola]

To symphony1010 - does your email account have SPF authentication, DKIM signing and a DMARC policy in place?  What's the domain? Just the part of the email address after the @ symbol so we can see if there's a generic issue.

Have you been successful in sending just a plain text message?