emails from 1 contact suddenly undeliverable

[RichardJP]

Hi, a friend using hotmail is now having all his messages to me rejected with the following rejection message:

cm8nec gave this error:
KGKSrngFCUCUsKGKSr276g Content rejected (TT992)

It's only his account, he can send to my gmail account, but both his and his wife's hotmail addresses generate the same response now as of 31st December 2023.

Any odeas?

Thanks

[Gondola]

I appreciate your time to let us know. It's perfect when we know a topic is resolved. Thank you.

[RichardJP]

Hi, Sorry for my tardiness in replying, I was following the developments on the other thread Ady and Gondola were investigating and forgot about my own! The problem has now been resolved for my friend too, so many many thanks to everyone involved and for offering support especially at holiday times.

Keep up the great work!

RichardJP

[Ady-TalkTalk]

I've made the email and incidents team aware of the issue with us blocking hotmail and Outlook. Hopefully, they'll put a quick fix in. 

Ady

[Gondola]

I've now gone back a few months to recall an archive of mail sending from outlook.com to talktalk mail.  In an example the sending IP address was fully authenticated and is still fully authenticated. The sending IP address then was 40.92.48.53 that resolves to mail-vi1eur02olkn2053.outbound.protection.outlook.com with the authentication provided via a valid SPF file at outlook.com.

What I have now found is that SORBS SPAM show the sending IP address as "40.92.48.53 was listed".  This is part of a bigger range of IP addresses authenticated for Microsoft senders. The full range is 40.92.0.0/15. I've not checked the full range.

I know that CloudMark the sender intelligence engine that does spam fingerprinting for TalkTalk does take on board listings by some of the spam listing agencies including SORBS. Not surprising really as both CloudMark and SORBS are owned by ProofPoint. So, whilst I do not know the current sending IP address or addresses in use for outlook.com and hotmail.com I would say that it's highly likely that CloudMark is flagging up spam on the basis of detection by spam traps operated by SORBS SPAM.

We'll need to wait for TalkTalk Support to check the reason for the inbound mail servers operating spam blocking with the TT992 bounceback and if it simply is the automatic response of CloudMark's sender intelligence engine being informed in part by SORBS as well as by input from TalkTalk Mail users.

[RichardJP]

Hi Keith,

Thanks for the reply. Since posting the problem I have found the other thread and comments from @Gondola, but there doen't appear to be any solution that we as users can effect. I've also found a thread from April 2023 with input from @Gondola dealing with the same problem. However, again there doesn't seems to have been anything we can actually do to solve it ouselves, or prevent it happening. This is the first time I've had this problem so don't know if it's common, or not.

Richard

[KeithFrench]

This is a known problem that @Gondola has been dealing with.