NC041 has been rebooted and is again online and serving websites. Our apologies for the brief interruption. It was down for about a minute.
NC041 has been rebooted and is again online and serving websites. Our apologies for the brief interruption. It was down for about a minute.
In a few minutes we will be rebooting NC041, the primary web server. It should only be down for about a minute, and we’ll post here again as soon as it is up.
Just about a month ago we became aware of the problem with delivering email to Microsoft-hosted domains. At that time, one of the actions we took was to pay to have our mail server’s IP address listed in the UCEPROTECT whitelist that effectively removed our IP address from a huge list of blacklisted IP addresses that are only listed because of the lackadaisical approach of our data centre (Digital Ocean) to removing spammers from their network of data centres.
We weren’t certain at the time that this action would achieve anything and, to be frank, we have no concrete evidence to believe that our doing so has had the desired effect. We think there is strong evidence that it has, but there is no way we can determine that definitively. The strong evidence is that we have had very few problems with mail to Microsoft-hosted domains since a couple of days after the problem started on 20 June.
Our subscription to this whitelist expires on Monday the 22nd. To test the effectiveness of this subscription we are going to allow it to lapse. If we see a sudden uptick in email messages to Microsoft-hosted domains bouncing then we’ll take that as evidence that the subscription is working, and we’ll immediately renew it. In that case, messages you send to such domains will bounce temporarily, so please forward those bounce messages to NinerNet support and we will immediately divert future messages to those domains via our secondary outbound mail servers. This is a temporary and planned test; if these bounces happen it is not evidence that our systems are failing for any reason. If they don’t bounce then we will have learned that our paying for the listing is a waste of money.
The purpose of this message is to let you know of this test in advance. We expect that if messages start bouncing again and we renew the subscription, everything will be back to normal within about 24 hours, and immediately for domains we add to our mail server configuration to have messages go out via our secondary mail server. That said, we have also found that retrying if you get a bounce in this situation sometimes succeeds! It’s bizarre.
Thank-you for your continued patience with issues like this thrown at us by massive providers that don’t care about you, people who choose to host with their competitors.
Yesterday, 20 June 2024, multiple clients began contacting us to report that email they were sending to certain domains was bouncing. We responded as usual by routing messages to the problem domains via our secondary SMTP server. In other words, this wasn’t an unusual experience, and we mitigated it immediately as we always do.
However, it very quickly became apparent that all of the problem destination domains in these multiple reports were hosted by a single hosting provider: Microsoft … or Outlook, or Hotmail, or however they’d like to be known today.
As we’ve said to our clients for many years, fighting spam is a never-ending battle. It’s a big issue for hosting companies big and small; however, the power of small hosting companies like NinerNet to deal with massive companies like Microsoft, Gmail, Yahoo, etc., is almost non-existent. Actually, it’s not almost non-existent, it is totally non-existent. For many years NinerNet has been (and still is) a member of or participant in the Outlook.com “Smart Network Data Services” system. This was supposed to give small providers like NinerNet access to the decision makers at Microsoft (the so-called postmaster[s]) so that we could work out issues together as if we were all grown-ups. However, it has never actually worked that way. Instead, the big hosting providers listed above treat companies like NinerNet with disdain. After all, we’re competitors, and every client who hosts with NinerNet takes away revenue from the big boys.
The rest of this blog post is lengthy, and goes into a fair bit of detail. The summary is that a huge email hosting provider (Microsoft) has suddenly made sending email to them very difficult for us, but NinerNet has done and is doing everything we can to provide a working service to our clientele.
Today we find we’re in a situation where one of the biggest email hosting companies in the world — owned and run by Microsoft — is refusing email from companies like NinerNet. This is anti-competitive, which you wouldn’t expect from a company headquartered in a country where the competitive marketplace is supposed to trump (pardon the pun) everything else.
The bounce messages generated by the failed deliveries offer a “delisting” service, purely because Microsoft seems to actually realise that they have acted with a very heavy hand in this instance. However, when we tried for the third time to get our mail server’s IP address delisted, the automated response we got was that, “The IP address in question is not currently blocked in our system.” This is interesting.
What we believe has happened here is that Microsoft are using a blacklist that includes every single one of the IP addresses owned by the company where a number of our servers (including our primary mail server) are physically located, and have been located for about eight years. This company is Digital Ocean. Why are all of Digital Ocean’s IP addresses blacklisted? Good question. The summary seems to be that Digital Ocean has no interest in dedicating resources to keeping spammers off of their servers. This results in their telling their customers (like NinerNet) that they should send all email out via third parties. This is a ridiculous and expensive requirement, of course, because that is not how the Internet was designed several decades ago, and it’s not how NinerNet operates or has ever operated. When this requirement was forced on us by another data centre company many years ago (Interland), we refused and moved our business elsewhere. For sometime now we have known that the data centre for our next mail server would not be a Digital Ocean data centre but, strangely enough, Microsoft didn’t give us any notice of this change in their practices. And as you know if you’ve been a NinerNet client for any length of time, moving email hosting to a new server is no small undertaking.
The result of Digital Ocean doing nothing to keep spammers out of their data centres is that their IP addresses (including ours) have been elevated from UCEPROTECT Level 0, to Level 1, to Level 2 and finally (over time) to Level 3. UCEPROTECT describes Level 3 as listing the “IP Space of the worst ASNs”. (An ASN is a “Autonomous System Number”, “an identifier for a collection of IP networks and routers under the control of one entity”. [Wikipedia.]) So NinerNet’s mail server is in a blacklist, not because of something we or one of our clients have done (or not done), but because Digital Ocean fails to do anything to keep spammers off of their systems.
For sometime we have known about the fact that UCEPROTECT has a system by which companies like NinerNet, who have no track record of providing safe harbour to spammers, can have their IP address(es) whitelisted, so that we are essentially excluded from the Level 3 blacklisting of all Digital Ocean IP addresses. Previously we chose not to do this because of the added expense, and we preferred to spend money on other ways (described in the first paragraph of this post) of mitigating this problem. However, we have broken down and paid a fee to UCEPROTECT to have our IP address whitelisted.
Therefore, if we are correct in deducing the cause of the current problem, we expect that email to domains hosted by Microsoft will be delivered without hindrance starting by about 04:18 UTC today, 21 June 2024.
Update, 2024-06-22: We thought that our having paid for an exception to the UCEPROTECT blacklist had solved the problem. And it does seem to have solved the problem, for the most part. However, very oddly, messages to only some Microsoft-hosted domains are still being blocked with the exact same bounce message that directs senders to their article, “External senders – Use the delist portal to remove yourself from the blocked senders list and address 5.7.511 Access denied errors” at http://go.microsoft.com/fwlink/?LinkID=526655, which redirects to https://learn.microsoft.com/en-gb/defender-office-365/external-senders-use-the-delist-portal-to-unblock-yourself?redirectedfrom=MSDN. (The 5.7.511 error in the title does not appear to apply to the messages bounced from our server, as those errors are 5.7.1.) However, every time we try to have our mail server’s IP address delisted, the response we receive is, “The IP address in question is not currently blocked in our system.” So why are messages being blocked?!
This seems to be a ridiculous game of cat-and-mouse that Microsoft are playing instead of being open with people about what they are doing, and companies like NinerNet cannot do anything to counter that. It makes absolutely no sense, and doesn’t serve Microsoft, their customers, or NinerNet or our customers.
So in these circumstances, if you’re still having messages to Microsoft-hosted domains bounced — you will know if you see references to Outlook(.com) and Microsoft(.com) in the bounce message — please forward the bounce message(s) to NinerNet support and we will add the problem domains to the mail server configuration that redirects messages sent to those domains via our secondary SMTP server. This is the same procedure that we followed previously, but we were hoping to avoid that procedure by buying our way out of the UCEPROTECT blacklist. However, at least now the number of Microsoft-hosted domains that we have to add to our mail server configuration should be far less than previously.
Again, we apologise to you, our clients, for this non-consensual position in which Microsoft has put us and many small hosting companies around the world.
Update, 2024-06-28: Over the last week we have added a grand total of 21 domains to our mail server’s configuration to redirect outgoing messages to them via our secondary mail server. In that time we have learned that there is no consistency to the problem. Sometimes mails that are blocked are delivered five minutes later if the sender retries, without our adding that domain to our mail server’s configuration. And delivery succeeds to some Microsoft-hosted domains consistently without any intervention by us. There’s nothing more frustrating than an inconsistent problem that is not possible to troubleshoot.
So at this point it seems that we are back to the point we were at before this incident started. Here is a summary of what has transpired:
As always, if you have mail you send bounced by Microsoft, please forward the bounce message to support and we will add the destination domain to our mail server’s configuration. We appreciate your patience and continued patronage.
We have increased the disk space available on server NC036 (our primary mail server) to accommodate more and the growing size of email accounts. Normally we would have done this during our weekend maintenance tomorrow, but earlier on Friday we had an unexpected spike in traffic that consumed the last of the disk space available on the server to store email messages. This was brought to our attention by a client who noticed anomalies in the webmail where messages were not being displayed.
Some incoming email may have bounced, but many incoming messages remained queued on a second hard drive on the server, and were delivered to email accounts once additional disk space was provided. The situation was resolved at 20:38 UTC on Friday, 22 March 2024.
We apologise for this miscalculation. If you have any questions please contact NinerNet support. Thank-you.
There is a significant number of messages on our mail server (NC036) queued up to be delivered to domains (mostly in South Africa) that use the Mimecast mail filtering service. These will be delivered when their service is back online again.
There is planned network maintenance, “to improve performance and scalability”, for the data centre in Amsterdam where server NC036 (our primary mail server) is located. This maintenance is not expected to result in any downtime, but if any issues arise “affected [servers] may experience increased latency or a brief disruption in network traffic.” This will take place on Tuesday 27 February 2024 from 16:00 to 20:00 UTC. This is 08:00 to 12:00 Pacific Time and 18:00 to 22:00 Central Africa Time on the same date.
If you’d like to calculate this for any other location, please use the World Time Server.
We only post this to ensure you’re aware of the reason for any possible issues in advance. However, based on previous experience, we don’t anticipate any issues.
If you have any questions, please do contact NinerNet support. Thank-you.
We’ve been meaning to post about this for several years (since 2020), but we haven’t because there’s always something more important to do and it’s not our job to highlight how badly a competitor is running their mail servers. However, after the issue had gone away for a time we thought that perhaps Xneelo (formerly Hetzner South Africa) had resolved their problem. But now it’s back.
The problem is that one of the multiple mail servers they run is in multiple anti-spam blacklists/blocklists. We don’t know how many outbound mail servers they run, but let’s say (for the sake of example) it’s ten. If the IP address of one of those servers is in a blacklist, and all of their outbound mail is equally spread among those ten servers, then 10% of their outbound messages will not be delivered to anyone that is using the blacklists in which that server is listed.
The problem for us is that we end up devoting a significant percentage of our support resources to answering questions from clients who don’t understand what is going on, and who think that we are the problem. But we’re not!
Getting into an anti-spam blacklist is a significant event for any company, but the bigger you are and the more servers you run the less of an issue it is. NinerNet is not big, and so if one of our servers gets into a blacklist it’s a big deal, and we jump around to fix the problem and have our IP address removed from the blacklist. Considering how long one of Xneelo’s mail servers has been in a major blacklist, and how many of their clients we (or our clients) have told to take the problem to Xneelo, it’s shocking to us that they don’t seem to have done a thing about it. So we’re making this blog post to try and bring their attention to it publicly and to point our clients here whenever they have a question about the problem.
If one of your correspondents tells you that their email messages to you are not getting through to you, and they’re a Xneelo customer, this is almost certainly the reason. Your correspondent — the Xneelo client — needs to go to Xneelo to demand that Xneelo resolve their years-old problem in order to serve their own clientele properly.
Update, 2024-03-01: A Xneelo client that was failing to correspond with one of our clients engaged Xneelo support on 28 February 2024, and we are in ongoing discussions with Xneelo for them to fix this problem. Xneelo have acknowledged that at least two of their outgoing mail servers (197.189.244.82 and 197.189.244.90) are in six blacklists between them, so the situation is actually far worse than the hypothetical example given above. When the issue is resolved we will post an update here.
Update, 2024-03-05: Almost a week later and Xneelo are still spouting excuses and fabrications, and assuming that the people they are addressing (including us!) are too stupid to understand how email works. This may or may not be resolved at some point, but at this point it seems it likely won’t be. Email service providers should cooperate with one another to reduce spam across the Internet, and they should communicate truthfully with one another, but that seems to be too much of a challenge for Xneelo. We’d love to run our mail servers without having to consult blacklists of spammers, but your email account would become instantly useless if we did. All we can suggest you do is to advise your correspondents to use email hosting providers that take care of the reputations of their IP addresses, as otherwise their email will be tainted with the same negative reputation. This is how the combined actions of hosting clients are supposed to drive the bad actors out of business.
Update, 2024-03-14: It has emerged that Xneelo doesn’t even handle greylisting properly! One of the parties involved in the ticket with Xneelo decided to communicate with us directly (to become a client, ironically), but because Xneelo’s mail servers don’t respond correctly to NinerNet’s use of the well-established anti-spam technique greylisting, their messages to us are now bouncing! Apparently this client of Xneelo has done the right thing and told Xneelo that they will be moving their hosting business away if they don’t fix the problem. It blows us away how badly Xneelo is running their mail servers!
Update 2, 2024-03-14: We have added various IP addresses, server names and domains to various whitelists on our mail servers. Adding the blacklisted IP address will not have any effect on messages from Xneelo’s blacklisted servers that are listed in the blacklists our anti-spam system consults, but these additions are, as far as we can tell so far, having a positive effect on Xneelo’s inability to handle greylisting. If you communicate with a South African correspondent who is hosted by Xneelo and their emails to you are bouncing or taking hours to come through, please log into the mail server control panel and add their domain at Domains and Accounts -> YOUR_DOMAIN -> Greylisting -> Do not apply greylisting on listed senders. If your correspondent is susie@example.com, you need to add “@example.com” (with the leading @ symbol) to that text box, and click the green “Save changes” button.
Update, 2024-03-25: We have not heard back from Xneelo in three weeks, and it seems clear that we won’t. So our advice remains the same: If one of your correspondents tells you that their email messages to you are not getting through to you, and they’re a Xneelo customer, this (everything explained above) is almost certainly the reason. Your correspondent — the Xneelo client — needs to go to Xneelo to demand that Xneelo resolve their years-old problem in order to serve their own clientele properly. But please do also contact NinerNet support and we will assist you to do all that can be done to help the Xneelo mail servers get their messages through to you. However, the situation described above — the two IP addresses above are still in multiple blacklist — is still just as true today as it was when we first posted this in January.
The *.niner.net wildcard SSL/TLS certificate has been renewed and updated across our entire infrastructure, although we apologise for being about four hours late. This should be seamless for all our clients. However, should you run into a situation in the next 24 hours where you’re told that the certificate has expired, please log out and reload whatever it is you’re trying to do. You may need to reboot, but this would be very unusual. Simply forcing a reload should clear things up. Via FTPS you may need to re-trust our certificate depending on your FTP client.
This doesn’t affect certificates on your own domain on your website, just NinerNet services such as control panels and connecting to the mail and FTP servers.
If you have any questions or concerns, please do contact NinerNet support with any error messages you may be seeing. Thank-you.
Server NC036, our primary mail server, was apparently down for 34 minutes yesterday, 8 January. Our server itself was not down, but the data centre experienced what seems to have been a partial connectivity issue. In fact, you may not even have noticed it, as we didn’t receive any complaints about the downtime.
According to the data centre’s report, the issue was resolved and it is not expected to recur. We apologise to anyone who was affected.
Systems at a Glance:
Loc. | System | Status | Ping |
---|---|---|---|
NC023 | Internal | Up? | |
NC028 | Internal | Up? | |
NC031 | Internal | Up? | |
NC033 | Operational | Up? | |
NC034 | Internal | Up? | |
NC035 | Operational | Up? | |
NC036 | Operational | Up? | |
NC040 | Internal | Up? | |
NC041 | Operational | Up? | |
NC042 | Operational | Up? |
Subscriptions:
Search:
Recent Posts:
Archives:
Categories:
Links
Tags:
Resources:
On NinerNet: