Know your ISP.

User #84875   638 posts
Whirlpool Enthusiast

Hi All,

I've found some previous posts on the above issue but they were quite old so I thought I'd start a new post...

Yesterday afternoon and this morning I've received into my organisation a stack (~10) of emails all originating from optusnet servers...

I'm not having any issues with my system so I'm putting the question out there if anyone else has had delays?

Here are the headers for you to have a look at.

Microsoft Mail Internet Headers Version 2.0
Received: from brisdmz.brisbane.local ([x.x.x.x]) by mail.mysmailserver.com.au with Microsoft SMTPSVC(6.0.3790.3959);
Fri, 5 Sep 2008 07:15:40 +1000
X-TM-IMSS-Message-ID:<>
Received: from fallbackmx10.syd.optusnet.com.au ([211.29.132.251]) by inssync.com.au ([x.x.x.x]) with ESMTP (TREND IMSS SMTP Service 7.0; TLS: TLSv1/SSLv3,256bits,AES256-SHA) id 1dc560050001681f ; Fri, 5 Sep 2008 07:15:37 +1000
Received: from mail03.syd.optusnet.com.au (mail03.syd.optusnet.com.au [211.29.132.184])
by fallbackmx10.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP id m7RBF3uR010644
for <>; Wed, 27 Aug 2008 21:15:03 +1000
Received: from [127.0.0.1] (cx-x-x-x.bla.qld.optusnet.com.au [x.x.x.x])
(authenticated sender OptusUser)
by mail03.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP id m7RBEpRg019094
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO);
Wed, 27 Aug 2008 21:14:52 +1000
Message-ID: <>
Date: Wed, 27 Aug 2008 21:16:20 +1000
From: OptusUser <>
User-Agent: Thunderbird 2.0.0.16 (Windows/20080708)
MIME-Version: 1.0
To: Internal User <>

All delayed messages are getting resent from fallbackmx9.syd.optusnet.com.au and fallbackmx10.syd.optusnet.com.au plus it's only been from messages send it the last 2 weeks...

My net conneciton is with Telstra

Any help would be appreciated...

GT :)

edit – removed details I missed to remove in the first attempt.

posted 2008-Sep-5, 8am AEST
edited 2008-Sep-5, 9am AEST
User #5536   9176 posts
Whirlpool Forums Addict

It looks as if mail.srs.com.au is deferring delivery, as part of a greylisting strategy. THough it's not aware that optusnet use multiple servers and it's deferring again each time it sees a different IP address.

The administrator of mail.srs.com.au needs to update their whitelists it they're going to use greylisting.

You may want to edit out the IP addresses and other personal details from your post as well.

posted 2008-Sep-5, 9am AEST
User #84875   638 posts
Whirlpool Enthusiast

Thanks Jack.Daniels I'll get that looked at :)

posted 2008-Sep-5, 9am AEST
User #84875   638 posts
Whirlpool Enthusiast

On further investigation...

We use Trend Micro Internet Messaging Security Suite (IMSS) with the Spam Prevention Solution (SPS) module added on.

By itself IMSS is fine, but the SPS module uses a suite of list services that is owned and maintained by Trend Micro.

A description of the services and their purpose/function is detailed here:

http://www.mail-abuse.com/enduserinfo.html

The lists are IP address based as apposed to domain or specific address or mail content. To check IP's against the list go to here: http://www.mail-abuse.com/cgi-bin/lookup

These two Optus addresses are on the QIL list:

http://www.mail-abuse.com/cgi-bin/lookup?ip_address=211.29.132.251
http://www.mail-abuse.com/cgi-bin/lookup?ip_address=211.29.132.242

I have requested the removal of these IP addresses from the list...

posted 2008-Sep-5, 10am AEST
User #26587   379 posts
Forum Regular

Hi GreenTwig,

I too have come across the exact same issue as you today.

Headers are below:

Microsoft Mail Internet Headers Version 2.0
Received: from MSXCH.domain.local ([10.0.0.3]) by mail.domain.com.au with Microsoft SMTPSVC(6.0.3790.1830); Fri, 5 Sep 2008 03:51:41 +0930
Content-Transfer-Encoding: 7bit
Message-ID: <>
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2757
Received: from fallbackmx10.syd.optusnet.com.au ([211.29.132.251]) by domain.com.au ([203.49.***.**]) with ESMTP (TREND IMSS SMTP Service 7.0; TLS: TLSv1/SSLv3,256bits,AES256-SHA) id 3c0e541000004e1b for <>; Fri, 5 Sep 2008 03:51:39 +0930
Received: from mail04.syd.optusnet.com.au (mail04.syd.optusnet.com.au [211.29.132.185]) by fallbackmx10.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP id m7I5krN4031643 for <>; Mon, 18 Aug 2008 15:46:53 +1000
Received: from David (*********.adl5.sa.optusnet.com.au [122.109.***.**] (may be forged)) (authenticated sender sender) by mail04.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP id m7I5j1rg029050 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NO) for <>; Mon, 18 Aug 2008 15:45:02 +1000
From: "Sender Person" <>
To: <>
Subject: FW: Aldis & Lamont Wills
Date: Mon, 18 Aug 2008 15:09:49 +0930
Message-ID: <!&!AAAAAAAAAAAYAAAAAAAAAIUbCfXVxENJsomzIyBJDYjCgAAAEAAAAHZOFc7275pOihJO03AEySkBAAAAAA==@optusnet.com.au>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_000F_01C90144.75CEA290"
X-Mailer: Microsoft Office Outlook 12.0
thread-index: AckAGcnaA+k75zwtSSWcgfF9wMUkOwA2v96A
Content-Language: en-us
X-TM-AS-Product-Ver: SMEX-8.0.0.1181-5.500.1027-16138.000
X-TM-AS-Result: No--9.423300-4.000000-31
X-imss-scan-details: No--10.916-5.0-31-1
Return-Path: <>
X-OriginalArrivalTime: 04 Sep 2008 18:21:41.0002 (UTC) FILETIME=[13C376A0:01C90EBB]
X-TM-AS-User-Approved-Sender: No
X-TM-AS-User-Blocked-Sender: No

------=_NextPart_000_000F_01C90144.75CEA290
Content-Type: text/plain;
charset="US-ASCII"
Content-Transfer-Encoding: 7bit

------=_NextPart_000_000F_01C90144.75CEA290
Content-Type: text/html;
charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable

------=_NextPart_000_000F_01C90144.75CEA290--

posted 2008-Sep-5, 12pm AEST
edited 2008-Sep-5, 12pm AEST
User #17638   8368 posts
Whirlpool Forums Addict

I also encountered the same problem today... an e-mail sent on Tuesday afternoon was delivered this morning, while one sent four minutes later from the same user – and numerous others since then – came straight through.

Return-path: <user@optusnet.com.au>
Envelope-to: me@mydomain.com.au
Delivery-date: Fri, 05 Sep 2008 07:04:36 +1000
Received: from fallbackmx09.syd.optusnet.com.au ([211.29.132.242])
by host.hostingpeople.com.au with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.69)
(envelope-from <user@optusnet.com.au>)
id 1KbM0I-0006vZ-G0
for me@mydomain.com.au; Fri, 05 Sep 2008 07:04:36 +1000
Received: from mail02.syd.optusnet.com.au (mail02.syd.optusnet.com.au [211.29.132.183])
by fallbackmx09.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP id m823l07S021788
for <me@mydomain.com.au>; Tue, 2 Sep 2008 13:47:00 +1000
Received: from **** (****.****.nsw.optusnet.com.au [***.***.***.***])
by mail02.syd.optusnet.com.au (8.13.1/8.13.1) with SMTP id m823jxRE025732
for <me@mydomain.com.au>; Tue, 2 Sep 2008 13:45:59 +1000

Then, sent a few minutes later:

Return-path: <user@optusnet.com.au>
Envelope-to: me@mydomain.com.au
Delivery-date: Tue, 02 Sep 2008 13:50:21 +1000
Received: from mail08.syd.optusnet.com.au ([211.29.132.189])
by host.hostingpeople.com.au with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.69)
(envelope-from <user@optusnet.com.au>)
id 1KaMu3-0007Rb-CM
for me@mydomain.com.au; Tue, 02 Sep 2008 13:50:20 +1000
Received: from **** (****.****.nsw.optusnet.com.au [***.***.***.***])
by mail08.syd.optusnet.com.au (8.13.1/8.13.1) with SMTP id m823o14S021846
for <me@mydomain.com.au>; Tue, 2 Sep 2008 13:50:01 +1000

posted 2008-Sep-5, 1pm AEST
User #5536   9176 posts
Whirlpool Forums Addict

TicTacToe writes...

while one sent four minutes later from the same user – and numerous others since then – came straight through.

The fallback mail servers are used for queuing mail. If one of the mail servers either can't contact the destination MTA, or the destination MTA issues a deferral, the message is passed on to the fallback mail servers where it's placed in the mail queue for delivery to be attempted again later.

In the O.P case it looks as if the initial delivery was deferred because the destination uses an RBL that had one of the Optusnet mail servers listed, then the fallback server finally delivered the message.

in an age where more and more mail administrators are using greylisting and deferrals as a means of reducing the amount of spam that is allowed into their networks, it's luck that the SMTP RFC makes no promises about the promptness of message delivery.

posted 2008-Sep-5, 3pm AEST
User #17638   8368 posts
Whirlpool Forums Addict

Jack.Daniels writes...

The fallback mail servers are used for queuing mail. If one of the mail servers either can't contact the destination MTA, or the destination MTA issues a deferral, the message is passed on to the fallback mail servers where it's placed in the mail queue for delivery to be attempted again later.

Yeah I've kind of aware of that.

posted 2008-Sep-5, 3pm AEST
User #84875   638 posts
Whirlpool Enthusiast

Jack.Daniels writes...

it's luck that the SMTP RFC makes no promises about the promptness of message delivery

Yeah but it's not really an excuse end users like to hear ;)

Still, glad I'm not the only one who's had the issue...
I was starting to get paranoid :-P

GT :)

posted 2008-Sep-5, 3pm AEST
User #5088   284 posts
Forum Regular

Jack.Daniels writes...

in an age where more and more mail administrators are using greylisting and deferrals as a means of reducing the amount of spam that is allowed into their networks, it's luck that the SMTP RFC makes no promises about the promptness of message delivery.

In an age where more and more mail administrators are using any and/or every method to protect their networks from the torrents of UCE, of which greylisting provides one of the most effective methods, it's luck that the 2nd largest provider would actively attempt to be proactive about their impact on their clients.

posted 2008-Sep-5, 4pm AEST
User #5536   9176 posts
Whirlpool Forums Addict

sparkles writes...

of which greylisting provides one of the most effective methods

It's also one of the most effective methods of creating false positives, i.e blocking delivery of legitimate email, because of it has no way of handling farms of mail servers.

posted 2008-Sep-5, 4pm AEST
User #5088   284 posts
Forum Regular

Jack.Daniels writes...

It's also one of the most effective methods of creating false positives, i.e blocking delivery of legitimate email, because of it has no way of handling farms of mail servers.

Yes that is correct, but, and lets not get pedantic here because we could wish and want until the cows come home, the innovation stoped at greylists. It would appear that no one wants to take things to the next level, especially with an open standard.
While this might look like pointing the finger, i honestly think that ISP's could go a lot further in providign safe, secure and efficient email services.

posted 2008-Sep-8, 9am AEST
Hosted by
WebCentral Australia
Big numbers
976,374 threads
17,212,134 posts
2,009,466 whims sent
3,082 wiki topics
236 ISPs listed
8,134 broadband plans
824 modems & routers
40,609 features filled