Greylisting - Long Delays Accepting Mail from Office 365

[Ruffs]

Hi folks,


Having seen a customer of ours migrate to Office 365 recently we also noticed a large delay in receipt of emails from them.

This seems to be related to the Greylisting functionality used in our MailEnable, as the outbound SMTP servers for Microsoft Office 365. However, as there are obviously lots of servers used for this process, it's being delayed by the constant different IP addresses of each outbound SMTP server being different until such time as a single IP address is used more then once.

Now, is there a way we can white-list, for example, all incoming *.outbound.protection.outlook.com connections that, no matter what their sub-domain, so long as they resolve back to an IP address that is correct to that DNS resolution range, would be accepted without further delay?

The reason being there is obviously one or more direct sub-domain mapping for the enterprise as a whole, e.g.:

na01-bn1-obe.outbound.protection.outlook.com

and when you reversed the actual connecting IP back it returns a with a different name to the one it states at time of connection. An example would have been the 207.46.163.189 came back from NSLookup as:

mail-bn1blp0189.outbound.protection.outlook.com

We've seen multiple times where emails come in at the end of the day, but the intended recipient may see the originators correct send time, but that might have been 8-10 hours earlier, so it appears in their mailboxes earlier in the day but just late, so the might not actually see and react to it immediately, or just gives off the impression of bad service. Something, obviously, no one really wants.

Now I know this is something that might also be causing some some concern, but I thought I would ask the question here as many more companies are outsourcing their email to similar such cloud providers (google business etc) how we can handle this without suffering these very long delays.


Kind regards,


Scott

[Ruffs]

It also doesn't mention in the documentation if the Greylisting Excluded IP addresses supports ranging IP statements, such as:

213.199.180.128/26

Obviously, I don't want to have to enter 50+ IP addresses into the supported Greylisting IP Exclusions for all Microsoft Office/Google outbound SMTP servers, as they general state the ranges or state to use reverse dns resolution to validate the IP (as in Google's statements).

Whilst I understand this is easily achieve-able for the entire 256 ranges by specifying the first few IP elements and use of wildcards, it is less clear from the documentation as to how it handles things in this situation.

Would anyone mind letting me know if this syntax is supported in the Greylisting IP Exclusions?

[furriephillips]

I know it was a long time ago, but it comes up in searches and is unanswered, so I thought I'd put an answer at the end of the trail.

The following lines in /etc/postfix/postgrey_whitelist_clients.local save a lot of waiting and recriminations: -

Code: Select all

## Microsoft Office365 is a bit stupid around greylisting
/^mail-.*\.outbound\.protection\.outlook\.com$/
#
## Google also has a mess of MTAs
/^mail-.*\.google\.com$/