Re: [UA-discuss] Email from new domains going to Junk (was: Requesting a contact from outlook/hotmail)
Here is the info I received back from the engineering team. They are happy to look at more failure cases if you have them. This message in particular did not have the sender as safe-sender (but if you have instances where safesender does not work, please forward them to me) and was junked by the content filter. The IP reputation for this range is not bad, and most content/communication should work fine (junk rate on the 162.210.70.55/30 registered to Directi in our systems is about 10%). I provided a mitigation and junking should stop in less than one hour. Regarding the newer TLDs, the % legitimate traffic registering them is microscopic. I’ve been told by a spammer that periodically domains in these TLDs are available for sale in bulk for cents and therefore very much loved by spammers (.bid, .club as well). Haven’t seen international TLDs abused yet in spam. Towards outlook.com we don’t have a deterministic rule to penalize these TLDs but it could be content filter ML is downgrading them (statistically for the filter it makes sense). O365 inbound and I am sure other providers do have rules that increase the spam scoring of these TLDs or do more scrutiny. /marksv From: Mark Svancarek (CELA) Sent: Wednesday, August 1, 2018 12:14 To: Subject: Email from new domains going to Junk (was: [UA-discuss] Requesting a contact from outlook/hotmail) Sorry for spam, please forward as appropriate. I am co-chair of https://uasg.tech, a community organization dedicated to the concept that all domain names and email addresses should be treated equally. This is a conversation from our mailing list. While I do expect mail from “new” Top-level Domains (e.g. .LAWYER or .みんな) to initially go to Junk while reputations are built, we are confused why they keep going there after users tag them as Not Junk and Safe Senders. Who can help with this? /marksv From: Aman Masjide <aman@radix.email<mailto:aman@radix.email>> Sent: Wednesday, August 1, 2018 04:34 To: Mark Svancarek (CELA) <marksv@microsoft.com<mailto:marksv@microsoft.com>> Subject: Re: [UA-discuss] Requesting a contact from outlook/hotmail Hi Mark, We did some further research on the anti-spam filtering issue Sample Test domains- amantest.space We created a new email ID - bhow@amantest.space<mailto:bhow@amantest.space> and re-tested by sending emails to a newly created hotmail id vivek.shahani@hotmail.com<mailto:vivek.shahani@hotmail.com>, which also ended up in SPAM/Junk folder. Here are the email headers - https://ybin.me/p/72b2aca98ff1ebfe#wCZ4LqfnFSA90erT7PRkHQbUc3AvKtOEWdFSRG47khQ=<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fybin.me%2Fp%2F72b2aca98ff1ebfe%23wCZ4LqfnFSA90erT7PRkHQbUc3AvKtOEWdFSRG47khQ%3D&data=02%7C01%7Cmarksv%40microsoft.com%7C86f01d0cc9db4f25142e08d5f7a2aaba%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636687200389948082&sdata=qUZWITioqKODGQPFI544oZ82482ohT8L8qP4lxI06Eg%3D&reserved=0> Here is the Analysis of the header - https://mxtoolbox.com/Public/Tools/EmailHeaders.aspx?huid=31f99e9d-dffd-4839-8f07-a476bd76a04f<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmxtoolbox.com%2FPublic%2FTools%2FEmailHeaders.aspx%3Fhuid%3D31f99e9d-dffd-4839-8f07-a476bd76a04f&data=02%7C01%7Cmarksv%40microsoft.com%7C86f01d0cc9db4f25142e08d5f7a2aaba%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636687200389948082&sdata=fb6k1foPw%2BJNZfPFX85%2Bus7Q2BvU02E%2BOOzUuuloYuE%3D&reserved=0> The X-Exchange-Antispam-Report-CFA-Test shows our Bulkmail and Phising score as 0 [BCL:0;PCL:0] Despite a 0 suspicious score, our mail ended up in the Junk Folder. Our research about the issue led us to this outlook customer uservoice page where other users have also giveen similar feedbacks. Here is the uservoice page - https://outlook.uservoice.com/forums/601444-new-experiences-in-outlook-com/suggestions/20504851-regular-email-falls-into-junk-folder<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Foutlook.uservoice.com%2Fforums%2F601444-new-experiences-in-outlook-com%2Fsuggestions%2F20504851-regular-email-falls-into-junk-folder&data=02%7C01%7Cmarksv%40microsoft.com%7C86f01d0cc9db4f25142e08d5f7a2aaba%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636687200389948082&sdata=a7BGgxFmz0oOZaPtZgV4xzMaYyWn84X%2BJ8OuYT6yB2k%3D&reserved=0> I believe there is some blanket rule within the Anti-Spam (URI Scanner) that classifies domains from new tlds or new domains from legacy/cc tlds automatically as spam. We sent this note to Florantine Stafie ( fstafie@microsoft.com<mailto:fstafie@microsoft.com> ) another contact we got from Domain Name Association, but haven't received a response so far. I can imagine you have pleanty on your plate but hope you can take some time to look at it. Thanks and regards, Aman On Wed, Jun 20, 2018 at 3:31 PM Aman Masjide <aman@radix.email<mailto:aman@radix.email>> wrote: Hey Mark, Thank you for your email. We at Radix are seeing some issues with our .SPACE TLD on outlook/hotmail. A few customers have claimed that emails sent from newly registered .SPACE domains are ending up in the spam/junk folder of a hotmail/outlook recepient. We tested this theory by creating a new test domain and sent it to existing and new hotmail/outlook accounts. It ended up in the spam folder. We also checked for blacklists for sender IP reputation and it came out clean. Sample Test domains- amantest.space(new domain), brills.space(old domain) SenderID - mail@amantest.space<mailto:mail@amantest.space>, test@brills.space<mailto:test@brills.space> Recepient1 - radixtest@outlook.com<mailto:radixtest@outlook.com> Recepient2 - anu.somarajan@hotmail.com<mailto:anu.somarajan@hotmail.com> I would like connect with the right individual within the organization with whom I can discuss this issue and work towards a solution. Best Regards, On Tue, Jun 19, 2018 at 9:04 PM, Mark Svancarek <marksv@microsoft.com<mailto:marksv@microsoft.com>> wrote: I can represent Hotmail/Outlook.com. From: UA-discuss <ua-discuss-bounces@icann.org<mailto:ua-discuss-bounces@icann.org>> On Behalf Of Aman Masjide Sent: Tuesday, June 19, 2018 7:07 AM To: ua-discuss@icann.org<mailto:ua-discuss@icann.org> Subject: [UA-discuss] Requesting a contact from outlook/hotmail Hey Folks, Is anyone from outlook/hotmail on the list? If so, requesting you to kindly DM me. If not, I request someone on the group help me connect with someone. Warm Regards, -- [https://drive.google.com/a/radix.email/uc?id=0BxfW4uTHaeWiTXh6eVVSTDNoUlk&ex...] Aman Masjide Program Manager Anti-Abuse Department T: +91 (22) 6196 6300 Extn: 8653 Skype: amasjide Google Buys Business.Site for Google My Business<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fbit.ly%2F2xs...> -- [https://drive.google.com/a/radix.email/uc?id=0BxfW4uTHaeWiTXh6eVVSTDNoUlk&ex...] Aman Masjide Program Manager Anti-Abuse Department T: +91 (22) 6196 6300 Extn: 8653 Skype: amasjide Google Buys Business.Site for Google My Business<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fbit.ly%2F2xs...> -- [https://drive.google.com/a/radix.email/uc?id=0BxfW4uTHaeWiTXh6eVVSTDNoUlk&ex...] Aman Masjide Program Manager Anti-Abuse Department T: +91 (22) 6196 6300 Extn: 8653 Skype: amasjide Google Buys Business.Site for Google My Business<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fbit.ly%2F2xs...>
In article <BN6PR21MB01305DAB5A84CBC7A57B09ACD12C0@BN6PR21MB0130.namprd21.prod.outlook.com> you write:
Regarding the newer TLDs, the % legitimate traffic registering them is microscopic. I’ve been told by a spammer that periodically domains in these TLDs are available for sale in bulk for cents and therefore very much loved by spammers (.bid, .club as well).
This is the main point. I don't know anyone who's blocking new TLDs just for being new, other than a few hobbyists. But if you think about it for a few minutes, the only people who want bulk TLDs are crooks, for spam or for phish and malware landing pages. It is entirely reasonable to block an otherwise little used TLD if you see a spike of abuse from it. R's, John
Thanks for sharing this Mark. Very interesting to see how new TLDs are treated. On Thu, Aug 2, 2018 at 11:13 AM John Levine <john.levine@standcore.com> wrote:
In article < BN6PR21MB01305DAB5A84CBC7A57B09ACD12C0@BN6PR21MB0130.namprd21.prod.outlook.com> you write:
Regarding the newer TLDs, the % legitimate traffic registering them is microscopic. I’ve been told by a spammer that periodically domains in these TLDs are available for sale in bulk for cents and therefore very much loved by spammers (.bid, .club as well).
This is the main point. I don't know anyone who's blocking new TLDs just for being new, other than a few hobbyists. But if you think about it for a few minutes, the only people who want bulk TLDs are crooks, for spam or for phish and malware landing pages. It is entirely reasonable to block an otherwise little used TLD if you see a spike of abuse from it.
R's, John
Not directly related, but since reputation comes into play: https://domaingang.com/domain-news/alpnames-domain-registrar-denies-its-bein... -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com https://blacknight.blog / http://ceo.hosting/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow, R93 X265 ,Ireland Company No.: 370845 From: UA-discuss <ua-discuss-bounces@icann.org> on behalf of Elaine Pruis <elainepruis@gmail.com> Date: Thursday 2 August 2018 at 19:50 To: John Levine <john.levine@standcore.com> Cc: "UA-discuss@icann.org" <ua-discuss@icann.org> Subject: Re: [UA-discuss] Email from new domains going to Junk (was: Requesting a contact from outlook/hotmail) Thanks for sharing this Mark. Very interesting to see how new TLDs are treated. On Thu, Aug 2, 2018 at 11:13 AM John Levine <john.levine@standcore.com<mailto:john.levine@standcore.com>> wrote: In article <BN6PR21MB01305DAB5A84CBC7A57B09ACD12C0@BN6PR21MB0130.namprd21.prod.outlook.com<mailto:BN6PR21MB01305DAB5A84CBC7A57B09ACD12C0@BN6PR21MB0130.namprd21.prod.outlook.com>> you write:
Regarding the newer TLDs, the % legitimate traffic registering them is microscopic. I’ve been told by a spammer that periodically domains in these TLDs are available for sale in bulk for cents and therefore very much loved by spammers (.bid, .club as well).
This is the main point. I don't know anyone who's blocking new TLDs just for being new, other than a few hobbyists. But if you think about it for a few minutes, the only people who want bulk TLDs are crooks, for spam or for phish and malware landing pages. It is entirely reasonable to block an otherwise little used TLD if you see a spike of abuse from it. R's, John
I can conceive of a scenario where every instance of a particular IOT device receives a unique domain name in the same way it receives a MAC address and unique serial number; the domain name could in fact be its serial number. That would be a legit example for bulk acquisition of domain names. Of course, in this scenario, those domain names will be well known to the vendor and their partners, and can be completely untrusted by anyone else without loss of functionality. -----Original Message----- From: John Levine <john.levine@standcore.com> Sent: Thursday, August 2, 2018 11:14 To: ua-discuss@icann.org Cc: Mark Svancarek (CELA) <marksv@microsoft.com> Subject: Re: [UA-discuss] Email from new domains going to Junk (was: Requesting a contact from outlook/hotmail) In article <BN6PR21MB01305DAB5A84CBC7A57B09ACD12C0@BN6PR21MB0130.namprd21.prod.outlook.com> you write:
Regarding the newer TLDs, the % legitimate traffic registering them is microscopic. I’ve been told by a spammer that periodically domains in these TLDs are available for sale in bulk for cents and therefore very much loved by spammers (.bid, .club as well).
This is the main point. I don't know anyone who's blocking new TLDs just for being new, other than a few hobbyists. But if you think about it for a few minutes, the only people who want bulk TLDs are crooks, for spam or for phish and malware landing pages. It is entirely reasonable to block an otherwise little used TLD if you see a spike of abuse from it. R's, John
I can conceive of a scenario where every instance of a particular IOT device receives a unique domain name in the same way it receives a MAC address and unique serial number; the domain name could in fact be its serial number. That would be a legit example for bulk acquisition of domain names.
Of course every device has its own name, but nobody in their right mind would buy them one at a time from a TLD registry. For a whole lot of domain names, see https://wild.web.sp.am, click on a few links, and look at the domain names. If you followed the links long enough you'd find roughly 2 billion different names. Regards, John Levine, john.levine@standcore.com Standcore LLC PS: When I first set up that site, it broke the Bingbot. After alerting one of your colleagues to the problem, who told me that it led to some very loud conversations down the hall, Bing now knows enough to stay away but I have a log file with 6 million entries from people who don't.
Have you heard of RPZ? The TL;DR on RPZ is that the concept of things like Spamhaus RBL blacklisting to quickly resolve SPAM is going to start expanding into DNS so it is domain (or potentially TLD) based and not protocol-specific Paul Vixie from Farsight will be speaking at MERGE about RPZ - many of you have the privilege of knowing him and his many contributions to the stability and security of the Internet https://mergeorlando2018.sched.com/event/FXXd/takedown- vs-staydown-for-internet-identifiers-the-dns-rpz-firewall-approach This is something that a network administrator can institute at its perimeter nameservers / firewall, but that dominion can be a nation or a large ISP just as easily as a company. RPZ is worth some awareness within UASG as it may impact domain names from resolving everywhere immediately that are first activating because RPZ intentionally creates a delay (I am oversimplifying this) The delay is involved intentionally to counter fast-flux or fluid-instant registrations often seen in command and control networks, and there are some exceptions and tuning that can happen. -J Jothan Frakes Tel: +1.206-355-0230 On Thu, Aug 2, 2018 at 5:07 PM, John Levine <john.levine@standcore.com> wrote:
I can conceive of a scenario where every instance of a particular IOT
device receives a unique domain name in the same way it receives a MAC address and unique serial number; the domain name could in fact be its serial number. That would be a legit example for bulk acquisition of domain names.
Of course every device has its own name, but nobody in their right mind would buy them one at a time from a TLD registry.
For a whole lot of domain names, see https://wild.web.sp.am, click on a few links, and look at the domain names. If you followed the links long enough you'd find roughly 2 billion different names.
Regards, John Levine, john.levine@standcore.com Standcore LLC
PS: When I first set up that site, it broke the Bingbot. After alerting one of your colleagues to the problem, who told me that it led to some very loud conversations down the hall, Bing now knows enough to stay away but I have a log file with 6 million entries from people who don't.
Jothan, thanks, I was wondering about something like RPZ and good to know that it already exists. This is interesting to multiple areas of my new role (UASG and RDS). Are you or Cole attending this? From: Jothan Frakes <jothan@jothan.com> Sent: Thursday, August 2, 2018 17:36 To: John Levine <john.levine@standcore.com> Cc: Mark Svancarek (CELA) <marksv@microsoft.com>; ua-discuss@icann.org Subject: Re: [UA-discuss] Email from new domains going to Junk (was: Requesting a contact from outlook/hotmail) Have you heard of RPZ? The TL;DR on RPZ is that the concept of things like Spamhaus RBL blacklisting to quickly resolve SPAM is going to start expanding into DNS so it is domain (or potentially TLD) based and not protocol-specific Paul Vixie from Farsight will be speaking at MERGE about RPZ - many of you have the privilege of knowing him and his many contributions to the stability and security of the Internet https://mergeorlando2018.sched.com/event/FXXd/takedown-vs-staydown-for-internet-identifiers-the-dns-rpz-firewall-approach<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmergeorlando2018.sched.com%2Fevent%2FFXXd%2Ftakedown-vs-staydown-for-internet-identifiers-the-dns-rpz-firewall-approach&data=02%7C01%7Cmarksv%40microsoft.com%7Ca5338ce922814ab08ebd08d5f8d925ba%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636688533884906155&sdata=VnRV7yVzNN6gsWRGtur6nj%2Fjf4GBYOgepxuQho6R4jI%3D&reserved=0> This is something that a network administrator can institute at its perimeter nameservers / firewall, but that dominion can be a nation or a large ISP just as easily as a company. RPZ is worth some awareness within UASG as it may impact domain names from resolving everywhere immediately that are first activating because RPZ intentionally creates a delay (I am oversimplifying this) The delay is involved intentionally to counter fast-flux or fluid-instant registrations often seen in command and control networks, and there are some exceptions and tuning that can happen. -J Jothan Frakes Tel: +1.206-355-0230 On Thu, Aug 2, 2018 at 5:07 PM, John Levine <john.levine@standcore.com<mailto:john.levine@standcore.com>> wrote: I can conceive of a scenario where every instance of a particular IOT device receives a unique domain name in the same way it receives a MAC address and unique serial number; the domain name could in fact be its serial number. That would be a legit example for bulk acquisition of domain names. Of course every device has its own name, but nobody in their right mind would buy them one at a time from a TLD registry. For a whole lot of domain names, see https://wild.web.sp.am<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwild.web.sp.am&data=02%7C01%7Cmarksv%40microsoft.com%7Ca5338ce922814ab08ebd08d5f8d925ba%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636688533885062406&sdata=PwTZnZh3175hVDAXddeFnqS7%2Fhh96NA%2FbEJPyw1gHxw%3D&reserved=0>, click on a few links, and look at the domain names. If you followed the links long enough you'd find roughly 2 billion different names. Regards, John Levine, john.levine@standcore.com<mailto:john.levine@standcore.com> Standcore LLC PS: When I first set up that site, it broke the Bingbot. After alerting one of your colleagues to the problem, who told me that it led to some very loud conversations down the hall, Bing now knows enough to stay away but I have a log file with 6 million entries from people who don't.
participants (5)
-
Elaine Pruis -
John Levine -
Jothan Frakes -
Mark Svancarek (CELA) -
Michele Neylon - Blacknight