3

(I am aware that there are several near-duplicates to this question on ServerFault, none helped me, unfortunately. An incomplete list: 1, 2, 3)

I have a private server which is also my and my families' mail server. For a few weeks now, Gmail is blocking mails from my server and I can't find out why. Google's documents and contact forms for this turned out to be dead-ends or blackholes, they never get back to me.

So, how can I contact Gmail regarding this? Preferably a human, of course.

I used to be able to send to Gmail in the past years, but starting almost a month ago all my mails are rejected with the following message:

Our system has detected an unusual rate 550-5.7.1 of unsolicited mail originating from your IP address. To protect our 550-5.7.1 users from spam, mail sent from your IP address has been blocked. 550-5.7.1 Please visit 550-5.7.1 https://support.google.com/mail/?p=UnsolicitedIPError to review our 550 5.7.1 Bulk Email Senders Guidelines. 132si3016603wmh.2 - gsmtp (in reply to end of DATA command)

Here's what I've checked and done so far:

  • To the best of my abilities, I haven't found any malware on my server (ran chkrootkit as well).
  • Traffic is as low as always and I haven't found anything suspicious in my logs yet.
  • My server is not an open relay (I check using several online services).
  • The server is only used by me and my family, only authenticated users are allowed to send.
  • My server/domains are not listed in any DNSBL (I checked using www.dnsbl.info and others).
  • My domains are listed in DNSWL.org.
  • My domains are registered with Gmail Postmaster Tools. They are marked as Verified there.
  • I have tried to contact Gmail twice using their contact form and provided the requested informations. They did not get back to me (the first time I wrote to them was 3 weeks ago, the last time several days ago).
  • I did read the document on the page mentioned in the bounce and read the ones linked on that page, but they all are turn out to be dead-ends.
  • In the Gmail Postmaster Tools, they link to a choose-your-own-adventure-style document for troubleshooting (it's also linked somewhere on the page from the SMTP error message). That also turns out to be a dead-end since I fulfill everything (with the sole exception that I don't have DKIM).
  • I have valid SPF records for my domains, but no DKIM.
  • The IP has a valid reverse DNS record (PTR).

At this point, I don't know how to proceed. There doesn't seem a way to actually contact a human at Google regarding this and I can't find out why my server is blocked by Gmail.

How can I proceed? What am I missing? Is there a way around this, for example a kind of relay service that I can use to get my mails from my server to Gmail?

Edit: I checked the Postfix logs for outgoing mails in the past few weeks and did notice there is backscatter from one account (the mail for that user is forwarded to another server which sometimes declines messages as spam that my system didn't catch). It happens about once every two days and always to the same address but of course I need to fix that. Other than that, the logs show no unusual outgoing mails. I did sign up for GSuite (the first two weeks are free) and sent a support request, let's see how that goes…

Edit 2: I did get a response from a human at GSuite support pretty quickly. After a few mails back and forth we had phone conversation. Essentially, the guy told me that unfortunately there's nothing he can do here (wrong department and no access to the necessary systems) but he'd want to try to help me anyway and forward my problem to someone else. That was on Friday, today's Tuesday and unfortunately nothing happened so far. Mailing still doesn't work, so it's another dead-end and I'll try to get someone else on the phone using http://www.wikihow.com/Contact-Google .

Community
  • 1
DarkDust
  • 267
  • 1
  • 8
  • Sure, but who did what with your IP before it was assigned to you? – EEAA Feb 16 '17 at 14:50
  • 1
    One idea: sign up for a GSuite temporarily and then contact support through that account. – EEAA Feb 16 '17 at 14:52
  • 3
    Have you checked your outgoing connections to verify that there are no compromised accounts that are being used to send bulk email? I have seen this happen quite a lot. Checking Malware on the server is great, but may times it's the client machine (this is what it sounds like to me) that has malware and has been put into service as a spam drone. In my experience, false positived with Gmail are rare. it is arguably on the the best email platforms on the planet. – Gmck Feb 16 '17 at 15:01
  • 1
    You can maybe try to get someone on the phone with http://www.wikihow.com/Contact-Google, best way to really have a "human" on the other side. – Tolsadus Feb 16 '17 at 15:02
  • @EEAA: I have this particular IP for over half a year, the domains for several years. The problem started just a month ago. The GSuite idea is neat! Might try that. – DarkDust Feb 16 '17 at 15:05
  • @Gmck: The SMTP message specifically says my server's IP is blocked, so I wonder whether the client's actually *can* do something that would trigger this message. – DarkDust Feb 16 '17 at 15:07
  • @Tolsadus: Thanks, that's a great link! Will try this evening. – DarkDust Feb 16 '17 at 15:08
  • @DarkDust: I have had this happen on my SMTP servers many times. It has always turned out to be a compromised user account. You seem to have check everything else on the server side. What is the server software you are using? Can you try send to Yahoo and see if there is a similar error? – Gmck Feb 16 '17 at 15:11
  • @DarkDust if it's good, tell me so I can put this in a proper comment for futher people trying to get rid of google with a real "human" – Tolsadus Feb 16 '17 at 15:17
  • 1
    @Gmck: I'm running an OpenSUSE 42.1 with Postfix and SpamAssassin. Will check what my users are sending and setup a Yahoo account for testing this evening, thanks for the feedback! – DarkDust Feb 16 '17 at 15:28
  • 2
    @DarkDust In spite of what you hear, Google Support is quite good when you're an actual customer (e.g. paying them money). I manage a number of paid GSuite orgs, and have never had a negative experience with their support. $5 to sign up for one user for a month is likely worth it for you if it helps you sort this out quickly. – EEAA Feb 16 '17 at 17:11
  • 2
    If you are aware of existing questions on the site that are related but don't address your problem, and the existing questions are sufficiently different that simply e.g. offering a bounty on one of them is unlikely to lead to good results in your situation, it's usually considered good form to include (in your question) links to those, ideally with a brief description of *why* the answers to those questions do not address your problem or concern. That way, we don't have to go down already tried paths. – user Feb 21 '17 at 08:37

1 Answers1

3

The answer to the question "How to contact the Gmail team?" is: you can't. You can only guess what's wrong and hope for the best.

I finally managed to get Gmail to accept my mails again. The missing pieces were DKIM and DMARC: I've added support for these to my server yesterday and now I can send to Gmail again.

So there's a pretty long checklist to make Gmail happy:

  • Check that you aren't sending spam via some malware or infected user (check the outgoing mail server logs!)
  • Make sure the server IP has a valid reverse DNS record (PTR).
  • Check that your server is not an open relay (there are online services for that).
  • Check that your server/domains are not listed in any DNSBL (e.g. via www.dnsbl.info or others).
  • (Optional? Add domains to DNSWL.org)
  • (Optional? Add domains to Gmail Postmaster Tools and make sure they are marked as Verified there.)
  • Have valid SPF records for your domains.
  • Have DKIM set up.
  • Have DMARC set up.

I assume that Gmail tweaked their policies since the same setup (without DKIM and DMARC) worked for months, unchanged.

It's really troubling that you cannot contact the Gmail team if there are any problems. I understand they don't like to support every small mail server operator, but since this can be really damaging to a business if you can't reach Gmail users, Google should do way better here! Even the Google guy I managed to reach via GSuite support wasn't able to provide any help, he also didn't know how a mere mortal can contact them (and he hinted that he did write them but didn't expect any response).

Update: So unfortunately, while I can send from my main domain to Gmail, the mails from may second domain (also with valid SPF, DKIM and DMARC and from the same server) is still declined by Gmail. Great…

Update 2: So I discovered another puzzle piece. For some reason, my server was contacting Gmail with IPv4 when using my main domain, but was using IPv6 when I tried to send a mail with my secondary domain. I noticed this in Google's DMARC report (but in the report, all values were reported as "pass"… wtf, Google?). But maybe it was just "luck" that in my tests IPv4 was used with my default domain.

I did check that my IPv6 has a rPTR and that thus IPv6-address → hostname → IPv6-address was correct and also that Postfix was using the correct HELO.

Anyway, what solved this was to force Postfix to send via IPv4 when sending to Gmail.

Here's how you do this in Postfix. Add the following lines to your config (the transport_maps line might already exist on your system):

main.cf:
transport_maps = hash:/etc/postfix/transport

transport.cf:
gmail.com       smtp-ipv4:
google.com      smtp-ipv4:
googlemail.com  smtp-ipv4:

master.cf:
smtp-ipv4 unix  -       -       n       -       -       smtp
  -o inet_protocols=ipv4
  -o inet_interfaces=my.ipv4.addr.ess

Note: most guides I found about this don't have the -o inet_interfaces=my.ipv4.addr.ess line (obviously, insert your server's IPv4 address here) but without it, I got an error message fatal: config variable inet_interfaces: host not found: my:ipv6:address.

After doing these changes, call

postmap /etc/postfix/transport

or whatever the path to your transport file is, and restart Postfix (simply reloading might not work).

Update 3: I ran into another issue: domains that use Gmail as their MX. It looks like transport doesn't help here to force connecting via IPv4. Which forced me to do a very barbaric solution: prefer IPv4 over IPv6 (found out how to in this answer).

main.cf:
smtp_address_preference = ipv4
Community
  • 1
DarkDust
  • 267
  • 1
  • 8