MX Watch

Telnet: the best email diagnositc tool

2008-08-26T01:29:00Z

Oftentimes it is very helpful to remove your mail server from the equation to see if there is an underlying network / reputation problem blocking mail flow. Here's how you can manually send a test message using the telnet command built into every operating system. You'll need to determine the name or address of your recipeints mail server. You can do this by looking up their MX record at http://mxtoolbox.com. In my example the MX record is a1.mx-route.com. Your commands are in bold below and the responses I got are in italic. Be careful, on Windows if you typo you cannot backspace and correct yourself. Just hit enter and retype the entire command.

telnet a1.mx-route.com 25
Trying 208.123.79.41...
Connected to a1.mx-route.com (208.123.79.41).
Escape character is '^]'.
220 a1-1.mx-route.com ESMTP
helo mxtoolbox.com
250 a1-1.mx-route.com
mail from: <peter@mxtoolbox.com>
250 sender <peter@mxtoolbox.com> ok
rcpt to: <support@mxtoolbox.com>
250 recipient <support@mxtoolbox.com> ok
data
354 go ahead
Subject: Test Message
This is a test message.
.
250 ok: Message 156715331 accepted
quit
221 a1-1.mx-route.com
Connection closed by foreign host.

Here you can see that the sender, recipient and message were accepted by the 250 responses from the recieving mail server. If there are problems you will see them reflected with 4xx or 5xx responses that can be very helpful for figuring out the problem.

Peter
Product Development Engineer
peter@MXToolBox.com

Fixing ORDB Blacklist (ordb.org) Bounce Back Problems - Exchange

2008-03-26T20:17:00Z

If you are encountering problems with mail referencing ORDB.org on your Microsoft Exchange 2003 or 2007 server, or mail being blocked with a return message stating that the sender's IP was on relays.ordb.org, please ensure that you do not have relays.ordb.org entry configured in the IMF settings. You MUST restart the SMTP Virtual Server to release this setting.

The ORDB was an open relay data base which listed open relays which has recently closed its doors. Most RBLS (real time blacklists) when they wish to dissolve will commonly blacklist the entire internet in order to get the attention of those people using them to stop attempting to contact their IPs.

For more information please see the ORDB Problems page on our support site.

MxToolBox Announces the FlexBox Email Platform

2007-09-12T14:22:00Z

FlexBox Email Platform

Exciting things are happening here at MxToolBox. Monday marked the official launch of the MxToolBox FlexBox Email Platform, a one-of-a-kind email services suite built on Patent Pending Technology and designed specifically for the small to medium business market. FlexBox is an integrated collection of email services from email perimter security for companies that manage an email server in to fully managed email and collaboration for companies that do not want to manage an email server. But that's just the begining...

So, what Makes FlexBox "one-of-a-kind"?

Great question. Let me begin by saying that we're just as skeptical as you are when people throw around words like one-of-a-kind, revoluionary, groundbreaking, etc. You really have to be. When we say that FlexBox is one-of-a-kind, we can prove it. Read about it on our website and test it to see for yourself.

FlexBox's Technology allows a single email address to exist in two places. Aside from being really cool, this capability is particularly unique and useful in two different scenarios: Email Continuity and Testing/Migrating to a Managed Email Service.

Email Continuity

FlexBox Emergency Mail is a email continuity (aka disaster recovery) mail box that runs in parallel with an existing mailbox on a self managed server. Emergency Mail is always on, always ready and always synchronized with the primary mailbox. It is the first email continuity service with Zero Switchover Time, Zero IT Intervention to Activate, Zero Switchback time, and a rolling 30 day history of received email. That means that if you have FlexBox Emergency and your server goes down, your users can immediately begin using the Emergency Email system without skipping a beat. They can send and receive email without any intteruption, which leaves you free to fix the problem. Once your server is back up, the Emergency Mail boxes automatically synchronizes with the mailbox on your server, meaning you don't have to migrate any data.

Emergency Mail gives small to medium businesses the same kind of protection from email outages (planned and unplanned) that large enterprises have...but at a fraction of the cost. It is available on a per user basis, so you don't have to overspend for users that don't need the protection.

Migrating to Hosted Email

Any IT Manager/Consultant/Administrator that has ever considered moving from a self-managed server to a Managed Email Service knows that the migration process is enough to stop the idea dead in its tracks. Consider this---with traditional hosted email (i.e. Non-FlexBox hosted email), in order to simply test a hosted email solution in a day-to-day production environment, every single user must be moved off of the mail server and onto the Managed Platform, all at once. Just to test it! There goes the weekend. After migration, the help desk phone begins to ring, and ring, and ring. "How do I use this new sytem?" "Why didn't all of my contacts move over?" The list goes on and on. Forget about having any fun for the next couple of weeks. Then, if the managed solution just doesn't deliver, every user has to be moved back to the old system (another weekend), data from each system has to be reconciled (good luck) and all those folks in the Executive Suite are going to be asking for answers. Not fun.

FlexBox completely changes the rules of email migration. Because FlexBox technology allows a single address to exist in two places, IT Managers (you), can now have a user's mailbox on your server and you can have that same user's mailbox on a FlexBox Managed Mail server. You can have one user, some of your users or all of your users on both systems.

This means you can try Managed Email without migrating every user. FlexBox Managed Mail is the only Managed Email service that let's administrators keep some users on their in-house server and put other users on a Managed Server. It is also the only Hosted Email solution with Self Paced Migration. No more 72 hour weekends. No more two week help desk flood. No more damaged reputation. Just the exact email system that you need.

The FlexBox Services

Junk Mail is a spam and virus filtering service for email servers. Junk Mail has inbound and outbound mail filtering with free spooling.

Emergency Mail is an always on, always up to date backup email box. The mailbox has a rolling 30-day email history and is always ready. There is zero switchover time, zero IT Intervention and zero switch back time. Emergency Mail is provisioned on a per user basis.

Managed Mail is a fully hosted email service with high-end security and enterprise grade redundancy. Managed Mail is provisioned on a per user basis.

Managed Mail Pro is a email and collaboration solution with shared synchronized contacts and calendars. Managed Mail Pro also offers shared wikis and many other web 2.0 productivity features. Managed Mail Pro is provisioned on a per user basis.

Mobile device Synchronization and Email Archiving are also available. All services are available immediately to organizations throughout North America. And, if you are an IT Consultant or Solutions Provider, we are happy to announce that we have a FlexBox Email Services Partner Program

Starloop Blacklist

2007-09-10T13:59:00Z

We have disabled lookups to the STARLOOP Blacklist. Our lookup tool is not checking Starloop as of 9 AM CST 9/10/07.Starloop began listing all IP Addresses sometime late Sunday evening. These listings are false positives. The Starloop website is down and the blacklist is now timing out. If you experience bounce backs as a result of a recipient system using Starloop, your best course of action is to contact the recipient email team and inform them that Starloop is not a current, working RBL.

We will monitor the sitatution and post any updates here.

Storm Worm Continues to Rage

2007-08-30T14:46:00Z

The Storm Worm is proving to be among the most resilient, persistent pieces of malware ever. If you don't remember, the Storm Worm first burst onto the IT Security scene in January 2007. The worm got it's name because the first wave of propogtion spam that flooded inboxes had subject lines referencing a large storm that was pounding Europe at the time. Since then, the Storm Worm has morphed again and again, bringing an estimated 1.7 Million PCs into its Botnet in the process. Bot Herders have generally pushed the worm via a combination of emails containing links to worm infected websites. This of course means that IT must filter the worm at the email level and the browser level. Herders have also used infected zip file and excell file attachments to push the worm. Campaigns have varied: Virginia Tech Massacre, Greeting Card Spam, Password Protected Zip Files are just a few examples.

Currently, the Storm Worm herders are using emails with subject lines suggesting that the recipient is in a You Tube video. Anyone unsuspecting enough to click the link is taken to a malicious web page where they are attacked (and most likely infected) by the worm. Herders have also infected hundreds, possibly thousands, of Blogger Blogs with the malware.

This Storm just keeps on raging. An organization needs three elements to fight it: Robust email filtering. Robust web filtering. Security Conscious Employees that are trained to spot scams and not click on links or open attachments in suspect emails (the hardest part).

PDF Spam on the Wane

2007-08-30T14:44:00Z

The PDF Spam Spike appears to be over...at least for now. But the Storm Worm Continues to rage across multiple vectors.

Workers Use Email More Than Telephone

2007-08-21T14:53:00Z

Email is the top choice for business communication. A Datamonitor poll found that 100% of workers in the US and Pacific Asia use Email to perform their jobs, while only 80% use fixed line Telephones (76% also use Mobile Phones). 66% of those surveyed use IM.

PDF Spam Escalates Spam War

2007-08-16T04:03:00Z

The PDF Spam Spike marks an escalation in the spam war. Spam rates, which have seen triple digit annual growth rates over the past two years, spiked dramatically last week. Spammers are sending larger and larger batches of spam and using ever-evolving cloaking techniques to evade email security filters. The latest spike is a strong example of the latest layered threat.

A sustained flood of emails with PDF attachments and either no subject line, or a vague but widely applicable business term in the subject line, and no text in the email body was unleashed last week and continues to date. The difficulty with the PDF Spam is that it mimics a common business email practice, which is to send an email with no subject line or a vague subject line, no body text, and a PDF attachment.

When fighting any spam tactic, one must always choose the right balance between stoping bad email and not stopping good email. In other words, you can stop all of the spam and accept a high number of false positives (when legitimate message is caught in spam filter), or you can stop most of the spam with few or no false positives.

Security filters will adjust to the PDF spam (just as they did with Image Spam earlier this year) and will then be challenged again by something new. The name of the game is to stop the known stuff and withstand heavy barrages of the new stuff, without losing legitmate email in the process.

Attachment Spam / Pump and Dump Scam Combo Behind Spam Spike

2007-08-15T05:11:00Z

Last week's spam spike, marked by the single biggest one day jump ever (445%), put a new twist on an ever-evolving combination of spam and scam campaigns. A massive flood of PDF Spam was used to propogate a Pump and Dump Stock Scheme. The scam-paign lifted the share price of Prime Time Limited, a small Florida Company, a whopping 57% (from $.07 to $.11) through last Wednesday. The stock tumbled below $.07 in trading Thursday but fluttered up and down on Friday and this past Monday.

Prime Time denies involvemet in the scam and is working to identify shareholders who held "Naked Short" positions in the company. A Naked Short is:

A short selling tactic where a seller sells stock they don't own and bet that the stock price will drop in the few days before the sold stock must be delivered so that the delivered stock cost substantially less that the sold stock.
An ironic way for spammer-scammers to monitize their spam

Mobile Entertainment Inc and CYTV were two other penny stocks touted in the campagins. CYTV is a regular feature on the pump and dump circuit.

As always, the most astonishing fact of the case is that several thousand people, at least, took the bait (but hey, we know that Pump and Dump works).

The campaign used a large botnet to unleash a flood of relatively new attachment spam that fooled some defenses and simply overwhelmed others. It is also the first Pump and Dump Campaign to provoke a sustained elevation in trading volume.

Cyber Crime Cost US Consumers $7 Billion in the Past Two Years

2007-08-10T15:43:00Z

A Consumer Reports study found that US Consumers lost a total of $7 Billion during 2005 and 2006. Roughly $2 Billion is attributed to Phising Scam losses and the remaing $5 Billion was spent to replace virus and spyware infected computers.

Spam and Virus Rates Still At All Time High

2007-08-08T14:52:00Z

Spam

Spammers and Hackers have been busier than ever this summer. June set the record for all time high in spam messages, and spam rates continue to hover at around 90% of all messages sent. The Spackers (Spammer/Hacker) continue to hone their techniques in this constant game of cat and mouse. The latest trend is a shift to attachment spam, where the payload is delivered via an attached file. Attachment spam now represents a very significant portion of all spam sent. The bad guys have turned to PDF, Excell and Zip File Atachments to deliver spam. This means that spam will continue to eat up bandwidth and will likely lead to an increase in false positives, as anti-spam vendors adjust filters to account for the shift in spamming techniques. The good news? Image spam is on the decline.

Viruses

July has seen the largest sustained virus attack in over two years, with a flood of storm worm like malware delivered by Botnet Machines via fake greeting cards and spam messages with links to malware carrying web site.

Botnets

And, speaking of Botnets, despite a crackdown effort by the FBI early in the summer, it looks like the overall number of Botnet Zombie computers continues to grow.

The Prognosis

If you've seen more spam getting through your filters this summer, it's probably not because the developers and technicians that build and maintain your anti-spam / anti-virus decided to hang out at the pool until Fall. It's likely because the overall volume of spam and viruses continues to push boundaries never before seen. Couple this with the myriad of new techniques and tactics and, well, the security community has to scramble to keep up.

As for MxToolBox, we've worked hard to make sure our FlexBox Email Security Service has provided the highest possible level of protection for our customers mailbox's though this summer spam season.

Emergency Email: Don’t Let an Email Outage Jeopardize Your Business

2007-07-19T14:58:00Z

Email is Business Critical

Email is a critical business tool. In less than two decades, email has grown to equal the telephone as one of the essential tools for conducting business. Email is uniquely positioned at the heart of business critical communications AND business critical data.

Businesses rely on email to coordinate, collaborate, prospect, sell, manage, etc. In addition to sending and receiving email, many organizations also use their email system to manage and share calendars and contacts, adding another layer of criticality.

For the unprepared organization, an email outage carries harsh consequences, including:

Missed Deadlines
Angry Clients
Lost Opportunity
Wasted Investment
Reduced Revenue
Damaged Reputation

Depending on the industry (i.e. Legal, Financial), there might even be implications of malpractice or regulatory non-compliance.

50% of all businesses that lose access to mission critical data or applications, including email, to an accident, equipment failure, disaster or other cause and are unable to recover within 24 hours go out of business within 6 months[1].

Email is Fragile

Of all the critical tools businesses use, email is by far the most vulnerable.

The technology and infrastructure that power email today are still based on the original email system devised in the 1970's, where approximately fifty academics sent research papers back and forth to one another. Trust was an inherent part of the system. Because the community was so small and so tightly knit, the likelihood of abuse was close to zero. Fast forward a few decades to now, and we have billions of emails sent everyday. On top of that, unknown masses of super-sharp cyber criminals are always waiting just around the corner to steal money and data.

This doesn't mean that the whole system is on the verge of collapse, it just means that a secure, reliable business email system requires a large investment and a great deal of care and expertise to build, manage, maintain and backup.

Email Outages can occur at anytime and are caused by maddening number of factors--from a spilled cup of coffee to a natural disaster. When you manage your own e-mail server, you have to be prepared to deal with hardware failure, security breeches, missed updates/patches, fire, flood, tornados, hurricanes, theft, and more. If an email hosting company manages email for you, you have to know that they are prepared for the same.

When Your Email Goes Down...

If your email server or an ancillary piece of your email system fails and you don't have a backup system in place, two things immediately happen:

No one at your business can send or receive email
Any email that is inbound to your server is probably lost forever

Depending on how you are setup, you may also have problems accessing historical email, contacts and calendars. What happens next is easy enough to imagine.

Eliminate the Risk of an Email Outage

Today's business climate is such that if an email system fails, businesses need to be able to continue to conduct business without missing a beat. Anything less exposes the business to untold risk.

A business can easily avoid the harsh consequences of an Email Outage with a professional Emergency Mail service. Emergency Mail Services (a.k.a. "Email Continuity," "Disaster Recovery") come in many colors, shapes and sizes. Many of them are inadequate.

To be completely effective, an Emergency Mail Service must have the following four characteristics:

Includes an intuitive web based email client that users are already familiar with
Contains a history of recent Email for users to reference
Provides Immediate Switch Over to the backup system so that no email, deadline or opportunity is missed
Requires little to no IT Intervention so that IT support does not become overwhelmed

Without these four capabilities, an Emergency Mail system is really just going to be as effective as a "band-aid on a bullet hole."

Don't Chance It

You business is important to you. Email is important to your business. Emergency Mail helps to ensure that an unforeseen email outage doesn't spiral into a full blown company crisis.

About MxToolBox, Inc: Based in Austin, TX, MxToolBox, Inc. is a leading provider of on demand email services to small business throughout the USA and Canada. MxToolBox's Email Security, Emergency Email, Managed Email and Email Archiving services make email secure, reliable and effective for over 30,000 users. Visit http://www.mxtoolbox.com/ or call 866-MxToolBox (866-698-6652) for more details.

[1] Gartner Group

FlexBox Mail Software, Zimbra, Wins eWEEK Excellence Award for Enterprise Collaboration

2007-06-25T16:07:00Z

Zimbra recently won the eWEEK Excellence Award for Enterprise Collaboration for it's next generation messaging and collaboration suite. MxToolBox is excited about this award because Zimbra is the collaboration component that helps to power our FlexBox Managed Email Service. We chose Zimbra as our collaboration software because it is an innovative groupware system that scales up without degraded performance, and it plays well with our dedication to innovation and superior performance. Of course, we have combined Zimbra with our best-in-class security solution, our "we cross the line" service philosophy, and several sprinkles of the secret sauce to provide a hassle free, reliable, secure, high performance managed email service like no other.

FlexBox Managed EMail is a full exchange replacement with shared/synchronized contacts, calendars, email and mobile devices.The system synchronizes with Outlook, so your users don't have to learn a whole new bag of tricks. It also has a few added features that exchange doesn't (wikis, for example)...oh, and the web client is like a dream (think of the best of Outlook, combined with the best of Gmail).

Speaking of FlexBox, stay tuned in the weeks and months ahead for some upcoming announcements that promise to be as exciting as they will be groundbreaking.

FLOWGO Goes Away

2007-06-13T13:16:00Z

The FLOWGO RBL has gone offline. As a result all IP Addresses are now "listed." Anyone who is using FLOWGO as an anti-spam measure on their server should remove it. If you receive a bounce message saying your mail was rejected due to listing on FLOWGO, please contact the recipient email administrator and advise them that FLOWGO is now offline.

We have removed FLOWGO from our lookup tool as of 7:30 AM CST. However, after FLOWGO went offline sometime lastnight, our server monitoring tool sent out noticies to roughly 1000 of our monitoring customers. If you received one of these alerts, you can disregard it.

Spamhaus DDOS SYN Flood Attack

2007-06-08T13:57:00Z

Spamhaus was the victim of a Distributed Denial of Service attack (DDOS) SYN Flood attack during through the middle of the week. The site is back up and running now on a new IP.