NOTICE TIME ZONE | Brisbane GMT+10 |
---|---|
STATUS (Open/Closed) | Open |
INCIDENT START DATE | 2020929 |
INCIDENT START TIME (HH:MM) | Approx: 08:15 |
ESTIMATED TIME TO RESOLUTION | N/A |
INCIDENT END DATE | 20200929 |
INCIDENT END TIME (HH:MM) | 23:59 |
OUTAGE DURATION | 16hrs |
INCIDENT CAUSED BY A 3RD PARTY? | No |
IF YES, NAME OF 3RD PARTY | |
XCRM TICKET NUMBER | N/A |
BRAND | XNET |
INTERNAL PRIORITY | N/A |
CUSTOMERS AFFECTED | ALL |
SITES AFFECTED | ALL |
DESCRIPTION OF INCIDENT | Some users receiving notifications informing them of delays sending to domains such as hotmail.com, outlook.com and live.com due to mail.voipstra.com.au being on email blacklists |
PRIMARY IMPACT EFFECT | Users may have delays sending emails |
SECONDARY IMPACT EFFECT | None |
EVENT TIMELINE | |
TUESDAY 29TH SEPTEMBER 2020 | |
08:15 | XSTRA identified a large backlog of emails on mail server |
08:30 | XSTRA confirmed mail.voipstra.com.au was blacklisted |
08:41 | XSTRA identified cause of blacklisting due to large quantity of spam emails being relayed through server |
09:00 | XSTRA identified source of relay and immediately blocked all connectivity to the mail server from that network |
09:03 | XSTRA commenced clearing backlog of spam emails |
09:45 | XSTRA submitted request to be delisted from the blacklists |
10:15 | XSTRA forced email to route via alternative IP address temporarily to ensure delayed email still transmitted |
RECOVERY & RESOLUTION | |
Removed spam server’s ability to relay through the mail server and additionally blocked at the router level. Cleared all remaining spam email from queue and submitted requests to be delisted | |
ROOT CAUSE | |
A subnet mask that is reserved for private ip addresses was declared too large allowing public addresses to use the mail server as a relay | |
CORRECTIVE & PREVENTATIVE MEASURES | |
Confirm all IP addresses in the list are only private subnets and\or customer specific ip addresses | |
RESIDUAL EFFECT | |
Some email may be required to be resent if it exceeds the 2 day delay window |
Revision:
1
Last modified:
Nov 10, 2020
Post your comment on this topic.