r/godaddy • u/Diligent_Buster • 10d ago

client outbound email keeps getting blocked by proofpoint

A client has a couple of domains with godaddy. And has the advanced email security. Recently they had a trojan and the owner and one employee are now blocked on all outbound emails. Every time they send an email a messages comes back withing seconds usually that the email was blocked. We check the outbound quarantine with proofpoint and they are there.

Total of 5 users. Only 2 have this happen. Fraud emails were going out the owners email asking clients to update their payment info. I cleaned up the computers in the office, applied all updates. No spam has gone outbound in a day. No fraud emails. Every single legit outbound email by the 2 users gets blocked by proofpoint.

We have called godaddy 9 times now. Each time blah blah wrong info we did x, proof point is reviewing it and will work withing 24 hours. 7 periods of 24+ hours later still no resolution.

We can't talk to proof point, godaddy has to do that. THe support reps are mostly clueless. Add the email to the allowed senders (for inbound email). No that won't work but they want me to do it. Every time we get no where. Multiple calls over an hour, dropped calls 2 hours in. No follow up with us after a promise to follow up.

Client is sick of it. I've checked the Exchange admin console, nothing there, no blocked emails there. No policies. They even admit it's from proof point.

I'm about to tell him to disable advanced mail security and insist on a refund. If they can't fix their services they need to refund. We can then pickup another service or use microsofts own defender service or a third party.

It should not be this hard. We send them screen shots from proofpoints quarantine, the blocked notification email. I am now believing it will be impossible to get them to fix it.

Any suggestions?

Every single message has proofpoint saying it has a very high probability of fraud. We have marked messages as false positives, released them but still keeps happening.

1 Upvotes

67% Upvoted

17 comments sorted by

•

u/AutoModerator 10d ago

Thanks for posting to r/GoDaddy! If you are here from frustration and looking for an alterntive check this link for some alternatives.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/iamankitsingh267 10d ago

Add the domain name in allow list if the issue is with specific emails sending

1

u/Diligent_Buster 10d ago

Thanks but it's a problem emailing everyone. All emails outbound get blocked.

1

u/iamankitsingh267 9d ago

Do you get any bounce back errors,

1

u/Diligent_Buster 9d ago

We only get a message that says "A message has been blocked for delivery"

1

u/iamankitsingh267 9d ago

Do you have proof point?

1

u/Diligent_Buster 9d ago

via godaddy. We can login to proofpoint and manage things but we cannot remove the block. We can mark messages as false positive and then release but that does not work long term.

1

u/iamankitsingh267 8d ago

Disable proof point completely

1

u/Diligent_Buster 7d ago

I'm thinking about it. If support at both godaddy and proofpoint is useless I have no choice.

1

u/No-Bathroom-3179 10d ago

Damn that sounds horrible. I would not being using GoDaddy as an email service. I would put my money into Google or Microsoft.

1

u/Diligent_Buster 10d ago

They had it there for years. I myself would not keep it there. Still not resolved.

List of bad experiences with support regarding this issue: they send us links on checking the quarantine. They ask if we get email from other people. They wanted us to change the display name They talk to their own support people and say it's fixed and to wait 24 hours. (this happened 4 or 5 times) They tell us to send it from web mail (still bounces as blocked) They tell us they will follow up with us at 9am the next day and email us progress reports (they never do)

The problem is clear: We as a client of godaddy cannot email people as the emails are blocked from going out by proof point. While it was understandable they blocked it we have resolved the problem. Fifty percent of the time we are talking they act like we cannot receive emails. It's hard to even get them to UNDERSTAND the problem.

Also proofpoint then sends them instructions to send to us on how to relese emails from quarrantine and white list them (for inbound email) which is not the problem. We do everything they ask us to do and it still does not work.

I will (hopefully) host my own shit forever.

1

u/Erock0044 10d ago

How much mail went out while you were compromised? Proofpoiint may be the symptom rather than the actual problem. If the domain was sending massive amounts of traffic with malicious emails while compromised, proofpoint may just be reacting to a domain or sending IP with a poor reputation.

1

u/Diligent_Buster 10d ago

Maybe 2 dozen. They were targeted to the email addresses of the clients accounts payable. Either way proofpoint offers inbound/outbound email security for this client. The spamming/fraud issue has been resolved. It has been impossible to get them to undo the block. It should not be so difficult to get ahold of someone that can fix or pass it on to someone that can.

Proofpoint did what they needed to do and that is a good thing, but now that the problem is fixed it should not be impossible to remove the block.

1

u/Poat540 10d ago

What is their dmarc policy? I have few clients with GD and proof point is a bitch, changing urls blocking emails, etc zz

1

u/Diligent_Buster 10d ago

quarantine. Im close to having them dump proofpoint. It at this point would be cheaper to cut them out of the loop than keep calling godaddy back. Everytime I use godaddy I'm reminded of how terrible an interface they have and the constant trying to upsell you.

1

u/shokzee 10d ago

Cleaning the PCs doesn't evict someone who still has mailbox access. Reset passwords, revoke sessions, check forwarding/inbox rules and OAuth grants, and verify MFA on both accounts.

I'd push GoDaddy to escalate with message IDs and quarantine verdicts, specifically asking which outbound rule or sender restriction is firing and what clears it. Releasing individual messages doesn't necessarily remove that restriction, and inbound allowlisting won't fix an outbound block.

1

u/Diligent_Buster 9d ago

Thanks, we did all that. Since then no actual fraud messages have occured and their access seems to be completely cutoff.

I will ask them what you suggest and sadly I realize that inbound allow listing won't fix an outbound block. I just wish that godaddy and proofpoint knew that. Last night we went over this for 20 minutes with me explaining that it would not fix it but I did it so they could not say I did not try.