Is CGNat stopping my e-mails communicating with Plusnet SMTP server?

[#1]

Hi, a recent upgrade to my Gigaclear broadband seems to have stopped MS Outlook e-mails getting through to the relay.plus.net server. Gigaclear explained that my router now uses CGNat to create my IP addresses, and this could be the problem. CGNat has replaced the usual DHCP dynamic IP address. Gigaclear's idea is that I would need to revert to a static IP address (at a cost) which I don't fancy due to potential security issues and who knows, maybe an unknown impact on the VPN provided by our employer for home working?

Does anyone recognise this particular issue, and is the Gigaclear idea workable? This has been a voyage of discovery for me, I am no expert!

Thanks

[#2]

Moderator's note:
Thread moved from Broadband to Tech Help

[#3]

I don't see how CGNAT would affect connection to relay.plus.net - lots of connections use CGNAT (e.g. most mobile phones) and they work OK.

It is possible that your new IP address is in a blocklist used by Plusnet.

Do you get any indication of why the connection isn't made - any error messages at all?

Presumably you have authentication set up if you have been using Gigaclear for a while.

BTW there are no additional security risks from using a static IP - I don't know why people think there are. However, it shouldn't be necessary anyway.

[#4]

AIUI CGNAT results in lots of users appearing to be using the same IP address.  Thereby there is...

• More potential that the IP address has been abused and black-balled from connecting to the SMTP services
• Be seen as a non-UK connection / IP and thus face additional security restrictions

Try running this SMTP connectivity diagnostic - it should give you a more refined error reason than just "connection refused".

Test SMTP authentication

Email programs often report username / password error for issues not actually related to those being wrong, but for other connectivity issues. Such can be very frustrating when you are convinced that they are correct. Testing SMTP authentication through a command line interface can deliver a more precise error message. The following describes how to do this using TELNET.

This is not difficult, but you need the following resources which might be unfamiliar...

1. TELNET - this might need installing as an additional option, for Windows see enabling TELNET.
2. A code64 encoder / decoder such as this.

You can use TELNET to communicate direct with the SMTP server as follows...

Open the code64 encoder in a web browser and leave ready for use in the following steps.

Launch a windows command line window (DOS window) - press windows-key+R - type CMD into the run box - click OK

Enter...

telnet relay.plus.net 587

Press enter. Note if you use one of the other brand email services, use the appropriate SMTP server name for that brand. In response to SMTP server I'm here message, say 'HELLO'...

EHLO relay.plus.net

The SMTP server will then report what it can do after which tell the server you wish to authenticate...

AUTH login

The server should return the following, which is a base64 encoded string that requires your username:

334 VXNlcm5hbWU6

Use the code64 encoder to encode your username and paste it into the telnet window and press enter. For example:

bXl1c2VybmFtZQ==

The server should return the following, which is a base64 encoded string that requires your password:

334 UGFzc3dvcmQ6

Paste the base64 encoded password for the username. For example:

bXlwYXNzd29yZA==

The server will then report success or failure, any failure message should clearly indicate the reason for the failure. If the reason for the failure is not clear, please report back the message.

Close the SMTP / TELNET session by entering

quit

The session should look something similar to the below wherein your input is in bold...

220 avasout03 smtp relay.plus.net
EHLO relay.plus.net
250-avasout03 hello [your IP address], pleased to meet you
250-HELP
250-AUTH LOGIN PLAIN
250-SIZE 104857600
250-PIPELINING
250-8BITMIME
250-STARTTLS
250 OK
AUTH LOGIN
334 VXNlcm5hbWU6
bXl1c2VybmFtZQ==
334 UGFzc3dvcmQ6
bXlwYXNzd29yZA==
235 ... authentication succeeded
quit
221 avasout03 smtp closing connection
Connection to host lost.

Here are some examples of failure responses...

535 ...authentication rejected [as username / password is wrong]
535 ...authentication rejected as source IP has a poor reputation
535 Too many SMTP auth failures. Please try again later.

[#5]

Hi Townman,

I followed your telnet advice with this message, I got this far after the first command.

220avasout-ptp-003 smtp relay.plus.net

Connection to host lost.

Then I sent a mail using a mobile hotspot, assuming this would go straight to plusnet servers without using wifi/broadband

Paying more attention now to Outlook messages on failing to send, I get this:

Task 'myname - Sending' reported error (0x800CCC6F) : 'Your outgoing (SMTP) email server has reported an internal error. If you continue to receive this message, contact your server administrator or Internet service provider (ISP).  The server responded: 554 avasout-peh-003 smtp ESMTP server not available (blacklisted by local policy)'.

So blacklisting is real, for me it still comes back to this all starting on the same day as broadband upgrade.

[#6]

@MastenB 

220avasout-ptp-003 smtp relay.plus.net

Connection to host lost

You need to be quick with your commands otherwise the connection will drop

Suggest you copy the commands to a text file and copy paste from there, also have the code64 ready

EDIT: seems to time out after 15 seconds with no input

EDIT2 forget to mention entering EHLO relay.plus.net should keep the connection open

HTH

[#7]

OK thanks, this is new to me.

I'm waiting for the command prompt after entering the first command, then the lost connection message appears after 15 secs, as you say. Should I be doing something else while waiting?

[#8]

Once the telnet session connects you should see

220 avasout-ptp-002 smtp relay.plus.net

You then enter the first command

EHLO relay.plus.net

You should then get this response

250-avasout-ptp-002 hello [my broadband IP Address], pleased to meet you
250-HELP
250-AUTH LOGIN PLAIN
250-SIZE 104857600
250-PIPELINING
250-8BITMIME
250-STARTTLS
250 OK

Next command to enter will be

AUTH login

EDIT: There is no command prompt

[#9]

After working out how to copy/paste in DOS, I get all messages as listed. No authentication errors.

[#10]

Have you tried using webmail to view your emails https://webmail.plus.net/ ? This removes the need to setup the incoming and outgoing server connections.

If it is the default email account just use the Plusnet account name

If it’s a secondary email account use accountname+mailboxname

HTH

[#11]

---

@MastenB wrote:

I'm waiting for the command prompt after entering the first command, then the lost connection message appears after 15 secs, ...

---

There is no command prompt - just follow the instructions as written - after response messages are displayed do the next step.

Are you advising that having followed the script, you logged in successfully?

[#12]

---

@MastenB wrote:

Paying more attention now to Outlook messages on failing to send, I get this:

Task 'myname - Sending' reported error (0x800CCC6F) : 'Your outgoing (SMTP) email server has reported an internal error. If you continue to receive this message, contact your server administrator or Internet service provider (ISP).  The server responded: 554 avasout-peh-003 smtp ESMTP server not available (blacklisted by local policy)'.

So blacklisting is real, for me it still comes back to this all starting on the same day as broadband upgrade.

---

That suggests that the shared IP address has been compromised, however if that were the case then SMTP diagnostic connection should report the same error.  Note that the SMTP diagnostic test does NOT use encryption.  Searching the error code (amongst other hits) produced this - Error: 0x800ccc6f - Microsoft Community

"This error could occur if in your account settings, you have set your SMTP e-mail server to use a secure connection, and your server does not support secure connections."

Though that thread is in relation to OE it might be worth removing encryption from the SMTP server settings in Outlook, for more recent hits state similar - see Email Sending Getting Error Code 0x800CCC6F - Microsoft Office™ (whatthetech.com)

For the avoidance of doubt by "outlook" EXACTLY what product are you using?

ESMTP - clearly indicates that the SMTP service IS configured for encryption - which port are you using and which encryption setting?

[#13]

MS Outlook is from Office 365. I get all the scheduled updates.

Incoming and Outgoing mail is not encrypted. Incoming mail has always been received.

Looking at your supplied links and trying a few things:

The Port numbers have been 110 and 25, although changing these to 993 and 587 and sending a mail gives the same erro message as earlier, except there is a subtle change to the listed server: 554 avasout-PTP-001 smtp ESMTP server.

Then going for encryption for Incoming and Outgoing mail, either STARTTLS or SSL/TLS, makes no difference.

All these changes were done within the Outlook POP Account settings. However, there is always the message that Outlook cannot save any of the settings, so it would not appear that these port or encryption changes were not implemented anyway. 

I have tried these type of setting changes already in the recent past.

In answer to Dan_the_Van's question, then yes, we're using webmail to send emails at the moment. Going off topic a little, the slightly annoying issue there is that the plusnet mailbox is named [username]@[username].plus.com, whereas our e-mail name uses a different phrase to the left of the @. This means direct replies don't get through.

[#14 · Accepted solution]

---

@MastenB wrote:

The Port numbers have been 110 and 25, although changing these to 993 and 587 and sending a mail gives the same erro message as earlier, except there is a subtle change to the listed server: 554 avasout-PTP-001 smtp ESMTP server.

All these changes were done within the Outlook POP Account settings. However, there is always the message that Outlook cannot save any of the settings, so it would not appear that these port or encryption changes were not implemented anyway. 

---

POP3 uses ports 110 (without encryption) and port 995 (with encryption)

Port 993 is for IMAP with encryption

SMTP should be on port 587 without (none) or with (STARTTLS) encryption

The different avasout server has no material bearing on the issue.

[#15]

My Outlook 365 settings are

     

HTH

Edit: missed the fix status