Skip to content
B

New Contributor

 • 

4 Messages

Tuesday, May 13th, 2025 8:52 AM

SSL SMTP connection blocked by Spamhaus

Hello.

We have a local email relay server and it is working with MS Outlook 365 cloud. MS cloud system is accepting relay emails only via SMTP connection (TCP port 25) with TLS certificates (encrypted connection + certificates authentication). So, it is protected from spam. But when we are trying to send emails from our local server to MS cloud we are getting an error from Spamhaus system (it located between us and MS cloud) within TCP connection:

550 5.7.1 Service unavailable, Client host [X.X.X.X] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/X.X.X.X AS(1450)"

We have a business IP and it is not dynamic. Also, we are not allowed to request Spamhaus to unblock us. By their policies it may be done only by ISP request.

We did try contact xfinity/comcast support several times to unblock IP from the Spamhaus protection system, but support agents don't know what to do with our case. Every time we are calling they are saying it is an issue with our firewall device (we are working in bridge mode) or with edge security system. Who and how we shall contact to solve this issue?

Best Regards.

Official Employee

 • 

34 Messages

9 days ago

@Binyod I’m sorry to hear you're having issues with your email account. Were you calling the business team directly at (800) 391-3000?  Sometimes we see these errors when accounts have been marked for sending spam. Can you provide me with the exact error code, so I can assist you further? 

New Contributor

 • 

4 Messages

8 days ago

Hello.

Thanks for responding. Yes, we contacted business team directly several times without any luck.

It is not an issue with email account providing by xfinity/comcast. We have email account at the Microsoft Exchange cloud (not just one account but domain with all our accounts). And we have a local relay server. This server is getting message from our local machines and transferring them by SMTP with SSL/TLS (TCP port 25) to Microsoft cloud (with authentication by certificate). But the email we are sending can't reach Microsoft cloud because our TCP connection with them are stopping by Spamhaus protection system. It is Mandatory of Microsoft to use TCP port 25 (SMTP) for sending emails from local relay servers: https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365#configure-a-tls-certificate-based-connector-for-smtp-relay and we can't use any other protocol.

The error we are getting within TCP connection I provided at the first message. Here is a confirmation our IP is at the PBL list: https://check.spamhaus.org/results?query=X.X.X.X

If it is a mandatory to use a Comcast relay server for sending emails we would like to see a manual how we may use Comcast relay server for sending our domain emails to Microsoft Exchange cloud without sharing any credentials data. If it is not possible we would like to request do remove IP from PBL.

Best Regards.

(edited)

Official Employee

 • 

37 Messages

Binyod Gotcha. Since email is used for important communications and Comcast wants to ensure that these communications are as secure and as private as possible. As such, Comcast does not support port 25 for the transmission of email by our residential Internet customers. Much of the current use of port 25 is by computers that have been infected by malware and are sending spam without the knowledge of the users of those computers.

 

https://www.xfinity.com/support/articles/email-port-25-no-longer-supported

New Contributor

 • 

4 Messages

Hi.

It is clear the port 25 is using by spamming bots and why it is blocking by default. But it is only available port to communicated with Microsoft Exchange cloud. And it is secure because Microsoft require TLS authentication. What are our options? Is it possible to leave IP at blocklist but allow Microsoft cloud as destination?

Best Regards.

Official Employee

 • 

37 Messages

Binyod There are unfortunately no options. Port 25 is fully blocked. Apologies but there is no way to accommodate the request for port 25 access. 

Administrator

 • 

39 Messages

Hey, @Binyod! I also just wanted to add that an alternative to port 25 would be 465 or 587. If I remember right, 465 is used more with TLS.

New Contributor

 • 

4 Messages

@Comcast_MichaelC​ thanks for info. But sadly, MS are supporting only port 25: https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365#configure-a-tls-certificate-based-connector-for-smtp-relay