Post incident report:

Start: 1-February-2022 1846 UTC
End: 1-February-2022 1935 UTC
Duration: 1 hr 29 min

Summary:

Received a ticket (II-80) from a customer stating that some email was undeliverable due to being on a Spamhaus block list.

Root Cause:

One of our AWS EIP’s was listed on the Spamhaus Policy Block List.  This listing alone should not block the sending of email.  Per Spamhaus FAQ on the PBL: 

PBL listings do not prevent the sending of email unless the user's email program is not authenticating correctly when connecting to their ISP or company's mail server.

Email was indeed blocked from sending though.

 Customer Impact:

This customer reported email being sent out were bounced back.  Upon further investigation it showed a small subset of MS teams that if they hit one specific MTA for OBX, Microsoft refused to send.

 Mitigation Action:

Used Spamhaus tools to immediately remove the AWS EIP from Spamhaus PBL.

 Follow-up Items and Preventative Measures:

1. Checking all EIPs to ensure no others are on Spamhaus PBL and repeating this check on a routine basis.
2. Met with Spamhaus leadership to strengthen our relationship and build contacts to prevent future issues