The asia.spamsources.mxes.net blocklist has received a major update. The list contains most of the CIDR blocks for the following countries, which represent our top sources of spam from Asia:

• India
• Vietnam
• Indonesia
• Pakistan
• China
• South Korea
• Taiwan
• Kazakhstan
• Sri Lanka

You can check for rejected email attempts from those countries by selecting 'Accounts -> Real-Time Reports' from top menu in the Account Manager, clicking a link in the 'Rejects' column, and then looking for 'Client blocked using asia.spamsources.mxes.net' in the list. For example:

Client blocked using asia.spamsources.mxes.net
   1 P sydney@bestworks.ws                     15:32:28          linux2-9.gabia.com[121.254.168.9]                            www.miraevein.com

If you wish to whitelist a sender, copy either the the envelope sender address (sydney@bestworks.ws in the above example), the client hostname (linux2-9.gabia.com), or the IP address (121.254.168.9) and add it to your account's Allow/Deny list. Select 'Account -> Allow/Deny List' and paste the sender in the 'Entry' field, check the 'MX' box, and click 'Add Address'.

If you want to disable the asia.spamsources.mxes.net blocklist, uncheck the 'B4 Reject Most Asian IP Addresses' MX restriction for your address. Select 'Domain -> Addresses' to access the MX restriction controls.

Several users have reported receiving a phishing email that claims to be from support@webmail.net with the subject "You Have Exceeded The Storage Limit". We don't own the "webmail.net" domain and have nothing to do with it.

The email requests that you click on a link to resolve the situation. The provided link then takes you to a form where you're requested to enter in your username and password. If you've provided this information, then you need to change your Tuffmail password immediately.

Tuffmail does send you an email when your account storage is exceeded (over quota), however the notification email comes from an mxes.net address and does not contain any links.

Here is a copy of the phishing email - please note that the provided URL is clearly bogus, especially since it doesn't point to a tuffmail.net or tuffmail.com domain.

Date: Wed, 18 May 2011 05:48:37 +0700
From: "System Administrator" 
To: undisclosed-recipients:;
Subject: You Have Exceeded The Storage Limit


You have exceeded the storage limit on your mailbox.

You will not be able to send or receive new mail until you upgrade your
email.

Click the below link and fill the form to upgrade your account.

http://sandersfamilyofeasttx.org/forms/use/support/form1.html

System Administrator
192.168.0.011

An email has been sent recently to some Tuffmail users from a scammer claiming to be "Tuffmail Technical Support" using the forged sender address webmaster@tuffmail.net.

It's a rather poor Phishing attempt to trick users into giving up some personal information by clicking on a link and filling out a form. We don't know what kind of information was being requested because the link is now dead, however we can guess that it was probably asking for a mailbox username and password.

We never communicate with our users using "webmaster@tuffmail.net" as the sender address, and we would never ask you to click a link to "verify your information." We would never ask you for personal information, except within the context of a support request that you initiate.

A copy of the phishing email is provided below. Please note that the form link points to a domain that clearly isn't Tuffmail.

---------------------------- Original Message ----------------------------
Subject: Changes due to recent server upgrades
From:    "Tuffmail Technical Support" 
Date:    Tue, May 3, 2011 8:39 am
To:      undisclosed-recipients:;
--------------------------------------------------------------------------

Dear Email User,

This message is from Tuffmail Internet message center,
during our regular update and verification of your email
accounts, we couldn't verify your current information.

Either your information has changed or it is incomplete. If the
account information is not updated to current information within
5 days, then your account will be set on hold.

Log in to your e-mail account by clicking on this link:

http://rs.osceolanewsgazette.com/phpform/use/Tuffmail-Technical-Support/form1.html

After you logged in, update and verify your information please.

Thank you for your patience as we work together to protect your email
account.


To be protected under Sec. 5 (b)(1)(A)(i) of the CAN-SPAM act, notice is
hereby given than we will not give, sell, or otherwise transfer addresses
found on this website to any other party for the purposes of initiating, or
enabling others to initiate, electronic mail messages.
As if the harvesting robots will read

Copyright 2002-2011 Breah Internet Inc.

Some email clients were failing to validate our new wildcard certificate for *.mxes.net because our certificate issuer, RapidSSL, switched CA roots from Equifax to GeoTrust. It turns out that GeoTrust had recently updated its root certificate in July, 2010.

Unfortunately, that newer GeoTrust root certificate isn't as widely deployed on client machines as the old Equifax root cert, which means that some email clients weren't able to validate the authenticity of mail.mxes.net and smtp.mxes.net.

Email clients for mobile devices such as Android were the most commonly affected, but other clients such as ClawsMail and Alpine also reported validation failures. The certificate validation failure appeared as messages like "Cannot Connect Safely to Server" or one indicating that the server certificate had changed.

The problem was solved by installing a "cross root" certificate that links our new RapidSSL intermediate certificate to the old Equifax CA root cert. Thanks to Michael from Trustico support for providing us with the correct crossroot CA cert.

Thanks also to our knowledgeable customers who provided us with valuable debugging information and suggestions.

A new wildcard certificate for *.mxes.net was installed on our servers last night. It was issued by RapidSSL and includes an intermidiate CA certificate as part of their new policy for newly-issued certificates. This seems to be causing problems for some email clients and browsers.

Some email clients, including those on Android phones, are issuing alerts that our certificate has changed, and this is true, although this isn't expected behavior.

Other errors indicate that our server certificate is invalid due to a validation error.

We're investigating this and will post updates to this page.

In the meantime, try https://manage.tuffmail.net for the Account Manager, and the unencrypted ports for mail.mxes.net and smtp.mxes.net ( http://www.tuffmail.com/ports.php )

The database for Roundcube 0.4.2 was dropped and recreated at 1:00AM EST. Please report any problems to support@tuffmail.com.

The database reset will be postponed until Thursday, December 2 at 1:00AM EST (Thursday, December 2 at 6:00AM UTC)

Please note that you will lose your 'Personal Addresses' address book entries, although your personal_ldap entries will remain unaffected.

Roundcube allows you to make a backup of your Personal Addresses. After logging in to Roundcube, select 'Address Book' from the top right of the page. Click on 'Personal Addresses' in the Groups pane on the left-hand side, then click 'Export contacts in vCard format', which is the folder icon + down arrow overtop the 'Contacts' pane. After the reset is done and your contacts disappear, you can import your saved contacts using the 'Import Contacts' button.

It turns out that our Roundcube 0.4.2 MySQL database structure, which was converted from 0.3, is a bit of a mess. The migration script supplied by Roundcube seems to have missed some indexes, constraints, and most importantly character encoding on tables and columns. We've applied some fixes, but odd problems are still cropping up.

We need to reset the database using the proper initialization SQL statements, but our testing shows that we won't be able to import the old data due to some inconsistencies. This means that after the database is reset, your settings will be lost, but your folders and email won't be affected. When you log back into Roundcube, it will be like logging in for the first time.

The database reset is scheduled for Thursday, November 25 at 1:00AM EST.

We've installed the latest stable release of Roundcube to our our beta webmail site. We've had to make a few modifications to the code for it to fit into our system, so we're not quite ready to officially support it until we see it run for a week or two. If you run across any problems please email support@tuffmail.com . URL: http://wmbeta.tuffmail.net/roundcubemail-0.4.2

We're moving a database server today which could cause some temporary service disruptions between 9:30 PM UTC and 10:30 PM UTC (5:30 PM EDT - 7:30 PM EDT). Specifically, LDAP services may be unavailable momentarily.

UPDATE 2010-08-28 22:30 UTC (6:30pm EDT) - Account Manager not functioning properly. You may not be able to make updates. Working on a fix.

UPDATE 2010-08-28 22:57 UTC (6:57pm EDT) - Account Manager problem resolved. All services functioning normally.