mail hosts does not recogize all mailchannels hosts

[ewv]

mailhosts only allows adding mx1.mailchannels.net. (pri 0)
and mx2.mailchannels.net  resulting in:

inbound.mailchannels.net
postfix-inbound-0.inbound.mailchannels.net
postfix-inbound-3.inbound.mailchannels.net
postfix-inbound-4.inbound.mailchannels.net
postfix-inbound-5.inbound.mailchannels.net
postfix-inbound-6.inbound.mailchannels.net
postfix-inbound-7.inbound.mailchannels.net
postfix-inbound-11.inbound.mailchannels.net

Missing from that list is (at least)#2:
postfix-inbound-2.inbound.mailchannels.net

and more fundamentally
inbound-splitter.mailchannels.net

resulting in spamcop hanging before getting to the spam source, for example:

2: Received: from inbound-trex-4 (100-101-84-158.inbound-trex.inbound.svc.cluster.local [100.101.84.158]) by postfix-inbound-4.inbound.mailchannels.net (Postfix) with ESMTP id AAE1520251 for <x>; Thu, 12 Nov 2020 10:19:05 +0000 (UTC)
No unique hostname found for source: 100.101.84.158
Possible forgery. Supposed receiving system not associated with any of your mailhosts
Will not trust this Received line.

for headers:

... Received: from inbound-trex-4 (100-101-84-158.inbound-trex.inbound.svc.cluster.local [100.101.84.158])
    by postfix-inbound-4.inbound.mailchannels.net (Postfix) with ESMTP id AAE1520251
    for <x>; Thu, 12 Nov 2020 10:19:05 +0000 (UTC)
Received: from inbound-trex-0 (100-96-26-96.inbound-trex.inbound.svc.cluster.local [100.96.26.96])
    by postfix-inbound-splitter-0.localdomain (Postfix) with ESMTP id EBBED20032;
    Thu, 12 Nov 2020 10:19:00 +0000 (UTC)
Received: from p110239-ipoefx.ipoe.ocn.ne.jp (p110239-ipoefx.ipoe.ocn.ne.jp
 [153.246.145.238])
    by 0.0.0.0:2500 (trex/5.18.10);
    Thu, 12 Nov 2020 10:19:00 +0000

p110239-ipoefx.ipoe.ocn.ne.jp escapes being reported.

 

 

Edited November 12, 2020 by ewv

[gnarlymarley]

You can try adding the same email address to your mailhosts again and then go back to the previous tracking URL to see if it picks it up.  I don't think the mailhosts updates itself automatically.

[ewv]

Adding mailchannels to mailhosts was confirmed in mailhosts, with no change in parsing behavior.  Parsing submissions have been only after Mailhosts was updated.

Mailchannels later disappeared from mailhosts entirely and could not be added back: Selecting the "standard name" mailchannels resulted in the options to select only dreamhost servers (the base mail host already registered long ago).  Hours later I could then add mailchannels servers again, but still with the same aberrant behavior blocking parsing for mail hosts preceding mailchannels in the Receive headers.

For a second spamcop account, used only for quickreporting, I have not been able to add mailchannels to the mailhosts at all, with the only options being the dreamhost mail servers after specifying the standard name 'mailchannels'.

[petzl]

50 minutes ago, ewv said:

Adding mailchannels to mailhosts was confirmed in mailhosts, with no change in parsing behavior.  Parsing submissions have been only after Mailhosts was updated.

Would help if you could send a Tracking URL which is at top of parse BEFORE you submit spam
example
Here is your TRACKING URL - it may be saved for future reference:
https://www.spamcop.net/sc?id=z6690533908ze72fd31a4dff786edaf29eccae16c308z

[ewv]

Another example:

https://www.spamcop.net/sc?id=z6690587707z0afbb907bf385a3a5839c4d16a400f48z

This has not been reported so as to not duplicate.

[petzl]

1 hour ago, ewv said:

Another example:

https://www.spamcop.net/sc?id=z6690587707z0afbb907bf385a3a5839c4d16a400f48z

This has not been reported so as to not duplicate.

https://www.spamcop.net/w3m?action=checkblock&amp;ip=163.172.137.93

spam is bombing the world fake email addresses included
199.10.31.238 is a cloud account possibly compromised? 

[ewv]

All of my incoming mail at dreamhost now has these mailchannels headers inserted, which blocks spamcop parsing to find the source.  Submitting any incoming mail to the spamcop parser results in hanging on mailchannels Received headers, and the parser "finds" networking@carbon60.com (mailchannels) as the reporting address.  I have tested this on random non-spam incoming mail (which is not reported). The mailchannels headers make finding and reporting spam impossible, except that mailchannels takes credit for the spam and its headers are in fact responsible for protecting spammers from being reported.

Dreamhost also funnels all outgoing mail to mailchannels to intercept and scan.  Aside from the privacy problem (echoing Google mail surveillance), this results in occasional, to an unknown degree, random outgoing mail being disparaged as "junk" in mailchannels headers, which in turn sometimes causes the perfectly valid mail to bounce or be diverted into a receiver's spam folder.  But that is a different problem than the one with incoming mail and the disruption of spamcop parsing, which is a new problem.  I don't know if this mess is caused by dreamhost, mailchannels, the spamcop mailhosts system, or some combination.  I have reported it to dreamhost but am still waiting; they are very slow and the first rounds of their eventual 'responses' are usually oblivious to the problem reported.

[gnarlymarley]

8 hours ago, ewv said:

Another example:

https://www.spamcop.net/sc?id=z6690587707z0afbb907bf385a3a5839c4d16a400f48z

This has not been reported so as to not duplicate.

Hmmm, I noticed your second line does not properly match the first one.  Specifically the "by 0.0.0.0:2500" section does not match a mailchannels line of "inbound-egress-6.mailchannels.net".  Something is strange where the headers do not see to match up.  If nothing was lost, then this would be from an internal mailchannels user.

1: Received: from TrololoVPN ([UNAVAILABLE]. [163.172.137.93]) by 0.0.0.0:2500 (trex/5.18.10); Thu, 12 Nov 2020 21:07:09 +0000
No unique hostname found for source: 163.172.137.93
Possible forgery. Supposed receiving system not associated with any of your mailhosts
Will not trust this Received line.

 

[Ken Simpson]

6 hours ago, gnarlymarley said:

Hmmm, I noticed your second line does not properly match the first one.  Specifically the "by 0.0.0.0:2500" section does not match a mailchannels line of "inbound-egress-6.mailchannels.net".  Something is strange where the headers do not see to match up.  If nothing was lost, then this would be from an internal mailchannels user.

1: Received: from TrololoVPN ([UNAVAILABLE]. [163.172.137.93]) by 0.0.0.0:2500 (trex/5.18.10); Thu, 12 Nov 2020 21:07:09 +0000
No unique hostname found for source: 163.172.137.93
Possible forgery. Supposed receiving system not associated with any of your mailhosts
Will not trust this Received line.

 

Hi,

I work for MailChannels. We have a few internal MTA hops while processing incoming email in our inbound filtering service. At each hop, we add a Received header as per the RFCs. Some of the internal MTAs are on private IP addresses. The 0.0.0.0:2500 Received header is the first hop into our edge SMTP proxy. While it's not super cool to have an IP of 0.0.0.0, we don't believe it's inconsistent with the RFC.

But please, if we're doing it wrong, we want to fix this and would be keen to know what you all think is the correct way to add headers.

Thanks

Ken Simpson

MailChannels CEO

[petzl]

1 hour ago, Ken Simpson said:

Hi,

I work for MailChannels. We have a few internal MTA hops while processing incoming email in our inbound filtering service. At each hop, we add a Received header as per the RFCs. Some of the internal MTAs are on private IP addresses. The 0.0.0.0:2500 Received header is the first hop into our edge SMTP proxy. While it's not super cool to have an IP of 0.0.0.0, we don't believe it's inconsistent with the RFC.

But please, if we're doing it wrong, we want to fix this and would be keen to know what you all think is the correct way to add headers.

Thanks

Ken Simpson

MailChannels CEO

https://talosintelligence.com/reputation_center/support#faq3
Displaying behavior that is exceptionally bad, malicious, or undesirable
Has your/3 email servers listed as "poor" but not on any blocklists
So maybe you should read the above Cisco link, it may help?

you are listed on backscatterer (bounces)  the site may ask for free sign-up just close the dialog box no need to "sign-up"
https://mxtoolbox.com/Problem/Blacklist/BACKSCATTERER/?page=prob_blacklist&amp;ip=199.10.31.238&amp;link=button&amp;action=blacklist:199.10.31.238&amp;showLogin=1&amp;hidetoc=1&amp;reason=127.0.0.2

Edited November 13, 2020 by petzl

[ewv]

What do I have to do to get this fixed?

For one spamcop account I can't add mailchannels to Mailhosts at all.  "Mailchannels" as the standard name reverts to non-mailchannels servers at dreamhost.  (Dreamhost is using mailchannels to intercept and scan mail.)

For my other spamcop account mailchannels can be added to Mailhosts but periodically disappears and has to be added again. 

Even while mailchannels  is registered with Mailhosts it still does not work because of additional servers with ambiguous headers inserted by mailchannels into incoming email that prevents further parsing to the spam source.  Ken Simpson, from mailchannels, above says they are inserting internal servers with IPs like 0.0.0.0:2500 but the spamcop parser hangs at ambiguous IPs like https://www.spamcop.net/sc?id=z6691078615zd435ce8b004b579b41b019fa65a5d50ez

 

3: Received: from inbound-trex-2 (100-96-24-78.inbound-trex.inbound.svc.cluster.local [100.96.24.78]) by postfix-inbound-2.inbound.mailchannels.net (Postfix) with ESMTP id 0F77480112 for <x>; Mon, 16 Nov 2020 10:20:43 +0000 (UTC)

No unique hostname found for source: 100.96.24.78 

Meanwhile, after four days, dreamhost support is not responding.

What does it take to get this fixed?

[petzl]

3 hours ago, ewv said:

Meanwhile, after four days, dreamhost support is not responding.

What does it take to get this fixed?

Try sending message to SpamCop  service
https://mailsc.spamcop.net/fom-serve/cache/401.html
"Mailhosts" in "reason for contact"
In dialogue box next page :
Mail Hosts that need whitelisting in my Mailhosts
199.10.31.238,  inbound-egress-6.mailchannels.net
199.10.31.237 inbound-egress-5.mailchannels.net  ? I think
but there are more suspect the lot will be found by SpamCop?
postfix-inbound-0.inbound.mailchannels.net
postfix-inbound-3.inbound.mailchannels.net
postfix-inbound-4.inbound.mailchannels.net
postfix-inbound-5.inbound.mailchannels.net
postfix-inbound-6.inbound.mailchannels.net
postfix-inbound-7.inbound.mailchannels.net
postfix-inbound-11.inbound.mailchannels.net

Edited November 16, 2020 by petzl

[gnarlymarley]

40 minutes ago, petzl said:

Try sending message to SpamCop  service
https://mailsc.spamcop.net/fom-serve/cache/401.html
"Mailhosts" in "reason for contact"
In dialogue box next page :

Petzl, your link required authentication.  Did you mean https://www.spamcop.net/fom-serve/cache/401.html?

[petzl]

18 minutes ago, gnarlymarley said:

Petzl, your link required authentication.  Did you mean https://www.spamcop.net/fom-serve/cache/401.html?

Assumed EWV was a paid user?     not sure what is available for free service?  
But couldn't hurt? Same applies
https://www.spamcop.net/fom-serve/cache/401.html

Edited November 16, 2020 by petzl

[ewv]

I will try the spamcop link but aside from the missing n's in the headers of the form x-inbound-n.inbound.mailchannels.net headers, the parser has also been hanging on other kinds of mailchannels headers.  Also for one spamcop account the mailchannels entry in Mailhosts periodically disappears entirely, and for another spamcop account mailchannels cannot be added to Mailhosts at all.

[MarkA]

Any update for Dreamhost and Mailchannels here yet?  I'm a long time spamcop user but new to the forums for this issue and am having similar recent issues with my Dreamhost reporting.  And though I'm not experiencing a parser hang, the parser simply now says my mailhost is not configured correctly:
 

Hostname verified: inbound-egress-5.mailchannels.net
Possible forgery. Supposed receiving system not associated with any of your mailhosts
Will not trust this Received line.
Mailhost configuration problem, identified internal IP as source 
Mailhost:
Please correct this situation - register every email address where you receive spam
No source IP address found, cannot proceed.

...with headers like this sample, which also has the 0.0.0.0:2500 IP/port as the first receiving host as reported previously here for mailchannels.  It kind of seems like the the 0.0.0.0 IP IS the issue, as it's NOT in the mailhosts list obviously:

Return-Path: <web.kws@www.kenwoodstore.it>
X-Original-To: x
Delivered-To: x
Received: from postfix-inbound-0.inbound.mailchannels.net (inbound-egress-5.mailchannels.net [199.10.31.237])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by pdx1-sub0-mail-mx66.g.dreamhost.com (Postfix) with ESMTPS id 5C266A66AB
	for <x>; Sat,  2 Jan 2021 16:23:22 -0800 (PST)
Received: from postfix-inbound-0.inbound.mailchannels.net (localhost [127.0.0.1])
	by postfix-inbound-0.inbound.mailchannels.net (Postfix) with ESMTP id 13523C0201
	for <x>; Sun,  3 Jan 2021 00:23:22 +0000 (UTC)
Received: from inbound-trex-0 (100-97-252-78.inbound-trex.inbound.svc.cluster.local [100.97.252.78])
	by postfix-inbound-0.inbound.mailchannels.net (Postfix) with ESMTP id ABE37C01CC
	for <x>; Sun,  3 Jan 2021 00:23:21 +0000 (UTC)
Received: from www.kenwoodstore.it (www.kenwoodstore.it [46.183.234.170])
	by 0.0.0.0:2500 (trex/5.18.11);
	Sun, 03 Jan 2021 00:23:21 +0000
X-Message-ID: MMk7naTgSUkn2DtiwRHLscNL
Authentication-Results: inbound.mailchannels.net;
 spf=none smtp.mailfrom=web.kws@www.kenwoodstore.it;
 dkim=none;
 dmarc=none
Received-SPF: none (inbound-dmarc-755b7f964d-wl2d2: domain of
 www.kenwoodstore.it does not provide an SPF record) client-ip=46.183.234.170;
 envelope-from=web.kws@www.kenwoodstore.it; helo=www.kenwoodstore.it;
Received: by www.kenwoodstore.it (Postfix, from userid 504)
	id 5EF7B22445; Sun,  3 Jan 2021 01:23:16 +0100 (CET)
To: <x>
Subject: <x>
X-PHP-Originating-scri_pt: 504:Sendmail.php
From: JVCStore Customer Care <info@jvcstore.it>
Date: Sun, 03 Jan 2021 00:23:16 +0000
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
MIME-Version: 1.0

I had a different original mailhost configuration that worked for a year or so at Dreamhost but started showing a bunch of spam sourced from networking@carbon60.com (mailchannels) as the reporting address (I was unaware of the apparent Dreamhost change).  I started getting enough of these, unaware that Dreamhost was now associated with mailchannels, that I actually setup a filter at Dreamhost looking for the mailchannels IP addresses in the headers and auto-forwarded to spamcop for reporting.  This resulted in a nasty loop with what was probably thousands of reports being submitted, and upon an error during parsing, spamcop sent me an email response which also had those same mailchannels IP addresses in them, which reported again.  It used up all of my spamcop fuel/credits I had and after three days of no emails making to my inbox, I realized the mistake and unwound it all.

It was then that I reconfigured the Dreamhost mailhosts to current, which doesnt work at all now due to the above.

My current updated mailhosts config list now includes:

inbound.mailchannels.net
postfix-inbound-0.inbound.mailchannels.net
postfix-inbound-1.inbound.mailchannels.net
postfix-inbound-2.inbound.mailchannels.net
postfix-inbound-3.inbound.mailchannels.net
postfix-inbound-4.inbound.mailchannels.net
postfix-inbound-5.inbound.mailchannels.net
postfix-inbound-6.inbound.mailchannels.net
postfix-inbound-7.inbound.mailchannels.net
postfix-inbound-9.inbound.mailchannels.net
postfix-inbound-11.inbound.mailchannels.net

Thanks

Edited January 3, 2021 by MarkA

[petzl]

18 hours ago, MarkA said:

Any update for Dreamhost and Mailchannels here yet?  I'm a long time spamcop user but new to the forums for this issue and am having similar recent issues with my Dreamhost reporting.  And though I'm not experiencing a parser hang, the parser simply now says my mailhost is not configured correctly:

Just login to SpamCop click the tag mailhosts delete Dreamhost and Mailchannels (scroll down to "Delete Host")
Afterwards resend. Allow a hour? before resending just in case SpamCop is a bit slow in the taking.

 

Edited January 4, 2021 by petzl

[MarkA]

On 1/3/2021 at 2:23 PM, petzl said:

Just login to SpamCop click the tag mailhosts delete Dreamhost and Mailchannels (scroll down to "Delete Host")
Afterwards resend. Allow a hour? before resending just in case SpamCop is a bit slow in the taking.

Sorry, but it's not clear here why I would want to delete my mailhost entry to solve for this?  All of the above server names I listed are for a single mail host entry.  Just to validate though, I did dump that mail host and attempted to resubmit a spam entry.  It failed as I expected with the "system not associated" error, plus the original "internal IP as source" errors:
 

Possible forgery. Supposed receiving system not associated with any of your mailhosts
Will not trust this Received line.
Mailhost configuration problem, identified internal IP as source
Mailhost:
Please correct this situation - register every email address where you receive spam
No source IP address found, cannot proceed.

And now when I attempt to re-add the missing host I'm getting the error:

Host pdx1-sub0-mail-mx1.g.dreamhost.com (checking ip) = 64.90.62.163
Sorry, SpamCop has encountered errors:

The email sample you submitted for <x>
appears to traverse more than one domain.  
Please ensure that you configure each mailhost individually and in order.

The error also had the "Proceed here:" URL, which then resulted in a subsequent 500 error.

The host-add validation email headers which generated the above validation error look like this (less email addresses removed):
 

Return-Path: <x@admin.spamcop.net>
X-Original-To: <x>
Delivered-To: x21240582@pdx1-sub0-mail-mx1.g.dreamhost.com
Received: from inbound-egress-6.mailchannels.net (inbound-egress-6.mailchannels.net [199.10.31.238])
	by pdx1-sub0-mail-mx1.g.dreamhost.com (Postfix) with ESMTP id 0717CABF45
	for <x>; Mon,  4 Jan 2021 20:09:29 -0800 (PST)
Received: from postfix-inbound-1.inbound.mailchannels.net (localhost [127.0.0.1])
	by postfix-inbound-1.inbound.mailchannels.net (Postfix) with ESMTP id BDE04C0199
	for <x>; Tue,  5 Jan 2021 04:09:29 +0000 (UTC)
Received: from inbound-trex-0 (100-97-252-78.inbound-trex.inbound.svc.cluster.local [100.97.252.78])
	by postfix-inbound-1.inbound.mailchannels.net (Postfix) with ESMTP id 99C89C0156
	for <x>; Tue,  5 Jan 2021 04:09:29 +0000 (UTC)
Received: from prod-sc-www01.spamcop.net (vmx.spamcop.net [184.94.240.112])
	by 0.0.0.0:2500 (trex/5.18.11);
	Tue, 05 Jan 2021 04:09:29 +0000

It's not clear here what constitutes traversing more than one domain, unless it's having issues with either the 0.0.0.0 IP or the handoff from mailchannels to dreamhost, and then my final email address in those headers is neither of those, being a hosted domain at Dreamhost.

So from bad to worse now.  I don't have any forwarding between email accounts as part of this.

Thanks.

[petzl]

1 hour ago, MarkA said:

It's not clear here what constitutes traversing more than one domain, unless it's having issues with either the 0.0.0.0 IP or the handoff from mailchannels to dreamhost, and then my final email address in those headers is neither of those, being a hosted domain at Dreamhost.

So from bad to worse now.  I don't have any forwarding between email accounts as part of this.

Thanks.

Seemed to me your Mail host had changed. It was not working at anyrate
Log into your SpamCop account
Go to preferences 
Put in a working email address, if need be set up a Gmail one
Then try to set up your mailhosts again
 

Edited January 5, 2021 by petzl

[MarkA]

8 hours ago, petzl said:

Put in a working email address, if need be set up a Gmail one
Then try to set up your mailhosts again

Already done that.  I have several other mail hosts for other providers that have been working fine here for many years, and when one changes or I get a new one, I add/update/delete without issue.  This issue seems to be unique to the current mailchannels servers setup, and there's really not much more detail I can lay out here.  Lots of previous detail above that I've provided that's not been commented on.  So my questions remain: Is there anything in the current headers, host server, etc. that appears to be invalid or actually traversing domains as listed in the spamcop validation message, etc. Is spamcop having issues with the 0.0.0.0 initial hop IP address? 

If there are obvious issues with the headers, it seems that the mail provider needs to fix.  If everything looks valid, either there's a spamcop bug here, or I'm still doing something wrong, which unless something has changed here, doesn't seem likely or at least obvious at this point.  And simply following the spamcop provided "proceed here" URL during validation after the "traversing multiple domains" error, which results in an HTTP 500 server error that I detailed above would seem to indicate at least some issues exist on the spamcop side of things.

[petzl]

7 hours ago, MarkA said:

If there are obvious issues with the headers, it seems that the mail provider needs to fix.

Try
deputies[AT]SpamCop[DOT]net
First look at preferences tab select
Report Handling Options
Then check "Enable quick data reports" should be checked
Quick Data Reports
Enable quick data reports
Disable quick data reports

You still may need permission to use this, it was turned off some years ago because of to much errant use. 
My spam is low and prefer to copy and paste spam headers/body, and follow links to send abuse complaint to registrar

Edited January 5, 2021 by petzl

[MarkA]

Still not resolved, but an update for anybody still following this...  I sent a request to spamcop admin and got a response from SpamCop/Richard.  It looks like the 0.0.0.0 IP is the cause of the issue as I had guessed, but also Richard identified IANA-reserved shared IPs (100.96.84.23, 100.97.13.101) being used on the MailChannels hops which may be contributing to it.

Responses from Richard, referring to headers from some subsequent tests with this same host:

Quote

 

On 1/13/2021 07:57, SpamCop/Richard wrote:
I got the mailhost worked out in your account, but you still won't be able to report spam received on that host. The problem is your mail host is receiving mail as 0.0.0.0, then passing it internally using a iana reserved IP, 100.96.84.23. The stalls the parsing at your internal network.

2: Received: from inbound-trex-2
(100-97-13-101.inbound-trex.inbound.svc.cluster.local [100.97.13.101])
by postfix-inbound-4.inbound.mailchannels.net (Postfix) with ESMTP id
4516B40763 for <x>; Tue, 12 Jan 2021 13:48:38 +0000 (UTC)
No unique hostname found for source: 100.97.13.101
a2hosting.com received mail from sending system 100.97.13.101

3: Received: from mout-xforward.kundenserver.de
(mout-xforward.kundenserver.de [82.165.159.9]) (using TLSv1.2 with
cipher DHE-RSA-AES256-GCM-SHA384) by 0.0.0.0:2500 (trex/5.18.11); Tue,
12 Jan 2021 13:48:37 +0000
Hostname verified: mout-xforward.kundenserver.de

To fix this your host need to accept mail at the network edge using a
server set up with proper FQDN and Internet routed IP address

 

And then:

Quote

 

Very simply, if we can't chain test the hop we are not going to accept the hop as valid. Since we cannot confirm 0.0.0.0 received the mail, we can't accept (mout-xforward.kundenserver.de [82.165.159.9]) handed it off. (mout-xforward.kundenserver.de [82.165.159.9]) can't converse across the Internet with 0.0.0.0

 

So... It looks like MailChannels needs to do some configuration changes on their side. Hopefully Ken Simpson from above is still monitoring.  I will also be opening tickets at DreamHost and if I can, at MailChannels.

 

[MarkA]

Well, nobody gives a hoot about this.  I've spent several hours on it but can't do any more.  SpamCop admin won't state which RFCs are not compliant in the sending configuration headers, if any, and DreamHost doesn't think it's an issue after working with them.  So here we are. It's broken some place but nobody wants to take ownership, see it through and fix it.  SpamCop doesn't work any more with DreamHost.  Glad I didn't renew my paid account here. 

Done.

[gnarlymarley]

22 hours ago, MarkA said:

It's broken some place but nobody wants to take ownership, see it through and fix it.  SpamCop doesn't work any more with DreamHost.

You may want to strip off the "bad" received record and then submit.  That should get you past the point where SpamCop has the problem.

[MarkA]

On 1/20/2021 at 7:17 PM, gnarlymarley said:

You may want to strip off the "bad" received record and then submit.  That should get you past the point where SpamCop has the problem.

Thanks @gnarlymarley, that does seem to work if I modify and dump the bad record. 

Interesting though... Now MailChannels has replaced the 0.0.0.0 initial IP with another IANA reserved/shared IP (at least it looks like maybe they're trying to make it a bit better).  I can add the updated mailhost to my account successfully now, but if I don't still modify that first record, it now wants to report to devnull with the IANA IP:
 

Re: 100.96.6.15 (Administrator of network where email originates)
To: abuse#iana.org@devnull.spamcop.net 

Anyway, some progress and I'm not dead in the water any more at least.  Thanks again.