Dear Proximus Email Support,
We are requesting a technical investigation into two separate issues affecting user-requested Worldline account-creation/authentication emails sent from no-reply@welcome.worldline-solutions.com to @skynet.be mailboxes through Amazon SES in eu-west-1: intermittent delivery delays and one message classified as phishing and placed in the junk folder.
Delivery delays
On 20 October 2026, our investigation recorded the following timings. All times below are CEST (UTC+02:00):
1. Delayed morning — mailbox A
SES mail timestamp: 11:17:50.867; recipient-server acceptance: 12:52:17.993
Elapsed: 1h 34m 27.126s
Recipient MX: mx201tcp.skynet.be (194.78.73.197)
Proximus SMTP message reference: 12021143
2. Fast comparison — mailbox B
SES mail timestamp: 20:48:41.873; recipient-server acceptance: 20:48:42.521
Elapsed: 0.648s
Recipient MX: mx101tcp.skynet.be (194.78.73.133)
Proximus SMTP message reference: 11192420
3. Delayed evening — mailbox B
SES mail timestamp: 20:53:52.146; recipient-server acceptance: 21:09:58.423
Elapsed: 16m 6.277s
Recipient MX: mx201tcp.skynet.be (194.78.73.197)
Proximus SMTP message reference: 12087210
The two evening samples were sent to the same mailbox: one was accepted in under a second, while another approximately five minutes later took over 16 minutes. The delayed messages were eventually accepted with SMTP 250 responses.
An additional fast example on 22 October 2026 reached mx201tcp.skynet.be at 21:19:07 CEST, six seconds after its Date/DKIM-signing timestamp. Its last available internal Received header is 21:19:26 CEST. These are header-derived intervals, not a fresh SES processing-time measurement. The same receiving MX hostname appears in the earlier delayed examples, so it is not associated exclusively with slow delivery. The supplemental transport evidence is included in fast-comparison-20261022.txt.
The three SES-correlated durations above measure the interval between SES accepting the send request and delivery to the recipient mail server, not when the message became visible in the mailbox.[1] We have not established which system caused the delay. The impact is significant for time-sensitive authentication: the longest recorded delay exceeds 90 minutes, so even a 60-minute link-validity window would not cover that sample.
Suspected false-positive phishing classification
On 20 October 2026, the mailbox owner found another requested account-creation email in the junk folder, with the subject prefixed "[PHISHING] Create your new Worldline account". Its receiver headers explicitly recorded:
X-SKYNET-JUNK: true
X-VadeSecure-Verdict: phishing
X-VadeSecure-Score: 290
The same source recorded passing MAIL FROM SPF, DKIM and DMARC. The SES message ID is 010201a15aee5625-f2a14438-bd27-4d19-9b1c-88c2df94c155-000000; the sending IP was 54.240.4.1 and the receiving MX was mx201tcp.skynet.be. Its Date/signing timestamp was 22:08:51 CEST and the Skynet ingress header was 23:07:04 CEST, a header-derived gap of 58m13s that has not been independently corroborated with
Vertraging van inkomende mails
+4- Moderator
Dear, do you have an example of a Skynet email where this issue occurs?
Without one, I cannot create a ticket for the IT department to investigate this.
If you have an example, please provide it via the 'ticket' section in your forum profile.
Geert
You should add your email address in your forum profile not post it publicly.
Now it is in visible to anyone, especially those who have bad intentions and will gladly send you phishing mails or mass spam or ….
You can change your post within the hour of publishing. If not, I hope
Proximus is using Cisco Talos and Ironport for mail security. Based on the following message headers and diagnostic data
X-SKYNET-JUNK: true
X-VadeSecure-Verdict: phishing
X-VadeSecure-Score: 290
Vade is another type of email security. Either put in place by the customer who is having the problems or Proximus.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.