Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to setup our website portal to send registration confirmation emails to customers who sign up (its a simple message containing a link that confirms the email of the user).

Everything is nice and working great, users get the emails okey; however, for users the email goes directly to Spam folder.

I need to add that I have spend 4 days reading every single forum posting on the subject and have implemented every hint and suggestion possible (note: I am not new to system administration, so I can assure you the time spent was digging rather than learning).

To summarize:

  • The sending IP is
  • There is a proper DNS and rDNS/PTR setup
  • The IP is not listed in any of the 100+ black lists I have checked online
  • The domain has proper MX entries setup (note: the incoming mail servers run on different IP ... can this be a problem? In theory it shouldn't)
  • The postmaster and abuse addresses are setup.
  • DomainKey is implemented and verified working
  • DKIM is implemented and verified working
  • SPF is implemented and verified working
  • We have signed up for Yahoo and Hotmail Loopback Feed programs
  • Here is the site that users Opt-in:
  • I have filled the bulk sender form for Yahoo (it fixed the issue for 3-4 days, but it came back - more on it later)
  • Since we are in a test phase, it is extremely unlikely that any of the users actually mark an email as spam (they are mostly friends) and the nature of the emails are not marketing/ads
  • Checked SMTP replies from Yahoo, first few days, it included some temporary deferrals but after I filled the forms and signed up with them, it went away.
  • Tested a few automatic checkers including, all seem good/green:

Three questions I have are:

  1. Any idea what am I missing?
  2. Someone from Yahoo replied to me that:

    Emails from the mail server(s) you are using have recently become de-prioritized due to potential issues with its mailings.

    These de-prioritizations were temporary but may be re-triggered if the sending IP profile continues to be poor. Typically, de-prioritizations are triggered by bad individual sender or MAIL FROM profiles.

After asking for more details, they said they can not provide any further information!!

  1. Yahoo doesn't show the secure key in front of the email ... Even if it is assumed spam, shouldn't it display the source authenticity? In another account that a message from this address is marked as "not Spam", it shows the key okey ...

Here is the delivery log from postfix:

Oct 18 00:59:25 mgmt postfix/smtp[4321]: 063E0B988A6: to=<>,[]:25, delay=1.6, delays=0.11/0.01/0.61/0.92, dsn=2.0.0, status=sent (250 ok dirdel)

Here is the message header from Yahoo:

From TELTUB Mon Oct 18 04:59:23 2010
X-Apparently-To: via; Sun, 17 Oct 2010 21:59:25 -0700
Return-Path: <>
Received-SPF: pass ( domain of designates as permitted sender)
X-YMailISG: HGiMWDwcZAr2nMseAcs8EMjEoTTXRB5jVgymRipvWi77dSrO
X-Originating-IP: []
Authentication-Results:; domainkeys=pass (ok);; dkim=pass (ok)
Received: from  (HELO (
  by with SMTP; Sun, 17 Oct 2010 21:59:25 -0700
Received: from (localhost.localdomain [])
 by (Postfix) with ESMTP id DF46118E81BB
 for <>; Mon, 18 Oct 2010 00:59:23 -0400 (EDT)
X-DomainKeys: Sendmail DomainKeys Filter v1.0.2 063E0B988A6
DomainKey-Signature: a=rsa-sha1; s=teltubdk;; c=simple; q=dns;
X-DKIM: Sendmail DKIM Filter v2.8.3 063E0B988A6
DKIM-Signature: v=1; a=rsa-sha1; c=simple/simple;;
 s=teltubdkim; t=1287377964; bh=xiqqKdrY0J4R8qUgsW9WMXUKnak=;
Content-Type: text/html; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: "TELTUB" <>
Subject: This is just a test
Message-Id: <>
Date: Mon, 18 Oct 2010 00:59:23 -0400 (EDT)
Content-Length: 111
share|improve this question
up vote 1 down vote accepted

FYI, I found the answer! The problem was that DKIM signing was still at test mode ('t=y' in the DNS entry). I redid the whole thing with a new IP and got the same results. But noticed that the DKIM signature generation tool that I use, leaves a 't=y' in the middle of the signature. Notice that I removed t=y earlier from the policy entry, but that didn't do the trick:

teltubdkim._domainkey IN TXT "v=DKIM1; g=*; k=rsa; t=y; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtMbAffP/NxX4JcglM+1G2M6xB/va6k1pZijAgZxRKXbbzACUdbSv0MFip5TAAFyZkH4VIUgUq+BAgbAzLZOBEB0SZu2uDb87XMj1acvSOVs//QpUDnbmaLjz4I7HGCY70jZtjFzdEt42730bXJ6eoK1zTGHAx3KLtFFkurHJVXwIDAQAB" ; ----- DKIM teltubdkim for _ssp.teltubdkim._domainkey TXT "dkim=unknown"

Be extra careful ...

share|improve this answer

Looks like you've got the right stuff set up at your end, and the headers you've published show that DomainKeys and SPF settings are acceptable. It's important to remember that most spam systems work by totalling a variety of scores. Including Google apps in your list of senders probably is not helping this score. And is a very large netmask. Any chance of making it more specific?

The things nobody can tell from the headers you've supplied are what Yahoo's bayesian filters hold - nor the rate at which you send emails. In the case of the latter there's several milters for sendmail (which may work with Postfix) but I'd suggest having a look at policyd

In terms of the content you send - its a lot more tricky to say whether that's a contributory factor. Certainly its not an easy thing to test in the absence of DSN failures to identify how to recreate the problem on demand.

share|improve this answer
I have run a few test with content. Conclusion: If the message is a simple English text without links and non-HTML format, or if it is less than say 50 characters, it goes through, but as soon as it gets larg, or as soon as I drop a non-dictionary word like "teltub" (the name of the company) in there, it goes to spam. – Ehsan Oct 18 '10 at 18:55

What happens you try to send mail to from It should work, even if it goes to the bit bucket. Also ensure that both abuse and postmaster addresses are valid.

share|improve this answer
noreply/postmaster/abuse are all valid emails. noreply wasn't valid a few weeks ago, but to eliminate any possibility I added it and didn't change anything. You might be interested to know that I reviewed server logs to see if there has been any attempt from Yahoo to verify these addresses. There wasn't. – Ehsan Oct 18 '10 at 18:52
Unless you are logging connections, or other events prior to Data, you aren't likely to see callback traffic. A quit is done after the recipient is verified. – BillThor Oct 19 '10 at 4:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.