Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Recently Gmail has started marking emails sent directly from my server (using php mail()) as spam and I'm having problems trying to find the issue. If I send an exact copy of the same email from my email client it goes to the Gmail inbox. The emails are plain text, around 7 lines long and contain a URL link in plain text.

As the emails sent from my client are getting through fine I'm thinking that the content isn't the issue. It would be greatly appreciated if someone could take a look at the the following headers and give me some advice why the email from the server is being marked as spam.

Email from Server:


Delivered-To: mygmail@gmail.com
Received: by 10.49.98.228 with SMTP id el4csp101784qeb;
    Thu, 15 Nov 2012 14:58:52 -0800 (PST)
Received: by 10.60.27.166 with SMTP id u6mr2296595oeg.86.1353020331940;
    Thu, 15 Nov 2012 14:58:51 -0800 (PST)
Return-Path: >admin@mydomain.co.uk>
Received: from dom.mydomain.co.uk (dom.mydomain.co.uk. [xx.xx.xx.xx])
    by mx.google.com with ESMTPS id df4si17005013obc.50.2012.11.15.14.58.51
    (version=TLSv1/SSLv3 cipher=OTHER);
    Thu, 15 Nov 2012 14:58:51 -0800 (PST)
Received-SPF: pass (google.com: domain of admin@mydomain.co.uk designates xx.xx.xx.xx as permitted sender) client-ip=xx.xx.xx.xx;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of admin@mydomain.co.uk designates xx.xx.xx.xx as permitted sender) smtp.mail=admin@mydomain.co.uk; dkim=pass header.i=@mydomain.co.uk
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mydomain.co.uk; s=default;
    h=Date:Message-Id:Content-Type:Reply-to:From:Subject:To; bh=2RJ9jsEaGcdcgJ1HMJgQG8QNvWevySWXIFRDqdY7EAM=;
    b=mGebBVOkyUhv94ONL3EabXeTgVznsT1VAwPdVvpOGDdjBtN1FabnuFi8sWbf5KEg5BUJ/h8fQ+9/2nrj+jbtoVLvKXI6L53HOXPjl7atCX9e41GkrOTAPw5ZFp+1lDbZ;
Received: from grantw by dom.mydomain.co.uk with local (Exim 4.80)
    (envelope-from >admin@mydomain.co.uk>)
    id 1TZ8OZ-0008qC-Gy
    for mygmail@gmail.com; Thu, 15 Nov 2012 22:58:51 +0000
To: mygmail@gmail.com
Subject: Offer Accepted
X-PHP-Script: www.mydomain.co.uk/admin.php for xx.xx.xx.xx
From: My Name >admin@mydomain.co.uk>
Reply-to: admin@mydomain.co.uk
Content-Type: text/plain; charset=Windows-1251
Message-Id: >E1TZ8OZ-0008qC-Gy@dom.mydomain.co.uk>
Date: Thu, 15 Nov 2012 22:58:51 +0000
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - dom.mydomain.co.uk
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [500 500] / [47 12]
X-AntiAbuse: Sender Address Domain - mydomain.co.uk
X-Get-Message-Sender-Via: dom.mydomain.co.uk: authenticated_id: grantw/from_h

Email from client:


Delivered-To: mygmail@gmail.com
Received: by 10.49.98.228 with SMTP id el4csp101495qeb;
        Thu, 15 Nov 2012 14:54:49 -0800 (PST)
Received: by 10.182.197.8 with SMTP id iq8mr2351185obc.66.1353020089244;
        Thu, 15 Nov 2012 14:54:49 -0800 (PST)
Return-Path: >admin@mydomain.co.uk>
Received: from dom.mydomain.co.uk (dom.mydomain.co.uk. [xx.xx.xx.xx])
        by mx.google.com with ESMTPS id ab5si17000486obc.44.2012.11.15.14.54.48
        (version=TLSv1/SSLv3 cipher=OTHER);
        Thu, 15 Nov 2012 14:54:49 -0800 (PST)
Received-SPF: pass (google.com: domain of admin@mydomain.co.uk designates xx.xx.xx.xx as permitted sender) client-ip=xx.xx.xx.xx;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of admin@mydomain.co.uk designates xx.xx.xx.xx as permitted sender) smtp.mail=admin@mydomain.co.uk; dkim=pass header.i=@mydomain.co.uk
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mydomain.co.uk; s=default;
    h=Content-Transfer-Encoding:Content-Type:Subject:To:MIME-Version:From:Date:Message-ID; bh=bKNjm+yTFZQ7HUjO3lKPp9HosUBfFxv9+oqV+NuIkdU=;
    b=j0T2XNBuENSFG85QWeRdJ2MUgW2BvGROBNL3zvjwOLoFeyHRU3B4M+lt6m1X+OLHfJJqcoR0+GS9p/TWn4jylKCF13xozAOc6ewZ3/4Xj/YUDXuHkzmCMiNxVcGETD7l;
Received: from w-27.cust-7941.ip.static.uno.uk.net ([xx.xx.xx.xx]:1450 helo=[127.0.0.1])
    by dom.mydomain.co.uk with esmtpa (Exim 4.80)
    (envelope-from >admin@mydomain.co.uk>)
    id 1TZ8Ke-0001XH-7p
    for mygmail@gmail.com; Thu, 15 Nov 2012 22:54:48 +0000
Message-ID: >50A572BA.9020401@mydomain.co.uk>
Date: Thu, 15 Nov 2012 22:54:50 +0000
From: My Name >admin@mydomain.co.uk>
User-Agent: Postbox 3.0.6 (Windows/20121031)
MIME-Version: 1.0
To: mygmail@gmail.com
Subject: Offer Accepted
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - dom.mydomain.co.uk
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - mydomain.co.uk
X-Get-Message-Sender-Via: dom.mydomain.co.uk: authenticated_id: admin@mydomain.co.uk
share|improve this question

4 Answers 4

up vote 0 down vote accepted

A few things.

1) Make sure your mail server PTR record is set to reflect the same as your MX record, not the same as your server hostname.

2) Your IP address appears to be a WebsiteWelcome/HostGator IP address. I'd check with their support if you haven't already. Of course the IP could be an old IP address of theirs that they sold back to their host, and you just happened to get it.

3) If you're proficient with tcpdump or wireshark, you could try to packet capture the email as it goes out and get the response from the gmail server. That would help more than headers would.

4) Bear in mind that Gmail also treats email for every person differently because their spam filters know that what some people consider spam, others don't -- so it could very likely be that you've flagged something similar to what is coming from your server as spam (even though the content is the same as what you're sending through the mail client), and so gmail is picking up on that. I'd say to try using a different gmail email address to test that theory.

5) X-Get-Message-Sender-Via: dom.domainbrokerage.co.uk: authenticated_id: grantw/from_h The problem here is that the authenticated_id is not an email address. In cpanel, setup an dedicated email address that is not the master email account for the cpanel account.

6) X-PHP-Script: www.domainbrokerage.co.uk/admin.php for 95.172.231.27 Gmail may see this and block based on that but its just a hunch. If there's a possibility to remove that header, do so.

Hope some of these help.

share|improve this answer
    
Thanks for the response (and everyone elses). I'll have a look at each of these over the next few days. Point 4 is covered, as I've been having to create a new Gmail account for every test email I send to eliminate that problem! As it stands at the moment, I've managed to find a relevant Google contact form (a problem solving excercise in itself!!) So I've reverted back any changes I've made to the zone file and will see what they say. Will report back with anything. –  grantw Nov 16 '12 at 19:30
1  
An update on this. After trying pretty much everything, I was left with the X-PHP-Script: header. I removed this and the problem now appears to be fixed!! For anyone else having similar issues and wanting to remove this, you will need to rebuild apache/php with the Mail Headers option disabled. Apparently from php 5.3 onwards this can be disabled in php.ini - mail.add_x_header. Thanks all. –  grantw Nov 26 '12 at 2:59
    
Glad I could be of help. Its interesting to know that GMail filters X-PHP-Script mails to spam automatically. I wonder how many people are affected by this, as I'm sure there are many many people that use PHP's mail() function. –  Speeddymon Dec 16 '12 at 5:39

With a VPS, my guess would be a missing reverse DNS record (PTR). Note that you cant do this via your domain name zone file. You have to get your VPS host to add the record for you. I've had to raise a support ticket with the VPS provider in the past to get this done.

The reverse DNS lookup for your VPS's IP address should match the hostname that your mailserver says HELO with.

share|improve this answer
    
The PTR record was sorted when I got the server about a year ago, it is correct, I've made a couple of changes to the zone file though so not sure it will stay that way. Thanks for the response. –  grantw Nov 16 '12 at 3:45

There's a number of things I recommend doing:

  1. Use a tool such as http://mxtoolbox.com/ to check your MX records and also to make sure your sending mail server is setup properly
  2. As someone already mentioned, make sure that you have Reverse DNS setup for your sending mail server.
  3. If you have SPF or DKIM setup (it looks like you do), ensure that your sending mail server's IP address is included in your SPF records (it looks like this is already done, by examining your mail headers above).
  4. Make sure your sending mail server isn't on any black lists.
  5. Consider just pasting into this question your raw, unedited mail headers. IP addresses aren't that private, after all. Also, I think you forgot to mask 1 of your lines. If your IP address starts with 95.172, then I know who your ISP is (and if its true, that I can further confirm that you don't have RDNS setup properly - and this would definitely cause a problem). :)
share|improve this answer
    
Hi, I think reverse DNS is ok. DKIM is setup and SPF has the IP included. As far as I can see I'm not blacklisted. I have edited the original post to include the full headers. I've had a bit of a play with the zone file based on someone elses advice since I posted, that doesn't seem to have made a difference as of yet though. –  grantw Nov 16 '12 at 3:47
    
oh, and the 95. address is my home broadband IP. –  grantw Nov 16 '12 at 3:57
    
Do try mxtoolbox or a similar service. It will check a bunch of things for you. –  dunxd Nov 16 '12 at 13:14

By masking hostnames and IP addresses from your question, I think you are also masking the problem itself. There are still traces of what I must assume is your IP address/hostname in the question, which if I'm correct, looks very much like you are sending email from an ISPs pool of addresses. Many of these types of IP addresses appear on RBLs and are likely increasing the likelihood of your email being treated as spam.

share|improve this answer
    
Hi, Could you explain that a bit further please? I've just masked my servers IP address, my domain name and the gmail address, everything else is shown. This is a VPS with a dedicated IP address, I've checked and my IP doesn't appear to be blacklisted anywhere. –  grantw Nov 16 '12 at 0:13
    
Does YOUR server IP address show YOUR domain name when a reverse lookup is done with that address? –  Skaperen Nov 16 '12 at 2:25
    
Yes, it resolves to the host name eg. dom.mydomain.co.uk –  grantw Nov 16 '12 at 3:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.