1

I'm making a mail-list with Mailman on Ubuntu Server. The main domain of my server is DOMAIN1.FR, but my mail-list is [email protected].

I think I've made all things to do but my emails are tagged as SPAM.

This is the Port25.com analysis of a mail received when I send a mail from [email protected] to [email protected]:

==========================================================
Summary of Results
==========================================================
SPF check:          pass
DomainKeys check:   neutral
DKIM check:         pass
DKIM check:         fail
SpamAssassin check: ham

==========================================================
Details:
==========================================================

HELO hostname:  DOMAIN1.fr
Source IP:      [MY IP]
mail-from:      [email protected]

----------------------------------------------------------
SPF check details:
----------------------------------------------------------
Result:         pass
ID(s) verified: [email protected]
DNS record(s):
    DOMAIN2.fr. SPF (no records)
    DOMAIN2.fr. 360 IN TXT "v=spf1 mx a ptr ?all"
    DOMAIN2.fr. MX (no records)
    DOMAIN2.fr. 360 IN A [MY IP]

----------------------------------------------------------
DomainKeys check details:
----------------------------------------------------------
Result:         neutral (message not signed)
ID(s) verified: [email protected]
DNS record(s):

----------------------------------------------------------
DKIM check details:
----------------------------------------------------------
Result:         pass (matches Sender: [email protected])
ID(s) verified: header.d=DOMAIN2.fr
Canonicalized Headers:
    sender:"ticsve"'20'<[email protected]>'0D''0A'
    content-transfer-encoding:base64'0D''0A'
    content-type:text/plain;'20'charset="utf-8"'0D''0A'
    list-subscribe:<http://DOMAIN2.fr/cgi-bin/mailman/listinfo/ticsve>,'20'<mailto:[email protected]?subject=subscribe>'0D''0A'
    list-help:<mailto:[email protected]?subject=help>'0D''0A'
    list-post:<mailto:[email protected]>'0D''0A'
    list-archive:<http://DOMAIN2.fr/pipermail/ticsve/>'0D''0A'
    list-unsubscribe:<http://DOMAIN2.fr/cgi-bin/mailman/options/ticsve>,'20'<mailto:[email protected]?subject=unsubscribe>'0D''0A'
    list-id:<ticsve.DOMAIN2.fr>'0D''0A'
    subject:[ticsve]'20'Bon'20'encore'20'un'20'test'0D''0A'
    to:[email protected]'0D''0A'
    message-id:<CAGXJdLwio8yKVo2hwN_Bx5=D4YPKN4hUvqQsNosDfWyTomsV1w@mail.gmail.com>'0D''0A'
    date:Thu,'20'13'20'Oct'20'2016'20'22:30:27'20'+0200'0D''0A'
    from:Valentin'20'A'20'<[email protected]>'0D''0A'
    mime-version:1.0'0D''0A'
    dkim-signature:v=1;'20'a=rsa-sha256;'20'q=dns/txt;'20'c=relaxed/relaxed;'20'd=DOMAIN2.fr;'20's=20140919;'20'h=Sender:Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Subject:To:Message-ID:Date:From:MIME-Version;'20'bh=gVxflKxOx84RES68MJK1T0Jgiq+M2zBArewFdZ2y/Ek=;'20'b=;

Canonicalized Body:
    xxxxx


DNS record(s):
    20140919._domainkey.DOMAIN2.fr. 360 IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDckpRYnhPuLw+AL+GMClusPLOxX216nXI/RwEJ7Lj79dwxo67YEqZz3RQM0vcmpsjAl008tLORilGy+n6z0DVfPFeVGNVYriGXGKTSnFiJhZs73Q4fX6/LlnY/a8DVK78d8OSk5vC7axDBoA7kiY0/E7VhnvQNfC93zRuG/cKqCwIDAQAB"

Public key used for verification: 20140919._domainkey.DOMAIN2.fr (1024 bits)

NOTE: DKIM checking has been performed based on the latest DKIM specs
(RFC 4871 or draft-ietf-dkim-base-10) and verification may fail for
older versions.  If you are using Port25's PowerMTA, you need to use
version 3.2r11 or later to get a compatible version of DKIM.

----------------------------------------------------------
DKIM check details:
----------------------------------------------------------
Result:         fail (wrong body hash: expected gVxflKxOx84RES68MJK1T0Jgiq+M2zBArewFdZ2y/Ek=)
ID(s) verified:
Canonicalized Headers:
    mime-version:1.0'0D''0A'
    from:Valentin'20'A'20'<[email protected]>'0D''0A'
    date:Thu,'20'13'20'Oct'20'2016'20'22:30:27'20'+0200'0D''0A'
    message-id:<CAGXJdLwio8yKVo2hwN_Bx5=D4YPKN4hUvqQsNosDfWyTomsV1w@mail.gmail.com>'0D''0A'
    subject:[ticsve]'20'Bon'20'encore'20'un'20'test'0D''0A'
    to:[email protected]'0D''0A'
    content-transfer-encoding:base64'0D''0A'
    dkim-signature:v=1;'20'a=rsa-sha256;'20'c=relaxed/relaxed;'20'd=gmail.com;'20's=20120113;'20'h=mime-version:from:date:message-id:subject:to'20':content-transfer-encoding;'20'bh=X1vyuq7wb47KGjR/trjfifs4kjrgQmTHo+yckBQhX5Y=;'20'b=

Canonicalized Body:
    xxxxxxxxxx


DNS record(s):

NOTE: DKIM checking has been performed based on the latest DKIM specs
(RFC 4871 or draft-ietf-dkim-base-10) and verification may fail for
older versions.  If you are using Port25's PowerMTA, you need to use
version 3.2r11 or later to get a compatible version of DKIM.

----------------------------------------------------------
SpamAssassin check details:
----------------------------------------------------------
SpamAssassin v3.4.0 (2014-02-07)

Result:         ham  (-1.4 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 0.0 FREEMAIL_FROM          Sender email is commonly abused enduser mail provider
                            (valentin.A[at]gmail.com)
 0.5 RCVD_IN_SORBS_SPAM     RBL: SORBS: sender is a spam source
                            [209.85.215.44 listed in dnsbl.sorbs.net]
 0.0 DKIM_ADSP_CUSTOM_MED   No valid author signature, adsp_override is
                            CUSTOM_MED
 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
                            domains are different
-0.0 SPF_PASS               SPF: sender matches SPF record
-1.9 BAYES_00               BODY: Bayes spam probability is 0 to 1%
                            [score: 0.0000]
 0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 0.0 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom
                             freemail headers are different

==========================================================
Original Email
==========================================================

Return-Path: <[email protected]>
Received: from DOMAIN1.fr ([MY IP]) by verifier.port25.com id hvvng220i3gn for <[email protected]>; Thu, 13 Oct 2016 16:30:57 -0400 (envelope-from <[email protected]>)
Authentication-Results: verifier.port25.com; spf=pass [email protected]
Authentication-Results: verifier.port25.com; domainkeys=neutral (message not signed) [email protected]
Authentication-Results: verifier.port25.com; dkim=pass (matches Sender: [email protected]) header.d=DOMAIN2.fr
Authentication-Results: verifier.port25.com; dkim=fail (wrong body hash: expected gVxflKxOx84RES68MJK1T0Jgiq+M2zBArewFdZ2y/Ek=)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=DOMAIN2.fr; s=20140919;
        h=Sender:Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Subject:To:Message-ID:Date:From:MIME-Version; bh=gVxflKxOx84RES68MJK1T0Jgiq+M2zBArewFdZ2y/Ek=;
        b=PzoqeM78DETVW92AhKDsxCNLG65dL4teyUFgGs+1sc/uJngXeNsat91feF751r6PsdYOalaY12FEkNamUPDJ6jLxPAkzu00FDTb1CJYLADPiNdZ6w837JOLnrvIJ3X+L8jsMC3HYg07p6eqE0Sra35+XufQipa5Ddy0FRPe3rf4=;
Received: from localhost ([127.0.0.1] helo=ksxxxxxx.kimsufi.com)
        by DOMAIN1.fr with esmtp (Exim 4.82)
        (envelope-from <[email protected]>)
        id 1bumeU-0007Ry-IE; Thu, 13 Oct 2016 22:30:54 +0200
Received: from mail-lf0-f44.google.com ([209.85.215.44])
 by DOMAIN1.fr with esmtp (Exim 4.82)
 (envelope-from <[email protected]>) id 1bumeS-0007Rr-BJ
 for [email protected]; Thu, 13 Oct 2016 22:30:52 +0200
Received: by mail-lf0-f44.google.com with SMTP id b81so151665357lfe.1
 for <[email protected]>; Thu, 13 Oct 2016 13:30:53 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=mime-version:from:date:message-id:subject:to
 :content-transfer-encoding;
 bh=xxxxxx
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20130820;
 h=x-gm-message-state:mime-version:from:date:message-id:subject:to
 :content-transfer-encoding;
 bh=xxxxx
X-Gm-Message-State: xxxx
X-Received: by 10.25.38.149 with SMTP id xxxx;
 Thu, 13 Oct 2016 13:30:47 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.25.196.213 with HTTP; Thu, 13 Oct 2016 13:30:27 -0700 (PDT)
From: Valentin A <[email protected]>
Date: Thu, 13 Oct 2016 22:30:27 +0200
Message-ID: <CAGXJdLwio8yKVo2hwN_Bx5=D4YPKN4hUvqQsNosDfWyTomsV1w@mail.gmail.com>
To: [email protected]
Subject: [ticsve] Bon encore un test
X-BeenThere: [email protected]
X-Mailman-Version: 2.1.16
Precedence: list
List-Id: <ticsve.DOMAIN2.fr>
List-Unsubscribe: <http://DOMAIN2.fr/cgi-bin/mailman/options/ticsve>,
 <mailto:[email protected]?subject=unsubscribe>
List-Archive: <http://DOMAIN2.fr/pipermail/ticsve/>
List-Post: <mailto:[email protected]>
List-Help: <mailto:[email protected]?subject=help>
List-Subscribe: <http://DOMAIN2.fr/cgi-bin/mailman/listinfo/ticsve>,
 <mailto:[email protected]?subject=subscribe>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
Errors-To: [email protected]
Sender: "ticsve" <[email protected]>

xxxxx
5
  • The real email addresses and domains are all available in the Base64 encoded blobs. Oct 13, 2016 at 22:01
  • 1
    DKIM fails, I'd start there.
    – Tim
    Oct 14, 2016 at 0:25
  • @Tim The weird thing is that my server is signed ( DKIM check: pass ) but there is another DKIM record from gmail and I can't sign it since I have no access to gmail records... :)
    – Valentin A
    Oct 14, 2016 at 11:20
  • Post your actual domains if you want further help
    – Tim
    Oct 14, 2016 at 19:03
  • @Tim The domains are valentin-a.fr (hostname of the server, which appears in HELO even if I would prefere a "dynamic" hostname...) and mastersime.fr (domain of the mail-list)
    – Valentin A
    Oct 16, 2016 at 10:15

1 Answer 1

2
  1. You email is being DKIM signed twice, one passing, one failing. It's looks like it's first being signed by GMAIL then your mail server signs it (But the body of the message is altered, causing it to original GMAIL DKIM signature to fail. Since you "xxxxxx" the Canonicalized Body out in the report from port 25, it's hard for anyone to point out what changed.
  2. Next take a look at the Spam Assassin report:

    RBL: SORBS: sender is a spam source [209.85.215.44 listed in dnsbl.sorbs.net]

You're listed in SORBS RBL which is another reason why your email might be being flagged as SPAM. RBL = Real-Time Blacklist - You should monitor that with a Blacklist Monitoring tool.

  1. The Port25 report is an excellent tool, but it only checks authentication methods used in your email, It won't detect configuration issues, like a true email tester, which can also cause your email to go to spam.
4
  • Thanks for your answer ! I'm looking at the email tester.
    – Valentin A
    Oct 15, 2016 at 15:21
  • About the blacklist : The weird thing is that i'm not the owner of 209.85.215.44 ! This is the IP of... Google... ( tcpiputils.com/browse/ip-address/209.85.215.44 ) Mine is 37.187.21.160 and I don't think i'm blacklisted...
    – Valentin A
    Oct 15, 2016 at 15:24
  • Your IP is on a few minor Blacklists. That's one of the issues when mailing through other peoples IP's. You really can't control there reputation. SORBS is a big one, a lot of places use them.
    – Henry
    Oct 15, 2016 at 18:11
  • When there is a "direct send" from my server to gmail the email doesn't fall in SPAM, so I guess my reputation isn't so bad... But I have no control on the reputation of the Google IPs and I really don't know how to resolve this issue... Thanks for the link anyway ! I'm looking at it !
    – Valentin A
    Oct 16, 2016 at 10:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .