2

Recently Gmail has started marking emails sent directly from my server (using php mail()) as spam and I'm having problems trying to find the issue. If I send an exact copy of the same email from my email client it goes to the Gmail inbox. The emails are plain text, around 7 lines long and contain a URL link in plain text.

As the emails sent from my client are getting through fine I'm thinking that the content isn't the issue. It would be greatly appreciated if someone could take a look at the the following headers and give me some advice why the email from the server is being marked as spam.

Email from Server:


Delivered-To: [email protected]
Received: by 10.49.98.228 with SMTP id el4csp101784qeb;
    Thu, 15 Nov 2012 14:58:52 -0800 (PST)
Received: by 10.60.27.166 with SMTP id u6mr2296595oeg.86.1353020331940;
    Thu, 15 Nov 2012 14:58:51 -0800 (PST)
Return-Path: >[email protected]>
Received: from dom.mydomain.co.uk (dom.mydomain.co.uk. [xx.xx.xx.xx])
    by mx.google.com with ESMTPS id df4si17005013obc.50.2012.11.15.14.58.51
    (version=TLSv1/SSLv3 cipher=OTHER);
    Thu, 15 Nov 2012 14:58:51 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates xx.xx.xx.xx as permitted sender) client-ip=xx.xx.xx.xx;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates xx.xx.xx.xx as permitted sender) [email protected]; dkim=pass [email protected]
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mydomain.co.uk; s=default;
    h=Date:Message-Id:Content-Type:Reply-to:From:Subject:To; bh=2RJ9jsEaGcdcgJ1HMJgQG8QNvWevySWXIFRDqdY7EAM=;
    b=mGebBVOkyUhv94ONL3EabXeTgVznsT1VAwPdVvpOGDdjBtN1FabnuFi8sWbf5KEg5BUJ/h8fQ+9/2nrj+jbtoVLvKXI6L53HOXPjl7atCX9e41GkrOTAPw5ZFp+1lDbZ;
Received: from grantw by dom.mydomain.co.uk with local (Exim 4.80)
    (envelope-from >[email protected]>)
    id 1TZ8OZ-0008qC-Gy
    for [email protected]; Thu, 15 Nov 2012 22:58:51 +0000
To: [email protected]
Subject: Offer Accepted
X-PHP-Script: www.mydomain.co.uk/admin.php for xx.xx.xx.xx
From: My Name >[email protected]>
Reply-to: [email protected]
Content-Type: text/plain; charset=Windows-1251
Message-Id: >[email protected]>
Date: Thu, 15 Nov 2012 22:58:51 +0000
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - dom.mydomain.co.uk
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [500 500] / [47 12]
X-AntiAbuse: Sender Address Domain - mydomain.co.uk
X-Get-Message-Sender-Via: dom.mydomain.co.uk: authenticated_id: grantw/from_h

Email from client:


Delivered-To: [email protected]
Received: by 10.49.98.228 with SMTP id el4csp101495qeb;
        Thu, 15 Nov 2012 14:54:49 -0800 (PST)
Received: by 10.182.197.8 with SMTP id iq8mr2351185obc.66.1353020089244;
        Thu, 15 Nov 2012 14:54:49 -0800 (PST)
Return-Path: >[email protected]>
Received: from dom.mydomain.co.uk (dom.mydomain.co.uk. [xx.xx.xx.xx])
        by mx.google.com with ESMTPS id ab5si17000486obc.44.2012.11.15.14.54.48
        (version=TLSv1/SSLv3 cipher=OTHER);
        Thu, 15 Nov 2012 14:54:49 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates xx.xx.xx.xx as permitted sender) client-ip=xx.xx.xx.xx;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates xx.xx.xx.xx as permitted sender) [email protected]; dkim=pass [email protected]
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mydomain.co.uk; s=default;
    h=Content-Transfer-Encoding:Content-Type:Subject:To:MIME-Version:From:Date:Message-ID; bh=bKNjm+yTFZQ7HUjO3lKPp9HosUBfFxv9+oqV+NuIkdU=;
    b=j0T2XNBuENSFG85QWeRdJ2MUgW2BvGROBNL3zvjwOLoFeyHRU3B4M+lt6m1X+OLHfJJqcoR0+GS9p/TWn4jylKCF13xozAOc6ewZ3/4Xj/YUDXuHkzmCMiNxVcGETD7l;
Received: from w-27.cust-7941.ip.static.uno.uk.net ([xx.xx.xx.xx]:1450 helo=[127.0.0.1])
    by dom.mydomain.co.uk with esmtpa (Exim 4.80)
    (envelope-from >[email protected]>)
    id 1TZ8Ke-0001XH-7p
    for [email protected]; Thu, 15 Nov 2012 22:54:48 +0000
Message-ID: >[email protected]>
Date: Thu, 15 Nov 2012 22:54:50 +0000
From: My Name >[email protected]>
User-Agent: Postbox 3.0.6 (Windows/20121031)
MIME-Version: 1.0
To: [email protected]
Subject: Offer Accepted
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - dom.mydomain.co.uk
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - mydomain.co.uk
X-Get-Message-Sender-Via: dom.mydomain.co.uk: authenticated_id: [email protected]

4 Answers 4

0

A few things.

1) Make sure your mail server PTR record is set to reflect the same as your MX record, not the same as your server hostname.

2) Your IP address appears to be a WebsiteWelcome/HostGator IP address. I'd check with their support if you haven't already. Of course the IP could be an old IP address of theirs that they sold back to their host, and you just happened to get it.

3) If you're proficient with tcpdump or wireshark, you could try to packet capture the email as it goes out and get the response from the gmail server. That would help more than headers would.

4) Bear in mind that Gmail also treats email for every person differently because their spam filters know that what some people consider spam, others don't -- so it could very likely be that you've flagged something similar to what is coming from your server as spam (even though the content is the same as what you're sending through the mail client), and so gmail is picking up on that. I'd say to try using a different gmail email address to test that theory.

5) X-Get-Message-Sender-Via: dom.domainbrokerage.co.uk: authenticated_id: grantw/from_h The problem here is that the authenticated_id is not an email address. In cpanel, setup an dedicated email address that is not the master email account for the cpanel account.

6) X-PHP-Script: www.domainbrokerage.co.uk/admin.php for 95.172.231.27 Gmail may see this and block based on that but its just a hunch. If there's a possibility to remove that header, do so.

Hope some of these help.

3
  • Thanks for the response (and everyone elses). I'll have a look at each of these over the next few days. Point 4 is covered, as I've been having to create a new Gmail account for every test email I send to eliminate that problem! As it stands at the moment, I've managed to find a relevant Google contact form (a problem solving excercise in itself!!) So I've reverted back any changes I've made to the zone file and will see what they say. Will report back with anything.
    – grantw
    Nov 16, 2012 at 19:30
  • 1
    An update on this. After trying pretty much everything, I was left with the X-PHP-Script: header. I removed this and the problem now appears to be fixed!! For anyone else having similar issues and wanting to remove this, you will need to rebuild apache/php with the Mail Headers option disabled. Apparently from php 5.3 onwards this can be disabled in php.ini - mail.add_x_header. Thanks all.
    – grantw
    Nov 26, 2012 at 2:59
  • Glad I could be of help. Its interesting to know that GMail filters X-PHP-Script mails to spam automatically. I wonder how many people are affected by this, as I'm sure there are many many people that use PHP's mail() function.
    – Speeddymon
    Dec 16, 2012 at 5:39
4

By masking hostnames and IP addresses from your question, I think you are also masking the problem itself. There are still traces of what I must assume is your IP address/hostname in the question, which if I'm correct, looks very much like you are sending email from an ISPs pool of addresses. Many of these types of IP addresses appear on RBLs and are likely increasing the likelihood of your email being treated as spam.

3
  • Hi, Could you explain that a bit further please? I've just masked my servers IP address, my domain name and the gmail address, everything else is shown. This is a VPS with a dedicated IP address, I've checked and my IP doesn't appear to be blacklisted anywhere.
    – grantw
    Nov 16, 2012 at 0:13
  • Does YOUR server IP address show YOUR domain name when a reverse lookup is done with that address?
    – Skaperen
    Nov 16, 2012 at 2:25
  • Yes, it resolves to the host name eg. dom.mydomain.co.uk
    – grantw
    Nov 16, 2012 at 3:22
3

There's a number of things I recommend doing:

  1. Use a tool such as http://mxtoolbox.com/ to check your MX records and also to make sure your sending mail server is setup properly
  2. As someone already mentioned, make sure that you have Reverse DNS setup for your sending mail server.
  3. If you have SPF or DKIM setup (it looks like you do), ensure that your sending mail server's IP address is included in your SPF records (it looks like this is already done, by examining your mail headers above).
  4. Make sure your sending mail server isn't on any black lists.
  5. Consider just pasting into this question your raw, unedited mail headers. IP addresses aren't that private, after all. Also, I think you forgot to mask 1 of your lines. If your IP address starts with 95.172, then I know who your ISP is (and if its true, that I can further confirm that you don't have RDNS setup properly - and this would definitely cause a problem). :)
3
  • Hi, I think reverse DNS is ok. DKIM is setup and SPF has the IP included. As far as I can see I'm not blacklisted. I have edited the original post to include the full headers. I've had a bit of a play with the zone file based on someone elses advice since I posted, that doesn't seem to have made a difference as of yet though.
    – grantw
    Nov 16, 2012 at 3:47
  • oh, and the 95. address is my home broadband IP.
    – grantw
    Nov 16, 2012 at 3:57
  • Do try mxtoolbox or a similar service. It will check a bunch of things for you.
    – dunxd
    Nov 16, 2012 at 13:14
1

With a VPS, my guess would be a missing reverse DNS record (PTR). Note that you cant do this via your domain name zone file. You have to get your VPS host to add the record for you. I've had to raise a support ticket with the VPS provider in the past to get this done.

The reverse DNS lookup for your VPS's IP address should match the hostname that your mailserver says HELO with.

1
  • The PTR record was sorted when I got the server about a year ago, it is correct, I've made a couple of changes to the zone file though so not sure it will stay that way. Thanks for the response.
    – grantw
    Nov 16, 2012 at 3:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .