5
# host 1.2.3.4
4.3.2.1.in-addr.arpa domain name pointer mail.domain.vn.

# dig +short txt domain.vn
"v=spf1 a mx ptr -all"

# dig +short txt mail.domain.vn
"v=spf1 a -all"

Here's an email header that is marked as Spam:

Delivered-To: [email protected]
Received: by 10.223.30.6 with SMTP id s6csp119326fac;
        Sat, 19 May 2012 22:16:56 -0700 (PDT)
Received: by 10.68.218.72 with SMTP id pe8mr55329860pbc.45.1337491015749;
        Sat, 19 May 2012 22:16:55 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mail.domain.vn (mail.domain.vn. [1.2.3.4])
        by mx.google.com with ESMTP id on9si20572118pbc.80.2012.05.19.22.16.53;
        Sat, 19 May 2012 22:16:54 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 1.2.3.4 as permitted sender) client-ip=1.2.3.4;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 1.2.3.4 as permitted sender) [email protected]; dkim=pass [email protected]
Received: from [192.168.1.98] (unknown [113.168.221.170])
    by mail.domain.vn (Postfix) with ESMTP id A8668BFB017E
    for <[email protected]>; Sun, 20 May 2012 12:16:52 +0700 (ICT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mail.domain.vn;
    s=domain; t=1337491012;
    bh=xeWEA29llkhrwCuYBQwWIkwsgpy5OY/Y/H4z1kGGqQo=;
    h=Message-ID:Date:From:MIME-Version:To:Subject:Content-Type;
    b=RZeb6BnXRbfSmU4V/SPWtbCKgIbMs19V/CmtkMO4XnA4tnom0Iip/52IvYiS86Fki
     ZyFob5CoqOj5AJ4jLe5wDB2OcrAtuhhJsgGL6bkDy6PW1W9jW99FxuUN+dZsw/Q0Xb
     Z8gSgUARIR6+M4nH8ziGJJB7z/Jimo68FIo8kw1o=
Message-ID: <[email protected]>
Date: Sun, 20 May 2012 12:16:28 +0700
From: Anonymous <[email protected]>
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:10.0.1) Gecko/20120308 Thunderbird/10.0.1
MIME-Version: 1.0
To: [email protected]
Subject: inbox or spam
Content-Type: multipart/alternative;
 boundary="------------000702010609020201020909"

My IP address is not listed in Spamhaus's SBL, PBL, XBL. I can send mail to Yahoo Inbox normally. Anything else should I check?


UPDATE: Fri May 25 14:35:15 ICT 2012

My IP address used to be listed in the Spamhaus PBL. It sounds like Google update the PBL slower than Yahoo. I have to wait 24-48 hours to see my email going to Gmail Inbox.

Now is another problem: My developer need to rewrite the sender to different domain, ex: [email protected]. I've created the SPF record for this one:

$ dig +short txt anotherdomain.vn
"v=spf1 ip4:mail.server.ip.address ~all"

and edited the main.cf to something like this:

/etc/postfix/main.cf:
    smtpd_sender_restrictions = 
        permit_sasl_authenticated
        permit_mynetworks
        check_sender_access hash:/etc/postfix/sender_access

/etc/postfix/sender_access:
    anotherdomain.vn     OK

Creating the hash db file, reloading the Postfix and sending a testing mail to Google but it go to Spam:

Received-SPF: pass (google.com: domain of [email protected] designates 1.2.3.4 as permitted sender) client-ip=1.2.3.4;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 1.2.3.4 as permitted sender) [email protected]; dkim=pass [email protected]

Beneath the subject line, I see this:

mailed-by:   anotherdomain.vn
signed-by:   mail.domain.vn

Do I must to configure anything else for anotherdomain.vn?


Reply to @John Gardeniers:

I've generated another key pair for anotherdomain.vn. Edited /etc/opendkim/KeyTable and /etc/opendkim/SigningTable, add the public key to DNS, ... and here's the new header:

Delivered-To: [email protected]
Received: by 10.223.30.6 with SMTP id s6csp472554fac;
        Fri, 25 May 2012 08:33:55 -0700 (PDT)
Received: by 10.68.203.40 with SMTP id kn8mr33031655pbc.162.1337960033592;
        Fri, 25 May 2012 08:33:53 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mail.domain.vn (mail.domain.vn. [x.x.x.x])
        by mx.google.com with ESMTPS id ir6si6494603pbc.292.2012.05.25.08.33.51
        (version=TLSv1/SSLv3 cipher=OTHER);
        Fri, 25 May 2012 08:33:52 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates x.x.x.x as permitted sender) client-ip=x.x.x.x;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected]  designates x.x.x.x as permitted sender) [email protected]; dkim=pass [email protected]
Received: from mail.domain.vn (mail.domain.vn [127.0.0.1])
    by mail.domain.vn (Exchange Server) with ESMTP id 978FFBFB019D
    for <[email protected]>; Fri, 25 May 2012 22:33:49 +0700 (ICT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=anotherdomain.vn;
    s=xxx; t=1337960029;
    bh=qfxlWfMGs8sEsiA6P/+nz3wGHymeJRPwzSRAcM0IwrM=;
    h=Date:From:To:Subject:Reply-To:Message-ID:Mime-Version:
     Content-Type;
    b=UyV+F3c6cBLs8RPcf+vfeXLfX5sVERRP2Nv4Oya3Ca7Nt29YBN3wBM7cixPFg4jNw
     ++G/ueOGvQWWs+NdF0pB6zesf6WHVvixRvqZsLbmgyGBPbPgLv02Pn1wrW8t8gsZUg
     snB5xvVdcYzrhym/ALxdwc2qYkapo4YwZRMsH/og=
Received: from webserver.hostname.vn (hostname [y.y.y.y])
    by mail.domain.vn (Exchange Server) with ESMTP id 7A09EBFB0181
    for <[email protected]>; Fri, 25 May 2012 22:33:49 +0700 (ICT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=anotherdomain.vn;
    s=selector; t=1337960029;
    bh=FWgVv5TXS9iT+yQB2k4/8O/fCcyX2ZhMJstt6RnzW38=;
    h=Date:From:To:Subject:Reply-To:Message-ID:Mime-Version:
     Content-Type;
    b=lcq2y13ZRNIfHzEU/vsfWpb9uo86rJnEtKtY2I3mUQOsV9lmejJamxxaYspCHWSCI
     hcxbqFitvFn0rD3X3uMsLTrmb+fPX24Bk0s/20DYmKuTb3/C6RC7ya7t0ZzgXOKTBV
     jYZ8gKpG1gwG38Mc+8oMmfhWi5TqQqtk6Ole4KW4=
User-Agent: CodeIgniter
Date: Fri, 25 May 2012 22:33:49 +0700
From: "No-Reply" <[email protected]>
To: [email protected]
Subject: =?utf-8?Q?=c4=90=c4=83ng_k=c3=bd_th=c3=a0nh_vi=c3=aan?=
Reply-To: "[email protected]" <[email protected]>
X-Sender: [email protected]
X-Mailer: CodeIgniter
X-Priority: 3 (Normal)
Message-ID: <[email protected]>
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="B_ALT_4fbfa65d682f1"
X-Virus-Scanned: ClamAV using ClamSMTP

The mailed-by and signed-by are already point to the same domain:

mailed-by:   anotherdomain.vn
signed-by:   anotherdomain.vn

but it is still flagged as spam by Google.


UPDATE: Sat May 26 13:38:58 ICT 2012

I've 'borrowed' a mail server from different department which is working fine. Belows is the header when sending an email (goes to Inbox):

Delivered-To: [email protected]
Received: by 10.182.7.136 with SMTP id j8csp194826oba;
        Fri, 25 May 2012 21:23:14 -0700 (PDT)
Received: by 10.68.231.36 with SMTP id td4mr3649336pbc.141.1338006193731;
        Fri, 25 May 2012 21:23:13 -0700 (PDT)
Return-Path: <[email protected]>
Received: from example.vn ([public.ip])
        by mx.google.com with ESMTPS id hc10si8220019pbc.121.2012.05.25.21.23.13
        (version=TLSv1/SSLv3 cipher=OTHER);
        Fri, 25 May 2012 21:23:13 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning [email protected] does not designate public.ip as permitted sender) client-ip=public.ip;
Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning [email protected] does not designate public.ip as permitted sender) [email protected]
Received: from anotherdomain.vn (unknown [private.ip])
    (Authenticated sender: [email protected])
    by example.vn (Postfix) with ESMTP id 2A55B680292
    for <[email protected]>; Sat, 26 May 2012 11:23:11 +0700 (ICT)
X-DomainKeys: Sendmail DomainKeys Filter v1.0.2 x.vn 2A55B680292
X-DKIM: Sendmail DKIM Filter v2.8.3 x.vn 2A55B680292
User-Agent: CodeIgniter
Date: Sat, 26 May 2012 11:23:10 +0700
From: "x" <[email protected]>
To: [email protected]
Subject: =?utf-8?Q?=c4=90=c4=83ng_k=c3=bd_th=c3=a0nh_vi=c3=aan?=
Reply-To: "[email protected]" <[email protected]>
X-Sender: [email protected]
X-Mailer: CodeIgniter
X-Priority: 3 (Normal)
Message-ID: <[email protected]>
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="B_ALT_4fc05aae7aba0"

What surprised me is spf=softfail.


UPDATE: Mon May 28 10:36:06 ICT 2012

I've been trying with another domain which has neither SPF nor OpenDKIM's SigningTable. In the /var/log/maillog I see something like this:

opendkim[22200]: (unknown-jobid): no signing table match for '[email protected]'

There are no signed-by and mailed-by in the 'Show details' section but that email goes to Inbox (both of Google and Yahoo).

I really have no ideas how does the Google spam filter mechanism work.

7
  • 2
    You should close the answer, adding the information you wrote in the update and open a second question which asks what you are asking in the update and offer the bounty there.
    – adamo
    May 25, 2012 at 8:43
  • 1
    Why are you including Google's settings in anotherdomain.vn, is that domain hosted by Google? Your question makes it sound like that e-mail is coming from your mail server as well, but that's not what your SPF record indicates.
    – Chris S
    May 25, 2012 at 12:36
  • @ChrisS: sorry for my misunderstanding about SPF record.
    – quanta
    May 28, 2012 at 3:52
  • Do you have reverse DNS set up?
    – Sašo
    May 28, 2012 at 6:52
  • See the first command in my post.
    – quanta
    May 28, 2012 at 6:59

3 Answers 3

7

I have had similar few months ago. I would recommend you to send an email to [email protected] then you will get an email back containing all the results and scores. Then I think you will have a clear view of your the problem preventing your messages to get delivered to gmail inbox.

1
  • +1 I've used the this method to help track down issues that weren't easily spotted otherwise. May 26, 2012 at 2:06
7
+25

There are many reasons why a message might be flagged as spam. Having one domain send a message which is signed by a different domain should be more than enough to ensure it is flagged as spam. Quite simply, you need to get everything properly lined up. The signature needs to be the one for the sending domain, not the domain it is sending for. What you have right now is a message that looks like it's being spoofed.

0
1

The unfortunate nature of current anti-spam techniques is that they are imperfect and prone to false positives if the recipient has settings wound too tight. I don't have a specific answer for you but I think there would be value in trying a few troubleshooting steps:

  • Is this happening for all messages to that domain? Or just some?
  • If the sender re-sends the message later, does it go through? (Just trying to determine if block is due to flow-control or is message specific.)
  • Can you send manual tests (for example from the command-line via telnet) and successfully send a message?
  • If you send the same message body from a different location does the message still get quarantined/tagged as spam?
  • Did this behavior start recently? Or has this been an on-going issue?
  • Have your users ever been able to successfully send to this domain?

Hope this helps.

2
  • I've been trying to send an email from the command line, something like this echo hi | mail -s 'rewrite sender from command line' [email protected] -- -r "[email protected]", it goes to Inbox. The problem seems related to CodeIgniter.
    – quanta
    May 25, 2012 at 16:14
  • @quanta Have you seen this post? stackoverflow.com/questions/10682278/… If you're using HTML, you should check to make sure is formatted correctly and valid.
    – Mike B
    May 25, 2012 at 16:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .