1

I'm making a mail-list with Mailman on Ubuntu Server. The main domain of my server is DOMAIN1.FR, but my mail-list is ticsve@DOMAIN2.FR.

I think I've made all things to do but my emails are tagged as SPAM.

This is the Port25.com analysis of a mail received when I send a mail from myemail@gmail.com to ticsve@DOMAINE2.FR:

==========================================================
Summary of Results
==========================================================
SPF check:          pass
DomainKeys check:   neutral
DKIM check:         pass
DKIM check:         fail
SpamAssassin check: ham

==========================================================
Details:
==========================================================

HELO hostname:  DOMAIN1.fr
Source IP:      [MY IP]
mail-from:      ticsve-bounces@DOMAIN2.fr

----------------------------------------------------------
SPF check details:
----------------------------------------------------------
Result:         pass
ID(s) verified: smtp.mailfrom=ticsve-bounces@DOMAIN2.fr
DNS record(s):
    DOMAIN2.fr. SPF (no records)
    DOMAIN2.fr. 360 IN TXT "v=spf1 mx a ptr ?all"
    DOMAIN2.fr. MX (no records)
    DOMAIN2.fr. 360 IN A [MY IP]

----------------------------------------------------------
DomainKeys check details:
----------------------------------------------------------
Result:         neutral (message not signed)
ID(s) verified: header.From=myemail@gmail.com
DNS record(s):

----------------------------------------------------------
DKIM check details:
----------------------------------------------------------
Result:         pass (matches Sender: ticsve-bounces@DOMAIN2.fr)
ID(s) verified: header.d=DOMAIN2.fr
Canonicalized Headers:
    sender:"ticsve"'20'<ticsve-bounces@DOMAIN2.fr>'0D''0A'
    content-transfer-encoding:base64'0D''0A'
    content-type:text/plain;'20'charset="utf-8"'0D''0A'
    list-subscribe:<http://DOMAIN2.fr/cgi-bin/mailman/listinfo/ticsve>,'20'<mailto:ticsve-request@DOMAIN2.fr?subject=subscribe>'0D''0A'
    list-help:<mailto:ticsve-request@DOMAIN2.fr?subject=help>'0D''0A'
    list-post:<mailto:ticsve@DOMAIN2.fr>'0D''0A'
    list-archive:<http://DOMAIN2.fr/pipermail/ticsve/>'0D''0A'
    list-unsubscribe:<http://DOMAIN2.fr/cgi-bin/mailman/options/ticsve>,'20'<mailto:ticsve-request@DOMAIN2.fr?subject=unsubscribe>'0D''0A'
    list-id:<ticsve.DOMAIN2.fr>'0D''0A'
    subject:[ticsve]'20'Bon'20'encore'20'un'20'test'0D''0A'
    to:ticsve@DOMAIN2.fr'0D''0A'
    message-id:<CAGXJdLwio8yKVo2hwN_Bx5=D4YPKN4hUvqQsNosDfWyTomsV1w@mail.gmail.com>'0D''0A'
    date:Thu,'20'13'20'Oct'20'2016'20'22:30:27'20'+0200'0D''0A'
    from:Valentin'20'A'20'<myemail@gmail.com>'0D''0A'
    mime-version:1.0'0D''0A'
    dkim-signature:v=1;'20'a=rsa-sha256;'20'q=dns/txt;'20'c=relaxed/relaxed;'20'd=DOMAIN2.fr;'20's=20140919;'20'h=Sender:Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Subject:To:Message-ID:Date:From:MIME-Version;'20'bh=gVxflKxOx84RES68MJK1T0Jgiq+M2zBArewFdZ2y/Ek=;'20'b=;

Canonicalized Body:
    xxxxx


DNS record(s):
    20140919._domainkey.DOMAIN2.fr. 360 IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDckpRYnhPuLw+AL+GMClusPLOxX216nXI/RwEJ7Lj79dwxo67YEqZz3RQM0vcmpsjAl008tLORilGy+n6z0DVfPFeVGNVYriGXGKTSnFiJhZs73Q4fX6/LlnY/a8DVK78d8OSk5vC7axDBoA7kiY0/E7VhnvQNfC93zRuG/cKqCwIDAQAB"

Public key used for verification: 20140919._domainkey.DOMAIN2.fr (1024 bits)

NOTE: DKIM checking has been performed based on the latest DKIM specs
(RFC 4871 or draft-ietf-dkim-base-10) and verification may fail for
older versions.  If you are using Port25's PowerMTA, you need to use
version 3.2r11 or later to get a compatible version of DKIM.

----------------------------------------------------------
DKIM check details:
----------------------------------------------------------
Result:         fail (wrong body hash: expected gVxflKxOx84RES68MJK1T0Jgiq+M2zBArewFdZ2y/Ek=)
ID(s) verified:
Canonicalized Headers:
    mime-version:1.0'0D''0A'
    from:Valentin'20'A'20'<myemail@gmail.com>'0D''0A'
    date:Thu,'20'13'20'Oct'20'2016'20'22:30:27'20'+0200'0D''0A'
    message-id:<CAGXJdLwio8yKVo2hwN_Bx5=D4YPKN4hUvqQsNosDfWyTomsV1w@mail.gmail.com>'0D''0A'
    subject:[ticsve]'20'Bon'20'encore'20'un'20'test'0D''0A'
    to:ticsve@DOMAIN2.fr'0D''0A'
    content-transfer-encoding:base64'0D''0A'
    dkim-signature:v=1;'20'a=rsa-sha256;'20'c=relaxed/relaxed;'20'd=gmail.com;'20's=20120113;'20'h=mime-version:from:date:message-id:subject:to'20':content-transfer-encoding;'20'bh=X1vyuq7wb47KGjR/trjfifs4kjrgQmTHo+yckBQhX5Y=;'20'b=

Canonicalized Body:
    xxxxxxxxxx


DNS record(s):

NOTE: DKIM checking has been performed based on the latest DKIM specs
(RFC 4871 or draft-ietf-dkim-base-10) and verification may fail for
older versions.  If you are using Port25's PowerMTA, you need to use
version 3.2r11 or later to get a compatible version of DKIM.

----------------------------------------------------------
SpamAssassin check details:
----------------------------------------------------------
SpamAssassin v3.4.0 (2014-02-07)

Result:         ham  (-1.4 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 0.0 FREEMAIL_FROM          Sender email is commonly abused enduser mail provider
                            (valentin.A[at]gmail.com)
 0.5 RCVD_IN_SORBS_SPAM     RBL: SORBS: sender is a spam source
                            [209.85.215.44 listed in dnsbl.sorbs.net]
 0.0 DKIM_ADSP_CUSTOM_MED   No valid author signature, adsp_override is
                            CUSTOM_MED
 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
                            domains are different
-0.0 SPF_PASS               SPF: sender matches SPF record
-1.9 BAYES_00               BODY: Bayes spam probability is 0 to 1%
                            [score: 0.0000]
 0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 0.0 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom
                             freemail headers are different

==========================================================
Original Email
==========================================================

Return-Path: <ticsve-bounces@DOMAIN2.fr>
Received: from DOMAIN1.fr ([MY IP]) by verifier.port25.com id hvvng220i3gn for <check-auth@verifier.port25.com>; Thu, 13 Oct 2016 16:30:57 -0400 (envelope-from <ticsve-bounces@DOMAIN2.fr>)
Authentication-Results: verifier.port25.com; spf=pass smtp.mailfrom=ticsve-bounces@DOMAIN2.fr
Authentication-Results: verifier.port25.com; domainkeys=neutral (message not signed) header.From=myemail@gmail.com
Authentication-Results: verifier.port25.com; dkim=pass (matches Sender: ticsve-bounces@DOMAIN2.fr) header.d=DOMAIN2.fr
Authentication-Results: verifier.port25.com; dkim=fail (wrong body hash: expected gVxflKxOx84RES68MJK1T0Jgiq+M2zBArewFdZ2y/Ek=)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=DOMAIN2.fr; s=20140919;
        h=Sender:Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Subject:To:Message-ID:Date:From:MIME-Version; bh=gVxflKxOx84RES68MJK1T0Jgiq+M2zBArewFdZ2y/Ek=;
        b=PzoqeM78DETVW92AhKDsxCNLG65dL4teyUFgGs+1sc/uJngXeNsat91feF751r6PsdYOalaY12FEkNamUPDJ6jLxPAkzu00FDTb1CJYLADPiNdZ6w837JOLnrvIJ3X+L8jsMC3HYg07p6eqE0Sra35+XufQipa5Ddy0FRPe3rf4=;
Received: from localhost ([127.0.0.1] helo=ksxxxxxx.kimsufi.com)
        by DOMAIN1.fr with esmtp (Exim 4.82)
        (envelope-from <ticsve-bounces@DOMAIN2.fr>)
        id 1bumeU-0007Ry-IE; Thu, 13 Oct 2016 22:30:54 +0200
Received: from mail-lf0-f44.google.com ([209.85.215.44])
 by DOMAIN1.fr with esmtp (Exim 4.82)
 (envelope-from <myemail@gmail.com>) id 1bumeS-0007Rr-BJ
 for ticsve@DOMAIN2.fr; Thu, 13 Oct 2016 22:30:52 +0200
Received: by mail-lf0-f44.google.com with SMTP id b81so151665357lfe.1
 for <ticsve@DOMAIN2.fr>; Thu, 13 Oct 2016 13:30:53 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=mime-version:from:date:message-id:subject:to
 :content-transfer-encoding;
 bh=xxxxxx
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20130820;
 h=x-gm-message-state:mime-version:from:date:message-id:subject:to
 :content-transfer-encoding;
 bh=xxxxx
X-Gm-Message-State: xxxx
X-Received: by 10.25.38.149 with SMTP id xxxx;
 Thu, 13 Oct 2016 13:30:47 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.25.196.213 with HTTP; Thu, 13 Oct 2016 13:30:27 -0700 (PDT)
From: Valentin A <myemail@gmail.com>
Date: Thu, 13 Oct 2016 22:30:27 +0200
Message-ID: <CAGXJdLwio8yKVo2hwN_Bx5=D4YPKN4hUvqQsNosDfWyTomsV1w@mail.gmail.com>
To: ticsve@DOMAIN2.fr
Subject: [ticsve] Bon encore un test
X-BeenThere: ticsve@DOMAIN2.fr
X-Mailman-Version: 2.1.16
Precedence: list
List-Id: <ticsve.DOMAIN2.fr>
List-Unsubscribe: <http://DOMAIN2.fr/cgi-bin/mailman/options/ticsve>,
 <mailto:ticsve-request@DOMAIN2.fr?subject=unsubscribe>
List-Archive: <http://DOMAIN2.fr/pipermail/ticsve/>
List-Post: <mailto:ticsve@DOMAIN2.fr>
List-Help: <mailto:ticsve-request@DOMAIN2.fr?subject=help>
List-Subscribe: <http://DOMAIN2.fr/cgi-bin/mailman/listinfo/ticsve>,
 <mailto:ticsve-request@DOMAIN2.fr?subject=subscribe>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
Errors-To: ticsve-bounces@DOMAIN2.fr
Sender: "ticsve" <ticsve-bounces@DOMAIN2.fr>

xxxxx
  • The real email addresses and domains are all available in the Base64 encoded blobs. – David Schwartz Oct 13 '16 at 22:01
  • 1
    DKIM fails, I'd start there. – Tim Oct 14 '16 at 0:25
  • @Tim The weird thing is that my server is signed ( DKIM check: pass ) but there is another DKIM record from gmail and I can't sign it since I have no access to gmail records... :) – Valentin A Oct 14 '16 at 11:20
  • Post your actual domains if you want further help – Tim Oct 14 '16 at 19:03
  • @Tim The domains are valentin-a.fr (hostname of the server, which appears in HELO even if I would prefere a "dynamic" hostname...) and mastersime.fr (domain of the mail-list) – Valentin A Oct 16 '16 at 10:15
2
  1. You email is being DKIM signed twice, one passing, one failing. It's looks like it's first being signed by GMAIL then your mail server signs it (But the body of the message is altered, causing it to original GMAIL DKIM signature to fail. Since you "xxxxxx" the Canonicalized Body out in the report from port 25, it's hard for anyone to point out what changed.
  2. Next take a look at the Spam Assassin report:

    RBL: SORBS: sender is a spam source [209.85.215.44 listed in dnsbl.sorbs.net]

You're listed in SORBS RBL which is another reason why your email might be being flagged as SPAM. RBL = Real-Time Blacklist - You should monitor that with a Blacklist Monitoring tool.

  1. The Port25 report is an excellent tool, but it only checks authentication methods used in your email, It won't detect configuration issues, like a true email tester, which can also cause your email to go to spam.
  • Thanks for your answer ! I'm looking at the email tester. – Valentin A Oct 15 '16 at 15:21
  • About the blacklist : The weird thing is that i'm not the owner of 209.85.215.44 ! This is the IP of... Google... ( tcpiputils.com/browse/ip-address/209.85.215.44 ) Mine is 37.187.21.160 and I don't think i'm blacklisted... – Valentin A Oct 15 '16 at 15:24
  • Your IP is on a few minor Blacklists. That's one of the issues when mailing through other peoples IP's. You really can't control there reputation. SORBS is a big one, a lot of places use them. – Henry Oct 15 '16 at 18:11
  • When there is a "direct send" from my server to gmail the email doesn't fall in SPAM, so I guess my reputation isn't so bad... But I have no control on the reputation of the Google IPs and I really don't know how to resolve this issue... Thanks for the link anyway ! I'm looking at it ! – Valentin A Oct 16 '16 at 10:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.