Ping a Specific Port

Question

quanta

Asked: 2012-05-22 20:42:41 +0800 CST2012-05-22 20:42:41 +0800 CST 2012-05-22 20:42:41 +0800 CST

PTR OK, SPF, DKIM passed but email messages are marked as Spam by Google?

772

# host 1.2.3.4
4.3.2.1.in-addr.arpa domain name pointer mail.domain.vn.

# dig +short txt domain.vn
"v=spf1 a mx ptr -all"

# dig +short txt mail.domain.vn
"v=spf1 a -all"

Here's an email header that is marked as Spam:

Received-SPF: pass (google.com: domain of [email protected] designates 1.2.3.4 as permitted sender) client-ip=1.2.3.4;
Message-ID: <[email protected]>
Date: Sun, 20 May 2012 12:16:28 +0700
From: Anonymous <[email protected]>
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:10.0.1) Gecko/20120308 Thunderbird/10.0.1
MIME-Version: 1.0
To: [email protected]
Subject: inbox or spam
Content-Type: multipart/alternative;
 boundary="------------000702010609020201020909"

My IP address is not listed in Spamhaus's SBL, PBL, XBL. I can send mail to Yahoo Inbox normally. Anything else should I check?

UPDATE: Fri May 25 14:35:15 ICT 2012

My IP address used to be listed in the Spamhaus PBL. It sounds like Google update the PBL slower than Yahoo. I have to wait 24-48 hours to see my email going to Gmail Inbox.

Now is another problem: My developer need to rewrite the sender to different domain, ex: [email protected]. I've created the SPF record for this one:

$ dig +short txt anotherdomain.vn
"v=spf1 ip4:mail.server.ip.address ~all"

and edited the main.cf to something like this:

/etc/postfix/main.cf:
    smtpd_sender_restrictions = 
        permit_sasl_authenticated
        permit_mynetworks
        check_sender_access hash:/etc/postfix/sender_access

/etc/postfix/sender_access:
    anotherdomain.vn     OK

Creating the hash db file, reloading the Postfix and sending a testing mail to Google but it go to Spam:

Received-SPF: pass (google.com: domain of [email protected] designates 1.2.3.4 as permitted sender) client-ip=1.2.3.4;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 1.2.3.4 as permitted sender) [email protected]; dkim=pass [email protected]

Beneath the subject line, I see this:

mailed-by:   anotherdomain.vn
signed-by:   mail.domain.vn

Do I must to configure anything else for anotherdomain.vn?

Reply to @John Gardeniers:

I've generated another key pair for anotherdomain.vn. Edited /etc/opendkim/KeyTable and /etc/opendkim/SigningTable, add the public key to DNS, ... and here's the new header:

Delivered-To: [email protected]
Received: by 10.223.30.6 with SMTP id s6csp472554fac;
        Fri, 25 May 2012 08:33:55 -0700 (PDT)
Received: by 10.68.203.40 with SMTP id kn8mr33031655pbc.162.1337960033592;
        Fri, 25 May 2012 08:33:53 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mail.domain.vn (mail.domain.vn. [x.x.x.x])
        by mx.google.com with ESMTPS id ir6si6494603pbc.292.2012.05.25.08.33.51
        (version=TLSv1/SSLv3 cipher=OTHER);
        Fri, 25 May 2012 08:33:52 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates x.x.x.x as permitted sender) client-ip=x.x.x.x;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected]  designates x.x.x.x as permitted sender) [email protected]; dkim=pass [email protected]
Received: from mail.domain.vn (mail.domain.vn [127.0.0.1])
    by mail.domain.vn (Exchange Server) with ESMTP id 978FFBFB019D
    for <[email protected]>; Fri, 25 May 2012 22:33:49 +0700 (ICT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=anotherdomain.vn;
    s=xxx; t=1337960029;
    bh=qfxlWfMGs8sEsiA6P/+nz3wGHymeJRPwzSRAcM0IwrM=;
    h=Date:From:To:Subject:Reply-To:Message-ID:Mime-Version:
     Content-Type;
    b=UyV+F3c6cBLs8RPcf+vfeXLfX5sVERRP2Nv4Oya3Ca7Nt29YBN3wBM7cixPFg4jNw
     ++G/ueOGvQWWs+NdF0pB6zesf6WHVvixRvqZsLbmgyGBPbPgLv02Pn1wrW8t8gsZUg
     snB5xvVdcYzrhym/ALxdwc2qYkapo4YwZRMsH/og=
Received: from webserver.hostname.vn (hostname [y.y.y.y])
    by mail.domain.vn (Exchange Server) with ESMTP id 7A09EBFB0181
    for <[email protected]>; Fri, 25 May 2012 22:33:49 +0700 (ICT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=anotherdomain.vn;
    s=selector; t=1337960029;
    bh=FWgVv5TXS9iT+yQB2k4/8O/fCcyX2ZhMJstt6RnzW38=;
    h=Date:From:To:Subject:Reply-To:Message-ID:Mime-Version:
     Content-Type;
    b=lcq2y13ZRNIfHzEU/vsfWpb9uo86rJnEtKtY2I3mUQOsV9lmejJamxxaYspCHWSCI
     hcxbqFitvFn0rD3X3uMsLTrmb+fPX24Bk0s/20DYmKuTb3/C6RC7ya7t0ZzgXOKTBV
     jYZ8gKpG1gwG38Mc+8oMmfhWi5TqQqtk6Ole4KW4=
User-Agent: CodeIgniter
Date: Fri, 25 May 2012 22:33:49 +0700
From: "No-Reply" <[email protected]>
To: [email protected]
Subject: =?utf-8?Q?=c4=90=c4=83ng_k=c3=bd_th=c3=a0nh_vi=c3=aan?=
Reply-To: "[email protected]" <[email protected]>
X-Sender: [email protected]
X-Mailer: CodeIgniter
X-Priority: 3 (Normal)
Message-ID: <[email protected]>
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="B_ALT_4fbfa65d682f1"
X-Virus-Scanned: ClamAV using ClamSMTP

The mailed-by and signed-by are already point to the same domain:

mailed-by:   anotherdomain.vn
signed-by:   anotherdomain.vn

but it is still flagged as spam by Google.

UPDATE: Sat May 26 13:38:58 ICT 2012

I've 'borrowed' a mail server from different department which is working fine. Belows is the header when sending an email (goes to Inbox):

Delivered-To: [email protected]
Received: by 10.182.7.136 with SMTP id j8csp194826oba;
        Fri, 25 May 2012 21:23:14 -0700 (PDT)
Received: by 10.68.231.36 with SMTP id td4mr3649336pbc.141.1338006193731;
        Fri, 25 May 2012 21:23:13 -0700 (PDT)
Return-Path: <[email protected]>
Received: from example.vn ([public.ip])
        by mx.google.com with ESMTPS id hc10si8220019pbc.121.2012.05.25.21.23.13
        (version=TLSv1/SSLv3 cipher=OTHER);
        Fri, 25 May 2012 21:23:13 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning [email protected] does not designate public.ip as permitted sender) client-ip=public.ip;
Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning [email protected] does not designate public.ip as permitted sender) [email protected]
Received: from anotherdomain.vn (unknown [private.ip])
    (Authenticated sender: [email protected])
    by example.vn (Postfix) with ESMTP id 2A55B680292
    for <[email protected]>; Sat, 26 May 2012 11:23:11 +0700 (ICT)
X-DomainKeys: Sendmail DomainKeys Filter v1.0.2 x.vn 2A55B680292
X-DKIM: Sendmail DKIM Filter v2.8.3 x.vn 2A55B680292
User-Agent: CodeIgniter
Date: Sat, 26 May 2012 11:23:10 +0700
From: "x" <[email protected]>
To: [email protected]
Subject: =?utf-8?Q?=c4=90=c4=83ng_k=c3=bd_th=c3=a0nh_vi=c3=aan?=
Reply-To: "[email protected]" <[email protected]>
X-Sender: [email protected]
X-Mailer: CodeIgniter
X-Priority: 3 (Normal)
Message-ID: <[email protected]>
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="B_ALT_4fc05aae7aba0"

What surprised me is spf=softfail.

UPDATE: Mon May 28 10:36:06 ICT 2012

I've been trying with another domain which has neither SPF nor OpenDKIM's SigningTable. In the /var/log/maillog I see something like this:

opendkim[22200]: (unknown-jobid): no signing table match for '[email protected]'

There are no signed-by and mailed-by in the 'Show details' section but that email goes to Inbox (both of Google and Yahoo).

I really have no ideas how does the Google spam filter mechanism work.

3 Answers

Voted

John Gardeniers · Answer 1 · 2012-05-26T04:30:13+08:00

John Gardeniers

2012-05-26T04:30:13+08:002012-05-26T04:30:13+08:00

There are many reasons why a message might be flagged as spam. Having one domain send a message which is signed by a different domain should be more than enough to ensure it is flagged as spam. Quite simply, you need to get everything properly lined up. The signature needs to be the one for the sending domain, not the domain it is sending for. What you have right now is a message that looks like it's being spoofed.

7

Hex · Answer 2 · 2012-05-26T04:47:07+08:00

Hex

2012-05-26T04:47:07+08:002012-05-26T04:47:07+08:00

I have had similar few months ago. I would recommend you to send an email to [email protected] then you will get an email back containing all the results and scores. Then I think you will have a clear view of your the problem preventing your messages to get delivered to gmail inbox.

7

Mike B · Answer 3 · 2012-05-26T08:03:24+08:00

Mike B

2012-05-26T08:03:24+08:002012-05-26T08:03:24+08:00

The unfortunate nature of current anti-spam techniques is that they are imperfect and prone to false positives if the recipient has settings wound too tight. I don't have a specific answer for you but I think there would be value in trying a few troubleshooting steps:

Is this happening for all messages to that domain? Or just some?
If the sender re-sends the message later, does it go through? (Just trying to determine if block is due to flow-control or is message specific.)
Can you send manual tests (for example from the command-line via telnet) and successfully send a message?
If you send the same message body from a different location does the message still get quarantined/tagged as spam?
Did this behavior start recently? Or has this been an on-going issue?
Have your users ever been able to successfully send to this domain?

Hope this helps.

1

PTR OK, SPF, DKIM passed but email messages are marked as Spam by Google?

Can you pass user/pass for HTTP Basic Authentication in URL parameters?

Ping a Specific Port

Check if port is open or closed on a Linux server?

How to automate SSH login with password?

How do I tell Git for Windows where to find my private RSA key?

What's the default superuser username/password for postgres after a new install?

What port does SFTP use?

Command line to list users in a Windows Active Directory group?

What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats?

How to determine if a bash variable is empty?