If any email contains the URL lafargeholcim-foundation.org or if an email is sent using an email address from that domain, certain providers rate those mails as Spam, others not at all. It is enough if the URL appears in the body as plain text or html, even if other totally independent mail addresses are used. For some reason, it has become a spam word on one or more important lists.
What we tried:
- We checked if that domain got blacklisted somewhere - nope (tested on multiple sites - there where some false positives on the lists, but the blacklist websites themselves said the domain is clean)
- We checked for correct DNS settings (SPF, MX, PTR and so on) - looks good
- We checked domain health using mxtoolbox.com - the only error it show is dmarc - Missing or Invalid Record; however, that error is shown for many other domains to which have no problem (also, that would not explain the ranking if it just gets mentioned)
- We have used http://www.isnotspam.com/ which results in SpamAssassin 3.4.1 (2015-04-28) - Result: ham (non-spam) (02.8points, 10.0 required) but in the details shows X-Spam-Status: Yes, hits=2.8 required=-20.0 tests=BAYES_99,BAYES_999, HTML_MESSAGE,RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL, SPF_HELO_PASS,SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.1; contradictory, but the important message is that somehow the BAYES checks fail
This is the spam check part of the header of a mail sent from [email protected] to an email address at domainfactory that does not filter mails:
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
spamfilter20.ispgateway.de
X-Spam-Level: **********
X-Spam-Status: No, hits=10.0 required=9999.0 tests=BAYES_50,CMAE_1 autolearn=disabled version=3.3.1
X-Spam-CMAETAG: v=2.1 cv=EeZGQZWC c=1 sm=0 tr=0 p=cbSXLfNRAAAA:8
a=pGLkceISAAAA:8 a=2MiuTIsZAAAA:8 a=1XWaLZrsAAAA:8 a=7aQ_Q-yQQ-AA:10
a=83US_ujnACjsZj5jA7sA:9 a=QEXdDO2ut3YA:10 a=UED6auwn5vwA:10
a=7xph8sLR3VcA:10 a=Ky3Y0quMuIMiIHF6c5kA:9 a=jJvKbzjZ-ey99uua:21
xcat=Undefined/Undefined
X-Spam-CMAECATEGORY: 0
X-Spam-CMAESUBCATEGORY: 0
X-Spam-CMAESCORE: 100
Although in this example it says "X-Spam-Status: No", the level is too high to let it go through.
Again: we can understand that some senders are blacklisted. But just mentioning the URL in plain or html text increases the spam rank so much that those mails, no matter where they come from, get filtered out (depending, of course, on what kind of check the mail provider does, if they use SpamAssassin or not).
The header above is from domainfactory, a usually quite reliable German provider. Similar delivery failures have been reported from greenmail.ch, hispeed.ch and others. As opposed to Gmail which shows no spam ranking.
The company is a perfectly legitimate non-profit foundation. They have sent out a newsletter to around 25.000 (voluntary, no spamming involved) recipients in December using Amazon SES. DNS setting are on Amazon Route 53, and Google Business accounts handle the mailboxes.
Over the last 8 years or so, many newsletters have been sent without any issues. The bulk SMTP provider has changed from critsend to Amazon SES recently, though.
Also, they have changed their domain recently and added envelopes to outgoing mails that changed the old domain to the new one - might that have aroused suspicion?
We have googled all day, and we still have no clue how to find out why and where that happened and how to handle that issue. Who adds a spam word to (maybe) SpamAssassin, why, and how can we get rid of it?
