Outgoing email marked as spam

[abzsol]

Hi,

in these last days, I have noticed that some outgoing email are marked as spam (spamscore > 10) but they are good emails.
This is the result for the last message blocked; the message was just

AWL                     -2.637 Adjusted score from AWL reputation of From: address
BAYES_00                -0.25 Bayes spam probability is 0 to 1%
DKIM_INVALID            0.1 DKIM or DK signature exists, but is not valid
DKIM_SIGNED             0.1 Message has a DKIM or DK signature, not necessarily valid
DOS_OUTLOOK_TO_MX_IMAGE 2.889 Direct to MX with Outlook headers and an image DYN_RDNS_AND_INLINE_IMAGE  1.168 Contains image, and was sent by dynamic rDNS DYN_RDNS_SHORT_HELO_IMAGE  1.013 Short HELO string, dynamic rDNS, inline image
FSL_HELO_NON_FQDN_1     0.001 -
HELO_NO_DOMAIN          0.161 Relay reports its domain incorrectly
KHOP_HELO_FCRDNS        0.399 Relay HELO differs from its IP's reverse DNS
MIME_QP_LONG_LINE       0.001 Quoted-printable line longer than 76 chars
RCVD_IN_PBL             3.335 Received via a relay in Spamhaus PBL
RCVD_IN_SBL_CSS         3.335 Received via a relay in Spamhaus SBL-CSS
RDNS_DYNAMIC            0.982 Delivered to internal network by host with dynamic-looking rDNS
SHORT_HELO_AND_INLINE_IMAGE    0.1 Short HELO string, with inline image
URIBL_BLOCKED           0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked.  See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information.

The rules that make the score so high are DOS_OUTLOOK_TO_MX_IMAGE, RCVD_IN_PBL and RCVD_IN_SBL_CSS
How can I adjust this situation? Is there some test that I can make?
Thanks

 

[hata_ph]

Are your public IP being blacklisted?

RCVD_IN_PBL 3.335 Received via a relay in Spamhaus PBL
RCVD_IN_SBL_CSS 3.335 Received via a relay in Spamhaus SBL-CSS

 

[abzsol]

Are your public IP being blacklisted?

RCVD_IN_PBL 3.335 Received via a relay in Spamhaus PBL
RCVD_IN_SBL_CSS 3.335 Received via a relay in Spamhaus SBL-CSS

The whole class of the IP that had sent the email was blacklisted, because the IP was not private but public.

 

[hata_ph]

The whole class of the IP that had sent the email was blacklisted, because the IP was not private but public.

Check with your ISP to fix the issue. As long as your public IP is being blacklisted, you will have problem sending and receiving email.

 

[abzsol]

Check with your ISP to fix the issue. As long as your public IP is being blacklisted, you will have problem sending and receiving email.

I think that 99% of IPs of a smartphone connection is in more than one blacklist, so no one should send from its smartphone.
I also want to know what is DOS_OUTLOOK_TO_MX_IMAGE and how to "fix" it.

 

[hata_ph]

I think that 99% of IPs of a smartphone connection is in more than one blacklist, so no one should send from its smartphone.
I also want to know what is DOS_OUTLOOK_TO_MX_IMAGE and how to "fix" it.

Not sure it correct or not...are you using outlook or exchange?

Spamassassin DOS_OUTLOOK_TO_MX rule is fired when two internal flags are set by processed message: __DOS_DIRECT_TO_MX and __ANY_OUTLOOK_MUA.
__DOS_DIRECT_TO_MX flag means that the message was sent directly from sender email client to recipient MTA server. This is usually true for internal mail but can occur in your case when a recipient also uses Amazon SES for mail processing.
__ANY_OUTLOOK_MUA flag means that the message has X-Mailer =~ /^Microsoft (?:Office )?Outlook\b/ header.
Both internal flags are harmless by themselves but their combination leads to DOS_OUTLOOK_TO_MX with high spam score. You need to check X-Mailer header of messages sent with PHPMailer. This header should be set to PHPMailer, not to Microsoft Outlook or something similar.

https://stackoverflow.com/questions/45962446/preventing-dos-outlook-to-mx-spamassasins-flag

 

[abzsol]

Not sure it correct or not...are you using outlook or exchange?

Spamassassin DOS_OUTLOOK_TO_MX rule is fired when two internal flags are set by processed message: __DOS_DIRECT_TO_MX and __ANY_OUTLOOK_MUA.
__DOS_DIRECT_TO_MX flag means that the message was sent directly from sender email client to recipient MTA server. This is usually true for internal mail but can occur in your case when a recipient also uses Amazon SES for mail processing.
__ANY_OUTLOOK_MUA flag means that the message has X-Mailer =~ /^Microsoft (?:Office )?Outlook\b/ header.
Both internal flags are harmless by themselves but their combination leads to DOS_OUTLOOK_TO_MX with high spam score. You need to check X-Mailer header of messages sent with PHPMailer. This header should be set to PHPMailer, not to Microsoft Outlook or something similar.

https://stackoverflow.com/questions/45962446/preventing-dos-outlook-to-mx-spamassasins-flag

The users use Outlook, so I think that every mail has the X-Mailer =~ /^Microsoft (?:Office )?Outlook\b/ header.

 

[hata_ph]

The users use Outlook, so I think that every mail has the X-Mailer =~ /^Microsoft (?:Office )?Outlook\b/ header.

Try send using different mail client, it no more the dos_outlook_to_mx then u found your answer...

 

[abzsol]

Try send using different mail client, it no more the dos_outlook_to_mx then u found your answer...

I can't tell to more than 3000 clients to stop using Outlook :/

 

[hata_ph]

I can't tell to more than 3000 clients to stop using Outlook :/

lol...u can test using 1 client to see the different...

 

[patefoniq]

Good Morning,

I have the same problem, but with MS OWA. I configured PMG for scanning outgoing e-mails but this setting impacted some sent emails.
Being outside the office users send e-mails via webmail (rarely from mobile outlook) and sometimes, let say once per hundreds of messages, they get this error message ("Received via a relay in Spamhaus PBL"). I can't add senders (organization users) IP's to the whitelist since they are using the public networks at home, hotels, airports, whatever.

 

[Stoiko Ivanov]

I have the same problem, but with MS OWA. I configured PMG for scanning outgoing e-mails but this setting impacted some sent emails.
Being outside the office users send e-mails via webmail (rarely from mobile outlook) and sometimes, let say once per hundreds of messages, they get this error message ("Received via a relay in Spamhaus PBL"). I can't add senders (organization users) IP's to the whitelist since they are using the public networks at home, hotels, airports, whatever.

hmm - in this case you could try to disable the rule RCVD_IN_PBL by assigning a score of 0 to it.
This usually is not a good solution (since servers where you send mail to could also use spamassassin and thus rate the mail with the same score and deny it), but in that case I think that SA only checks the last public IP in the received headers (assuming the exchange uses an internal address...)

 

[patefoniq]

You mean here?

 

[Stoiko Ivanov]

yes - add it with a score of 0 and keep an eye on the logs

 

[patefoniq]

Ok. Thank you very much. As always, you're the best

 

[Stoiko Ivanov]

Glad that it helps - don't forget to keep an eye on the logs

 

[patefoniq]

So it should look like that?

 

[patefoniq]

And one more thing, could you add the status filter to the tracking center, so we could select only blocked messages or delivered or quarantined or blocked?

 

[Stoiko Ivanov]

So it should look like that?

looks ok - if it works you will not see any more RCVD_IN_PBL in your mail.log

And one more thing, could you add the status filter to the tracking center, so we could select only blocked messages or delivered or quarantined or blocked?

hmm - could you please open an enhancement request at https://bugzilla.proxmox.com ?

 

[patefoniq]

Yes, it works, thank you. Enhancement request opened:

https://bugzilla.proxmox.com/show_bug.cgi?id=2742