Messages marked as SPAM

simonegiusti · Post by **simonegiusti** » 2009-11-14 11:45

Plesk 8.2 with Hmail 4.4. and Horde Webmail

I have two problems:

1) Every message sent with webmail is marked as Spam from Outlook. I tried to disable every spam parameter in Hmail and tried every combination. I disabled spam assassin in Plesk.

Smtp response seems to be ok

"SMTPD" 57832 461 "2009-11-14 10:24:24.106" "127.0.0.1" "SENT: 220 note.it ESMTP"
"SMTPD" 57832 461 "2009-11-14 10:24:24.106" "127.0.0.1" "RECEIVED: EHLO localhost"
"SMTPD" 57832 461 "2009-11-14 10:24:24.106" "127.0.0.1" "SENT: 250-hmailserver[nl]250-SIZE 500000000[nl]250 AUTH LOGIN"
"SMTPD" 57832 461 "2009-11-14 10:24:24.122" "127.0.0.1" "RECEIVED: MAIL FROM:<simone@nuovocaffedelteatro.it>"
"SMTPD" 57832 461 "2009-11-14 10:24:24.122" "127.0.0.1" "SENT: 250 OK"
"SMTPD" 57832 461 "2009-11-14 10:24:24.122" "127.0.0.1" "RECEIVED: RCPT TO:<simone@rockopera.it>"
"SMTPD" 57832 461 "2009-11-14 10:24:24.122" "127.0.0.1" "SENT: 250 OK"
"SMTPD" 57832 461 "2009-11-14 10:24:24.122" "127.0.0.1" "RECEIVED: DATA"
"SMTPD" 57832 461 "2009-11-14 10:24:24.122" "127.0.0.1" "SENT: 354 OK, send."
"SMTPD" 57832 461 "2009-11-14 10:24:24.137" "127.0.0.1" "SENT: 250 Queued (0.000 seconds)"
"SMTPD" 57832 461 "2009-11-14 10:24:24.137" "127.0.0.1" "RECEIVED: QUIT"
"SMTPD" 57832 461 "2009-11-14 10:24:24.137" "127.0.0.1" "SENT: 221 goodbye"
"SMTPC" 57832 462 "2009-11-14 10:24:24.216" "62.149.128.160" "RECEIVED: 220 mxavas4.aruba.it ESMTP"
"SMTPC" 57832 462 "2009-11-14 10:24:24.216" "62.149.128.160" "SENT: HELO note.it"
"SMTPC" 57832 462 "2009-11-14 10:24:24.216" "62.149.128.160" "RECEIVED: 250 mxavas4.aruba.it"
"SMTPC" 57832 462 "2009-11-14 10:24:24.216" "62.149.128.160" "SENT: MAIL FROM:<simone@nuovocaffedelteatro.it>"
"SMTPC" 40532 462 "2009-11-14 10:24:24.231" "62.149.128.160" "RECEIVED: 250 ok"
"SMTPC" 40532 462 "2009-11-14 10:24:24.231" "62.149.128.160" "SENT: RCPT TO:<simone@rockopera.it>"
"SMTPC" 40532 462 "2009-11-14 10:24:24.247" "62.149.128.160" "RECEIVED: 250 ok"
"SMTPC" 40532 462 "2009-11-14 10:24:24.247" "62.149.128.160" "SENT: DATA"
"SMTPC" 40532 462 "2009-11-14 10:24:24.247" "62.149.128.160" "RECEIVED: 354 go ahead"
"SMTPC" 40532 462 "2009-11-14 10:24:24.247" "62.149.128.160" "SENT: [nl]."
"SMTPC" 40532 462 "2009-11-14 10:24:25.653" "62.149.128.160" "RECEIVED: 250 ok 1258190661 qp 14276"
"SMTPC" 40532 462 "2009-11-14 10:24:25.653" "62.149.128.160" "SENT: QUIT"
"SMTPC" 40532 462 "2009-11-14 10:24:25.653" "62.149.128.160" "RECEIVED: 221 mxavas4.aruba.it"

2) Every message sent to Hotmail account is refused with the message:

RECEIVED: 550 OU-001 Mail rejected by Windows Live Hotmail for policy reasons. Reasons for rejection may be related to content with spam-like characteristics or IP/domain reputation problems. If you are not an email/network admin please contact your E-mail/Internet Service Provider for help. Email/network admins, please visit http://postmaster.live.com for email delivery

I tied with SPF ecc ecc ... with no results ....

Please help me !! I don'want to reinstall MailEnable !

^DooM^ · Post by **^DooM^** » 2009-11-14 11:51

Have you disabled anti spam in the my computer ip range?

I'll check your domain and post back.

^DooM^ · Post by **^DooM^** » 2009-11-14 12:02

The reason you are marked as spam is due to a few reasons.

First is because your IP is classed as dynamic/residential/generic meaning you look like you are sending it from your home ISP instead of from a legit business. 90% of spam comes from home accounts.

62.149.169.122 was found in NOMOREFUNN!
serverdedicati.aruba.it. Dynamic IP or generic rDNS. Use your ISPs mail service, or whitelist at: http://moensted.dk/spam/no-more-funn/?a ... 49.169.122
This ip is as a part of a listed netblock. This do NOT indicate that we think YOU are a spammer.This indicate that we in general don't trust your ISP/Contry/Connection type. However if you click "Whitelist/Exclude IP" your host will be automaticaly removed.

Second your IP was spotted here because of a dodgy HELO name

http://cbl.abuseat.org/lookup.cgi?ip=62.149.169.122

220 note.it ESMTP

That should read nuovocaffedelteatro.it

Third your IP resolves to (rDNS) host122-169-149-62.serverdedicati.aruba.it when it should resolve to nuovocaffedelteatro.it

Read this http://www.hmailserver.com/documentatio ... fic_server

simonegiusti · Post by **simonegiusti** » 2009-11-14 12:07

^DooM^ wrote:The reason you are marked as spam is due to a few reasons.

First is because your IP is classed as dynamic/residential/generic meaning you look like you are sending it from your home ISP instead of from a legit business. 90% of spam comes from home accounts.
62.149.169.122 was found in NOMOREFUNN!
serverdedicati.aruba.it. Dynamic IP or generic rDNS. Use your ISPs mail service, or whitelist at: http://moensted.dk/spam/no-more-funn/?a ... 49.169.122
This ip is as a part of a listed netblock. This do NOT indicate that we think YOU are a spammer.This indicate that we in general don't trust your ISP/Contry/Connection type. However if you click "Whitelist/Exclude IP" your host will be automaticaly removed.
Second your IP was spotted here because of a dodgy HELO name
http://cbl.abuseat.org/lookup.cgi?ip=62.149.169.122

220 note.it ESMTP
That should read nuovocaffedelteatro.it

I have 15 domains on my virtuale plesk server. Note.it is one of this. What I have to put in 'host name' ??

Third your IP resolves to (rDNS) host122-169-149-62.serverdedicati.aruba.it when it should resolve to nuovocaffedelteatro.it

the same as above ...

Read this http://www.hmailserver.com/documentatio ... fic_server

^DooM^ · Post by **^DooM^** » 2009-11-14 12:42

ok well the rDNS of 62.149.169.122 be note.it then not host122-169-149-62.serverdedicati.aruba.it

You also have no SPF record setup

Read the docs i pointed you too and read http://postmaster.live.com/ as the error message suggested.

simonegiusti · Post by **simonegiusti** » 2009-11-14 15:48

^DooM^ wrote:ok well the rDNS of 62.149.169.122 be note.it then not host122-169-149-62.serverdedicati.aruba.it

You also have no SPF record setup

Read the docs i pointed you too and read http://postmaster.live.com/ as the error message suggested.

Can I have some help more ???

What have I to insert in "host name" ???

How can I setup SPF ??

^DooM^ · Post by **^DooM^** » 2009-11-14 15:59

You need to contact your ISP and ask them to change the RDNS on your IP to note.it

Visit http://openspf.org for information on how to setup SPF

also. If you can't be bothered to read the help provided in the links that i have already given you then no I can't help you any more than i already have. I am not going to do your work for you. you need to do some research now and help yourself.

simonegiusti · Post by **simonegiusti** » 2009-11-15 02:46

^DooM^ wrote:You need to contact your ISP and ask them to change the RDNS on your IP to note.it

Visit http://openspf.org for information on how to setup SPF

also. If you can't be bothered to read the help provided in the links that i have already given you then no I can't help you any more than i already have. I am not going to do your work for you. you need to do some research now and help yourself.

Many thanks for all these hints ...
I am trying to solve the situation and I red all the documents you send me.

The only question is:

This is a smtp log. Why do I see 'localhost' when I substitute it with Ip address in Horde Config ???
The problem come only with horde webmail. I send you an email header with MailEnable. Did it started with "localhost", isn't it ??
With mailenable I have not this problem !

HMAIL LOG

"SMTPD" 38940 1568 "2009-11-15 01:40:56.544" "127.0.0.1" "SENT: 220 62.149.169.122 ESMTP"
"SMTPD" 38940 1568 "2009-11-15 01:40:56.544" "127.0.0.1" "RECEIVED: EHLO localhost"
"SMTPD" 38940 1568 "2009-11-15 01:40:56.544" "127.0.0.1" "SENT: 250-hmailserver[nl]250-SIZE 500000000[nl]250 AUTH LOGIN"
"SMTPD" 38940 1568 "2009-11-15 01:40:56.559" "127.0.0.1" "RECEIVED: MAIL FROM:<sabrina@note.it>"
"SMTPD" 38940 1568 "2009-11-15 01:40:56.559" "127.0.0.1" "SENT: 250 OK"
"SMTPD" 38940 1568 "2009-11-15 01:40:56.559" "127.0.0.1" "RECEIVED: RCPT TO:<simone@rockopera.it>"
"SMTPD" 38940 1568 "2009-11-15 01:40:56.575" "127.0.0.1" "SENT: 250 OK"
"SMTPD" 38940 1568 "2009-11-15 01:40:56.575" "127.0.0.1" "RECEIVED: DATA"
"SMTPD" 38940 1568 "2009-11-15 01:40:56.575" "127.0.0.1" "SENT: 354 OK, send."
"SMTPD" 38940 1568 "2009-11-15 01:40:56.575" "127.0.0.1" "SENT: 250 Queued (0.000 seconds)"
"SMTPD" 38940 1568 "2009-11-15 01:40:56.575" "127.0.0.1" "RECEIVED: QUIT"
"SMTPD" 38940 1568 "2009-11-15 01:40:56.575" "127.0.0.1" "SENT: 221 goodbye"
"SMTPC" 61108 1569 "2009-11-15 01:40:56.809" "62.149.128.154" "RECEIVED: 220 mxavas14.aruba.it ESMTP"
"SMTPC" 61108 1569 "2009-11-15 01:40:56.809" "62.149.128.154" "SENT: HELO 62.149.169.122"
"SMTPC" 61108 1569 "2009-11-15 01:40:56.809" "62.149.128.154" "RECEIVED: 250 mxavas14.aruba.it"
"SMTPC" 61108 1569 "2009-11-15 01:40:56.809" "62.149.128.154" "SENT: MAIL FROM:<sabrina@note.it>"
"SMTPC" 61108 1569 "2009-11-15 01:40:56.825" "62.149.128.154" "RECEIVED: 250 ok"
"SMTPC" 61108 1569 "2009-11-15 01:40:56.825" "62.149.128.154" "SENT: RCPT TO:<simone@rockopera.it>"
"SMTPC" 61108 1569 "2009-11-15 01:40:56.841" "62.149.128.154" "RECEIVED: 250 ok"
"SMTPC" 61108 1569 "2009-11-15 01:40:56.841" "62.149.128.154" "SENT: DATA"
"SMTPC" 38940 1569 "2009-11-15 01:40:56.841" "62.149.128.154" "RECEIVED: 354 go ahead"
"SMTPC" 38940 1569 "2009-11-15 01:40:56.841" "62.149.128.154" "SENT: [nl]."
"SMTPC" 38940 1569 "2009-11-15 01:40:56.919" "62.149.128.154" "RECEIVED: 250 ok 1258245653 qp 1352"
"SMTPC" 38940 1569 "2009-11-15 01:40:56.919" "62.149.128.154" "SENT: QUIT"
"SMTPC" 38940 1569 "2009-11-15 01:40:56.919" "62.149.128.154" "RECEIVED: 221 mxavas14.aruba.it"

MAILENABLE EMAIL HEADER
Received: from localhost ([127.0.0.1]) by home with MailEnable ESMTP; Wed, 11 Nov 2009 11:55:23 +0100
Received: from 94.160.185.44 ([94.160.185.44]) by
webmail.nuovocaffedelteatro.it (Horde MIME library) with HTTP; Wed, 11 Nov
2009 11:55:23 +0100
Message-ID: <20091111115523.4cvyuqcak0sgcocw@webmail.nuovocaffedelteatro.it>
Date: Wed, 11 Nov 2009 11:55:23 +0100
From: luca@nuovocaffedelteatro.it
To: bar@nuovocaffedelteatro.it
Subject: PROVA DI MENU
MIME-Version: 1.0
Content-Type: text/plain;
charset=ISO-8859-1;
DelSp="Yes";
format="flowed"
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
User-Agent: Internet Messaging Program (IMP) H3 (4.1.4)
Precedence: list
Reply-To: bar@nuovocaffedelteatro.it
Sender: simone@nuovocaffedelteatro.it
Return-Path: <simone@nuovocaffedelteatro.it>

^DooM^ · Post by **^DooM^** » 2009-11-15 11:44

"SENT: 220 62.149.169.122 ESMTP" <- hMail Sent
"RECEIVED: EHLO localhost" <- Horde Sent

Received: from localhost ([127.0.0.1]) by home with MailEnable ESMTP; Wed, 11 Nov 2009 11:55:23 +0100

That says mailenable and localhost which seems the same to me.. I don't see the difference.

This looks like a horde config problem. I have never used it.

westdam · Post by **westdam** » 2009-11-17 16:33

ok i try to help "simonegiusti" ( seems to be an italian.. )
Doom the problem in italy is this :
the PTR associated to his server is owned by Aruba.it one of the BIGGEST italian ISP. It's not a "home" ISP ( most of his business is done to company and not to end-user.) . The IP is a dynamic IP assigned statically.
In italy unfortunately most of the providers DO this and we've got lots of trouble.

Also i dont think Aruba let simone to handle his PTR so it's assigned by ISP and CANNOT BE CHANGED.

Anyway you can do something to "cheat" hotmail ( in primis.. )

Simone, you have to set-up SPF and DKIM for every domain,and use the smarthost for hotmail sending trough aruba SMTP server.Also in the hostname of hmailserver use the PTR name. sometimes works also if you create a "dummy" domain with the same domain of the ptr.

Also the dnsbl entry found of your IP is due to your " netblock". Someone has spammed around with an ip inside your netblock and the dnsbl has blocked all the netblock. No clue for this.. generally the procedure is this : your ISP ( aruba ) has to ask to the dnsbl to remove your ip.. Of course they dont do for you..
I've got the same trouble with fastweb. no solution .. i've changed IP and ISP.

i'm italian, if you need more help, i'm here..

simonegiusti · Post by **simonegiusti** » 2009-11-17 16:55

thanks!!!

Grazie!!

westdam · Post by **westdam** » 2009-11-17 17:08

as example :

Entry matching your Query: E-365698
85.18.0.0/17

my server ip is 85.18.45.20x ( just for spambot ) . as you can see my server is listed on apews.org and uceportect-lvl3

noway to handle this..
i've got AGAIN to change IP address.. of course it's impossible for me.. it's a 8mb up/8mb down line ADSL in italy with 8 IP static address. no way to manage ptr. and no way to set up as "static" . on router i've to set up as " dynamic" but never changes..

Messages marked as SPAM

Messages marked as SPAM

Re: Messages marked as SPAM

Re: Messages marked as SPAM

Re: Messages marked as SPAM

Re: Messages marked as SPAM

Re: Messages marked as SPAM

Re: Messages marked as SPAM

Re: Messages marked as SPAM

Re: Messages marked as SPAM

Re: Messages marked as SPAM

Re: Messages marked as SPAM

Re: Messages marked as SPAM