Email sent is marked as spam

[MrBryce2000]

I have an interesting issue. My Zimbra server is running fine, however email sent outside is sometimes marked as spam by providers like Yahoo that have powerful spam filters.

I can't find out why it's being sent to spam. What can I do to find out what's going on?

Thanks!

[bdial]

A few of the big things that can cause your mail to be flagged.

1. It's on some blacklist. Check Email Blacklist Check - See if your server is blacklisted and put in your mta's ip address and see if it's on any blacklists

2. does your server have a reverse dns entry that matches with the A record. Ideally this should be the same address it announces itself in EHLO too.

3. Do you use a spf record and does it include your mta?

[phoenix]

In addition the the advice above, if you look at the full headers of the mail in the spam folder you should be able to determine why the receiving server thought it was spam.

[MrBryce2000]

I'm sorry, I don't quite understand #3.

Phoenix, unfortunately the email header doesn't tell me the reason for putting the email in spam. So far, though, the issue has only been with Yahoo, AT@T, and a few Hotmail accounts.

The report sent to the admin account showed that Hotmail had blacklisted the IP address of our DSL.

[MrBryce2000]

Hang on, let me amend what I previously said about the email header. I neglected to view the full email header before. Here is the full header of an email I sent earlier today:

From admin@fairhavenchurch.org Thu May 15 09:24:13 2008
X-Apparently-To:	mrbryce2000@yahoo.com via 68.142.207.196; Thu, 15 May 2008 09:24:18 -0700
X-YahooFilteredBulk:	69.95.182.66
X-Originating-IP:	[69.95.182.66]
Return-Path:	
Authentication-Results:	mta191.mail.re4.yahoo.com from=fairhavenchurch.org; domainkeys=neutral (no sig)
Received:	from 69.95.182.66 (EHLO mail.fairhavenchurch.org) (69.95.182.66) by mta191.mail.re4.yahoo.com with SMTP; Thu, 15 May 2008 09:24:18 -0700
Received:	from localhost (localhost.localdomain [127.0.0.1]) by mail.fairhavenchurch.org (Postfix) with ESMTP id B84A17320002 for ; Thu, 15 May 2008 12:24:13 -0400 (EDT)
X-Virus-Scanned:	amavisd-new at
X-Spam-Flag:	NO
X-Spam-Score:	-2.77
X-Spam-Level:	
X-Spam-Status:	No, score=-2.77 tagged_above=-10 required=6.6 tests=[AWL=-0.271, BAYES_00=-2.599, RDNS_NONE=0.1]
Received:	from mail.fairhavenchurch.org ([127.0.0.1]) by localhost (mail.fairhavenchurch.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SmuYOzXrGjoA for ; Thu, 15 May 2008 12:24:13 -0400 (EDT)
Received:	from mail.fairhavenchurch.org (mail.fairhavenchurch.org [192.168.1.153]) by mail.fairhavenchurch.org (Postfix) with ESMTP id 77F5C7320001 for ; Thu, 15 May 2008 12:24:13 -0400 (EDT)
Date:	Thu, 15 May 2008 12:24:13 -0400 (EDT)
From:	admin@fairhavenchurch.org  Add Mobile Alert
To:	mrbryce2000@yahoo.com
Message-ID:	<461068523.580611210868653479.JavaMail.root@mail.fairhavenchurch.org>
Subject:	Test part 3
MIME-Version:	1.0
Content-Type:	text/plain; charset=utf-8
Content-Transfer-Encoding:	7bit
X-Originating-IP:	[74.218.208.98]
X-Mailer:	Zimbra 5.0.5_GA_2201.RHEL5_64 (ZimbraWebClient - FF2.0 (Win)/5.0.5_GA_2201.RHEL5_64)
Content-Length:	51

I sent the same email to my account at work, and it came through perfectly.

[bdial]

SPF records are records you can add to your domain that help other e-mail servers out. Basicly the record says "mail from this domain only comes from the following servers:" and you put the ip addresses of your servers. If you had an spf record, created a new mail server and didn't add it's ip to the record that would be big problem. But you probably don't have one.

Anyway, are you using residential dsl to host your mail server? I know many anti-spam systems, such as Sophos Puremessage have spam tests that look at the ip blocks and even the hostname to determine if it's a residential block and often score those pretty high.

[MrBryce2000]

I'm wondering if that is what's happening. I think that it's a business DSL (our IP address is static), but I'm not sure since I didn't set it up.

Is the option to setup a spf account in the domain section of the Zimbra admin?

[bdial]

No, SPF records are setup in your dns zone. If you run BIND yourself you can do it otherwise if your domain is hosted somewhere else you'll have to see if they support it.

[MrBryce2000]

I am running BIND in house. It's running on the server that's handling the Internet traffic (proxy, filter, firewall, etc...).

I use Webmin to manage my BIND server, and I saw a section for "Sender Permitted From Records." Is that it?

[bdial]

HOWTO - Define an SPF Record

here is a good resource then. I'm not sure if this will solve your problem or not, I guess it depends on how much weight yahoo gives a spf record if any, but it is a good practice.