Emails suddenly was moved to spam
We have a website that receive comments on subjects , when a user leave a comment , an automatic email is generated and sent to our team>
few days ago, suddenly the emails started to be flaged as spam potential and was put in the spam folder.
this is the message:
This is a multi-part message in MIME format.
------=_NextPart_000_0005_
Content-Type: text/plain;
charset="windows-1256"
Content-Transfer-Encoding:
3eT4x8ou3+bjCSAgZmFubmF0PG
IAkNCt7H4yBzYW15IDxtYWlsdG
IDIwMDknIMja5ObH5CAnJyDm5d
yNMgMi40IObH4c3e7d7JIMfk5c
zSDH4czj7dog3e3lxyANCg==
------=_NextPart_000_0005_
Content-Type: text/html;
charset="windows-1256"
Content-Transfer-Encoding:
<table dir="rtl" align="right" style="border:1px solid #aaaaaa; width:500px" border="0"
cellpadding="5" cellspacing="0">
<tr>
<td valign="middle" style="width: 400px; border-bottom:3px double #aaaaaa"><b>¿¿¿¿¿.¿¿¿</b><
<td style="border-bottom:3px double #aaaaaa" align="left"><img src='http://www.fannat.com/images/icon.gif' alt='fannat' align='absmiddle' /></td>
</tr>
<tr>
<td colspan="2">
<div dir="rtl">
<div dir=rtl>¿¿¿ samy <a href='mailto:'></a> <br> ¿¿¿¿¿¿ ¿¿¿¿¿ ¿¿¿ '¿¿¿¿¿¿¿ ¿¿¿¿¿¿ 2009' ¿¿¿¿¿¿ '' ¿¿¿¿ ¿¿ ¿¿¿¿¿¿¿: <br>¿¿¿ ¿¿¿¿ ¿¿¿¿¿¿ 2009 ¿¿ 2.4 ¿¿¿¿¿¿¿¿ ¿¿¿¿ ¿¿¿¿¿ ¿¿¿¿ ¿ ¿¿¿¿ ¿ ¿¿¿¿ ¿¿¿¿ ¿ ¿¿¿¿ ¿¿¿¿¿¿ ¿¿¿¿ </div>
</div>
</td>
</tr>
</table>
the Content analysis details are as follows:
--------------------------
Content analysis details: (5.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------
0.0 HTML_MESSAGE BODY: HTML included in message
2.4 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words
2.8 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding
0.1 RDNS_DYNAMIC Delivered to trusted network by host with dynamic-looking rDNS
0.3 DYN_RDNS_SHORT_HELO_HTML Sent by dynamic rDNS, short HELO, and HTML
0.1 AWL AWL: From: address is in the auto white-list
What is wrong with the email so that it was a potentially spam ????
few days ago, suddenly the emails started to be flaged as spam potential and was put in the spam folder.
this is the message:
This is a multi-part message in MIME format.
------=_NextPart_000_0005_
Content-Type: text/plain;
charset="windows-1256"
Content-Transfer-Encoding:
3eT4x8ou3+bjCSAgZmFubmF0PG
IAkNCt7H4yBzYW15IDxtYWlsdG
IDIwMDknIMja5ObH5CAnJyDm5d
yNMgMi40IObH4c3e7d7JIMfk5c
zSDH4czj7dog3e3lxyANCg==
------=_NextPart_000_0005_
Content-Type: text/html;
charset="windows-1256"
Content-Transfer-Encoding:
<table dir="rtl" align="right" style="border:1px solid #aaaaaa; width:500px" border="0"
cellpadding="5" cellspacing="0">
<tr>
<td valign="middle" style="width: 400px; border-bottom:3px double #aaaaaa"><b>¿¿¿¿¿.¿¿¿</b><
<td style="border-bottom:3px double #aaaaaa" align="left"><img src='http://www.fannat.com/images/icon.gif' alt='fannat' align='absmiddle' /></td>
</tr>
<tr>
<td colspan="2">
<div dir="rtl">
<div dir=rtl>¿¿¿ samy <a href='mailto:'></a> <br> ¿¿¿¿¿¿ ¿¿¿¿¿ ¿¿¿ '¿¿¿¿¿¿¿ ¿¿¿¿¿¿ 2009' ¿¿¿¿¿¿ '' ¿¿¿¿ ¿¿ ¿¿¿¿¿¿¿: <br>¿¿¿ ¿¿¿¿ ¿¿¿¿¿¿ 2009 ¿¿ 2.4 ¿¿¿¿¿¿¿¿ ¿¿¿¿ ¿¿¿¿¿ ¿¿¿¿ ¿ ¿¿¿¿ ¿ ¿¿¿¿ ¿¿¿¿ ¿ ¿¿¿¿ ¿¿¿¿¿¿ ¿¿¿¿ </div>
</div>
</td>
</tr>
</table>
the Content analysis details are as follows:
--------------------------
Content analysis details: (5.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------
0.0 HTML_MESSAGE BODY: HTML included in message
2.4 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words
2.8 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding
0.1 RDNS_DYNAMIC Delivered to trusted network by host with dynamic-looking rDNS
0.3 DYN_RDNS_SHORT_HELO_HTML Sent by dynamic rDNS, short HELO, and HTML
0.1 AWL AWL: From: address is in the auto white-list
What is wrong with the email so that it was a potentially spam ????
Do more with
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
The main problem is whatever script you have generating the email message is base64 encoding a plain text part. There is no legit reason for doing that as it's already just plain text. You only really need to encode binary data for attachments (like pictures/word documents/etc). Spamassassin sees this as a red flag because spammers might encode their text to avoid having spam filters catch the text.
The other problem is SA doesn't like that you have so much HTML with pictures and so little actual words in the email. Another spammer trick, replace words with pictures so filters don't "see" it.
You probably should fix these two things, but you could also just whitelist the sender for the email. http://wiki.apache.org/spamassassin/ManualWhitelist
By whitelisting those messages it'll add -100 to the score which will basically guarantee it isn't tagged as spam.
The other problem is SA doesn't like that you have so much HTML with pictures and so little actual words in the email. Another spammer trick, replace words with pictures so filters don't "see" it.
You probably should fix these two things, but you could also just whitelist the sender for the email. http://wiki.apache.org/spamassassin/ManualWhitelist
By whitelisting those messages it'll add -100 to the score which will basically guarantee it isn't tagged as spam.
Thanks for your help
I will consider the 2 problems in my auto generated messages
about the : Whitelisting the sender, where should it happen ? can you give me some details on that ?
I will consider the 2 problems in my auto generated messages
about the : Whitelisting the sender, where should it happen ? can you give me some details on that ?
Read this page: http://wiki.apache.org/spamassassin/ManualWhitelist
You edit /etc/mail/spamassassin/loc
whitelist_from from@yourdomain.com
If you're using spamd you'll probably need to restart it to reread the config file.
You edit /etc/mail/spamassassin/loc
whitelist_from from@yourdomain.com
If you're using spamd you'll probably need to restart it to reread the config file.
Premium Content
You need an Expert Office subscription to comment.Start Free Trial