Emails suddenly was moved to spam

Rawasi
Rawasi used Ask the Experts™
on
We have a website that receive comments on subjects , when a user leave a comment , an automatic email is generated and sent to our team>
few days ago, suddenly the emails started to be flaged as spam potential and was put in the spam folder.

this is the message:
This is a multi-part message in MIME format.

------=_NextPart_000_0005_01CA9FB0.07CE46E0
Content-Type: text/plain;
      charset="windows-1256"
Content-Transfer-Encoding: base64

3eT4x8ou3+bjCSAgZmFubmF0PGh0dHA6Ly93d3cuZmFubmF0LmNvbS9pbWFnZXMvaWNvbi5naWY+
IAkNCt7H4yBzYW15IDxtYWlsdG86PiANCsjF1sfdySDK2uHt3iDa4ewgJ+Xt5uTPx+0g0+bkx8rH
IDIwMDknIMja5ObH5CAnJyDm5dDHIOTVIMfhytrh7d46IA0Kx+THINrkz+0g0+bkx8rHIDIwMDkg
yNMgMi40IObH4c3e7d7JIMfk5ccg0+3H0ckgzeHmySDmIN3O48kg5iDe5u3JIN/K7dENCuYgyOTV
zSDH4czj7dog3e3lxyANCg==

------=_NextPart_000_0005_01CA9FB0.07CE46E0
Content-Type: text/html;
      charset="windows-1256"
Content-Transfer-Encoding: 8bit

<table dir="rtl" align="right" style="border:1px solid #aaaaaa; width:500px" border="0"
      cellpadding="5" cellspacing="0">
      <tr>
            <td valign="middle" style="width: 400px; border-bottom:3px double #aaaaaa"><b>¿¿¿¿¿.¿¿¿</b></td>
            <td style="border-bottom:3px double #aaaaaa" align="left"><img src='http://www.fannat.com/images/icon.gif' alt='fannat' align='absmiddle' /></td>
      </tr>
      <tr>
            <td colspan="2">
                  <div dir="rtl">
                        <div dir=rtl>¿¿¿ samy <a href='mailto:'></a> <br> ¿¿¿¿¿¿ ¿¿¿¿¿ ¿¿¿ '¿¿¿¿¿¿¿ ¿¿¿¿¿¿ 2009' ¿¿¿¿¿¿ '' ¿¿¿¿ ¿¿ ¿¿¿¿¿¿¿: <br>¿¿¿ ¿¿¿¿ ¿¿¿¿¿¿ 2009 ¿¿ 2.4 ¿¿¿¿¿¿¿¿ ¿¿¿¿ ¿¿¿¿¿ ¿¿¿¿ ¿ ¿¿¿¿ ¿ ¿¿¿¿ ¿¿¿¿ ¿ ¿¿¿¿ ¿¿¿¿¿¿ ¿¿¿¿ </div>
                  </div>
            </td>
      </tr>
</table>



the Content analysis details are as follows:
---------------------------------------------------------

Content analysis details:   (5.7 points, 5.0 required)

 pts rule name                               description
---- ----------------------                  --------------------------------------------------
 0.0 HTML_MESSAGE                   BODY: HTML included in message
 2.4 HTML_IMAGE_ONLY_08       BODY: HTML: images with 400-800 bytes of words
 2.8 MIME_BASE64_TEXT             RAW: Message text disguised using base64 encoding
 0.1 RDNS_DYNAMIC                   Delivered to trusted network by host with                                 dynamic-looking rDNS
 0.3 DYN_RDNS_SHORT_HELO_HTML Sent by dynamic rDNS, short HELO, and HTML
 0.1 AWL                    AWL: From: address is in the auto white-list


What is wrong with the email so that it was a potentially spam ????
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®

Commented:
The main problem is whatever script you have generating the email message is base64 encoding a plain text part. There is no legit reason for doing that as it's already just plain text. You only really need to encode binary data for attachments (like pictures/word documents/etc). Spamassassin sees this as a red flag because spammers might encode their text to avoid having spam filters catch the text.

The other problem is SA doesn't like that you have so much HTML with pictures and so little actual words in the email. Another spammer trick, replace words with pictures so filters don't "see" it.

You probably should fix these two things, but you could also just whitelist the sender for the email. http://wiki.apache.org/spamassassin/ManualWhitelist
By whitelisting those messages it'll add -100 to the score which will basically guarantee it isn't tagged as spam.

Author

Commented:
Thanks for your help
I will consider the 2 problems in my auto generated messages

about the : Whitelisting the sender, where should it happen ? can you give me some details on that ?
Commented:
Read this page: http://wiki.apache.org/spamassassin/ManualWhitelist

You edit /etc/mail/spamassassin/local.cf and add a line like:

whitelist_from  from@yourdomain.com

If you're using spamd you'll probably need to restart it to reread the config file.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial