Email from Qmail server being labelled as spam

jwshome
jwshome used Ask the Experts™
on
(I'm not at all an expert in server configuration, so the terms I'm using to describe my problem may be incorrect.  Apologies in advance...)

I am running qmail on a server.  When I send an email using the Windows Mail client from an individual account on this server (let's call it myname@server.com) to my gmail account (myname@gmail.com) the email goes right through to my inbox.

However, when I generate an email from a PHP program on the same server, and send it to the same gmail address, it gets classified as spam.

I have an SPF record on the server; don't have DKIM set up yet (will be doing that shortly).

But even so, I don't understand why GMail should interpret two emails from the same source differently.

Any ideas?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Daniel McAllisterPresident, IT4SOHO, LLC

Commented:
There are any number of things that could be making your php-generated message show up as SPAM -- I would want to see the "logs" of what triggered the label.

The good news is that those "logs" are often hidden in the "header" of the message -- so let's start by looking at the full header of both a message sent via an Outlook (or other program) client, and then one sent from the PHP script.

If comparing the headers doesn't lead you to "self discovery", post them here and we'll see what we can make of them.

NOTE: If posting here, it is NOT necessary to post the message CONTENTS -- just the headers... but the FULL headers!

Dan
IT4SOHO

Author

Commented:
Sorry for the delay in responding.

I'm not certain where to get the headers from, so I'll use my test email account at Yahoo (where I am getting the behavior I described above, and where Yahoo will show the headers).  I just sent two identical emails, one from my Windows Mail account, and one from a PHP script on the same server.  Here's the header, as Yahoo reports it, for the email from the Windows Mail account:

X-Apparently-To:             gvinetest1@yahoo.com via 98.138.85.181; Sun, 24 Oct 2010 04:05:56 -0700
Return-Path:             <jspector@mygrapevine.org>
X-YahooFilteredBulk:             174.122.80.50
Received-SPF:             pass (mta1035.mail.ac4.yahoo.com: domain of jspector@mygrapevine.org designates 174.122.80.50 as permitted sender)
X-YMailISG:             iJ3uCMwcZAq7mr03aGJksSq878v4eL6PAFcaUdwsGtvJj_D7 4ld..EKsn9LdoFbJ7HKZnggaCkIoTlOrybdWhncofHF.wmFBA9zg04TMOijl iTaEzJzK3Y8VuO5xtxrDAm2FwckzpNa7WJs0FpKR_pyqstVnven0cvNTxoPr RuZMOHP6VtA32b_jxO2x0bHPhRfkNCLPKWOFR6TSKMeCRUbpgrD23u8zWFdo jXWkKdg6KwurDKHpvuly3hDDaleZC1Xpztgof_JC0b8O_VDi5AVW_HchAhQa Bi5JapCyvwRRVsG.SEx1AV7gtxJF6Et6A6wt0dJc9NyRSJCGzuKAnVaeeFI7 8MnwWG3SsCz3YLqQDZkIlCJR39BX33n1HdJxyBICxswZCgrwV4s0fY1eBFCo 646j0IBoXW_.T25xWRQ68ZYc8MacwFgMpCHDJokmGqcfWJ_rBI8uQ8PRzH5n 60ZJ3S3LGDMu5Kcz7kzeNV5hcsnkoMHoO0CEZjhnbVi2aU.1HaioDQyj8KC0 O.X5KjfVJVDkJOsHIWIFzi.VW9U-
X-Originating-IP:             [174.122.80.50]
Authentication-Results:             mta1035.mail.ac4.yahoo.com from=mygrapevine.org; domainkeys=pass (ok); from=mygrapevine.org; dkim=neutral (no sig)
Received:             from 127.0.0.1 (EHLO server.mygrapevine.org) (174.122.80.50) by mta1035.mail.ac4.yahoo.com with SMTP; Sun, 24 Oct 2010 04:05:54 -0700
DomainKey-Signature:             a=rsa-sha1; q=dns; c=nofws; s=default; d=mygrapevine.org; b=BcBGE1DjEtKJEZ0PJtclGTV0d8Egzzlp0A5qTT82w/Hnw/UsLnlOyL+/4b1hRr4X254X4mB/1QJQMwoe2TUAwSQXxSM6FyWHge4cv0laosBuL+iyOs0sir+IK8DmaUx4; h=Received:Received:Message-ID:From:To:Subject:Date:MIME-Version:Content-Type:X-Priority:X-MSMail-Priority:X-Mailer:X-MimeOLE;
Received:             (qmail 26843 invoked from network); 24 Oct 2010 06:05:50 -0500
Received:             from pool-74-104-151-237.bstnma.fios.verizon.net (HELO dadstudy) (74.104.151.237) by server.mygrapevine.org with SMTP; 24 Oct 2010 06:05:50 -0500
Message-ID:             <69CAE1BB3A0C4AEE86B0364488489DF3@dadstudy>
From:             This sender is DomainKeys verified
"Jon Spector" <jspector@mygrapevine.org>  
Add sender to Contacts
To:             <gvinetest1@yahoo.com>
Subject:             School play is cancelled due to rain
Date:             Sun, 24 Oct 2010 07:05:50 -0400
MIME-Version:             1.0
Content-Type:             multipart/alternative; boundary="----=_NextPart_000_0029_01CB7349.E41F6260"
X-Priority:             3
X-MSMail-Priority:             Normal
X-Mailer:             Microsoft Windows Mail 6.0.6002.18197
X-MimeOLE:             Produced By Microsoft MimeOLE V6.0.6002.18263
Content-Length:             887


and here is the header, as Yahoo reports it, for the email from the PHP script:


X-Apparently-To:             gvinetest1@yahoo.com via 98.138.85.181; Sun, 24 Oct 2010 04:04:42 -0700
Return-Path:             <myaccount@mygrapevine.org>
X-YahooFilteredBulk:             174.122.80.50
Received-SPF:             pass (mta1006.mail.sp2.yahoo.com: domain of myaccount@mygrapevine.org designates 174.122.80.50 as permitted sender) ZSBjYWxsIHRoZSBvZmZpY2UgdG8gcmVjZWl2ZSBhIHJlZnVuZCBmb3IgeW91ciB0aWNrZXRzLgoKIAoK VGhhbmtzLgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKWW91IGFyZSByZWNlaXZpbmcg dGhpcyBlbWFpbCBiZWNhdXNlIHlvdSBzdWJzY3JpYmUgdG8gbXlHcmFwZXZpbmUgZm9yIHRoZSBUb3du IG9mIFdlc3RvbiwgYW5kIHlvdSBpbmRpY2F0ZWQBMAEBAQE-
X-YMailISG:             rN3NrtgcZAopx4h7yk_ne3RJEEMNSC2gbAJ_lewA8Z5lQa5j ZHrf8EWRn0mIevHe9i7EN059gk8Yt3QAllOtOsxJ14VJeTRiHZUmA1XQZQG0 4ZcQa69NBiUrA1Wb8.jAUHKlawtlJ4Vq7RivGzsJvV7T81a9zFtv0ScFCBCh kXfoGaG2A5mCga2gX5TZPXisj0R2HJRXAuVZCriDIy.UiKH8DR6giuRiJEBb M0UnA_BMFhwJS5nS0BWmRRoE8dqruf_n7dflbpupnnNRa4owV7yq8mBwGU4A c9pTrelhg4R86F7tMVtz796CPLcN0bYjs69ZoRR8HUQ2pkyWJ1kh3jJDp_Lc eTzTbQvBsNDcI8JURT1oH7K.FsASyOfcU_AJH2aI64np8.9xWuMVQYUxYS4S 9RWY_xanwHD7uegmDRfLWBx_h17A84qh1WlJ8Pf6IN9NRfXkmqJpfeX1MRNn vwRgC94qRONu7TnkcasmsLSsvFCwpvgaXCUb9xH2ek3RQfb9uXvIW_L6pLet s5PpAdnx1DqqhoKFocNVmXvC4AgieA6moTgg.NstM8sxeJRDPW74jAk04I4D 6rvECDCdEc3fADcPv7j9.fVtxSIHf80vQVPXBlN0adaO1g5.N8XOOgOxuVFQ 1KrmrjGb.EL1qQHQZ67.KAyCwLcei.yMNGRSkVJ2_LY6ngcwR0pngjP.6dfD rm9VWPzVGQfAd1zNQk8AJjEAX1ENu9RMdyUvhNV.cnYplxd5J7uhksWyYSaE 8RHdT_0.kru8vDxJRkW87pBBzpC_l1cciRVYy2UdtKQLumIlsoj0cQJRZCXm OVCgKtUqXc.nT7Df6.G47jf6_qFxG6F_d8tMOw9v1HNwrL1y2E2MAhO5R624 wxA6R3C1eMEgAHyTqAeTrGCN00sNbzku2nUETscJF1gxk6WWNZnySvPM8yNp 5f.Wduc.glrc6o3kC8eFfQWff2lA8t8a7I5wPP62JLN2lKOvF.Xs1z6gMTRt sL5dEyT_8JAcXX.B3wigmK.W3tdXH8gB.1Gk54usfBXuWmXYDD15s.fzinL_ 8pd1Hv7.MiIqCBRYJ3_cCpQHEa_YjYU2KiFRM1q70QiQBl1M0E8AcJbKadK2 qB6UTmbKrjuT1mNSYbHe1HrtAgvPQLEj4nPijpTJNQ--
X-Originating-IP:             [174.122.80.50]
Authentication-Results:             mta1006.mail.sp2.yahoo.com from=mygrapevine.org; domainkeys=pass (ok); from=mygrapevine.org; dkim=neutral (no sig)
Received:             from 127.0.0.1 (EHLO server.mygrapevine.org) (174.122.80.50) by mta1006.mail.sp2.yahoo.com with SMTP; Sun, 24 Oct 2010 04:04:41 -0700
DomainKey-Signature:             a=rsa-sha1; q=dns; c=nofws; s=default; d=mygrapevine.org; b=PKVI9u7nMtrsfdC/FxHfM+JlsTzERlSAiXnHprHJEwdqGaAq5ERR26iH5XRrLQaJezaNMdiGtzVwo18ykW+SaTsB+IRPUUcoT2+acbxtnYq3nhghUBpZKXsa2OMunJYy; h=Received:Received:Date:Return-Path:To:From:Reply-to:Subject:Message-ID:X-Priority:X-Mailer:MIME-Version:Content-Type;
Received:             (qmail 26813 invoked from network); 24 Oct 2010 06:04:39 -0500
Received:             from server.mygrapevine.org (HELO www.mygrapevine.org) (174.122.80.50) by server.mygrapevine.org with SMTP; 24 Oct 2010 06:04:39 -0500
Date:             Sun, 24 Oct 2010 07:04:39 -0400
Return-Path:             myAccount@mygrapevine.org
To:             gvinetest1@yahoo.com
From:             This sender is DomainKeys verified
myGrapevine <myAccount@mygrapevine.org>  
Add sender to Contacts
Reply-to:             myGrapevine <myAccount@mygrapevine.org>
Subject:             School play is cancelled due to rain (Sent at 07:04:39)
Message-ID:             <7f2817c40c980b7ae0840f0212fe46d6@www.mygrapevine.org>
X-Priority:             3
X-Mailer:             PHPMailer 5.1 (phpmailer.sourceforge.net)
MIME-Version:             1.0
Content-Type:             multipart/alternative; boundary="b1_7f2817c40c980b7ae0840f0212fe46d6"
Content-Length:             1537


Can you make any sense of this?  The two headers look identical to me, though there are obviously some differences somewhere that I'm not seeing.

Thanks in advance for your help.

Author

Commented:
Sorry, forgot to add one more thing that is confusing to me.  I am using a second approach to test whether my DOmainKeys setup is working properly.  According to the Yahoo email headers in the post above, it looks like they are OK.  But when I send a test email to 'sa-test@sendmail.net', I get back the following report, showing that the DOmainKeys signature is bad:

sendmail.net Sender Authentication Auto-Responder $Revision: 1.19 $

This service runs at <sa-test@sendmail.net> and allows remote users
to perform a simple, automated test to see if different Sender
Authentication schemes are working.  Mail sent to this service
is checked by our Sender Authentication filters for any valid
credentials or signatures.  A script receives the message, checks
for a special header with the results of the tests, and composes
this response message based on what it finds.  This response is also
signed with DomainKeys and DomainKeys Identified Mail (DKIM).

Please note that the DKIM filter signing this reply message conforms
to the latest IETF draft version, and thus may not be successfully
verified by older implementations.  If you are using dkim-filter from
Sendmail, Inc., upgrade to at least version 1.0.0 to be compatible
with the most recent version of DKIM.

We hope this service has been helpful to you.

Authentication System:       DomainKeys Identified Mail
   Result:                   (no result present)
   Reporting host:                              
   More information:         http://mipassoc.org/dkim/
   Sendmail milter:          https://sourceforge.net/projects/dkim-milter/

Authentication System:       Domain Keys        
   Result:                   DK signature confirmed BAD
   Description:              Signature verification failed, message may have been tampered with or corrupted
   Reporting host:           sendmail.net        
   More information:         http://antispam.yahoo.com/domainkeys
   Sendmail milter:          https://sourceforge.net/projects/domainkeys-milter/

Authentication System:       Sender ID          
   Result:                   SID data confirmed GOOD
   Description:              Sending host is authorized for sending domain
   Reporting host:           sendmail.net        
   More information:         http://www.microsoft.com/senderid
   Sendmail milter:          https://sourceforge.net/projects/sid-milter/

Authentication System:       Sender Permitted From (SPF)
   Result:                   SPF data confirmed GOOD
   Description:              Sending host is authorized for sending domain
   Reporting host:           sendmail.net        
   More information:         http://spf.pobox.com/


Again, I'm not an expert, bu the DomainKeys message doesn't sound good (!).

Maybe this will be helpful information as well.

Regards.
President, IT4SOHO, LLC
Commented:
OK... so the headers look similar enough... but I think you may be onto something...

Try sending the test message to sa-test@sendmail.net using each method... there may be an issue with how the php-generated e-mail is getting or generating its DK signature.

Dan
IT4SOHO

Author

Commented:
I don't have time to finish up this discussion, but the person responding was very thoughtful, and would have been able to help me solve the problem if I had the time to follow up.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial