1

I am hosting email on my own server that has SPF, DKIM & DMARC all passed.

Problem:

When sending out emails, GMail receives the email and confirms the security information matches, is valid and passes. Using free tools such as MX Toolbox & gsuite toolbox MX lookup all report good (except GSuite - designed for gmail operated servers) & various other tools all report the email setup is good.

Outlook on the other hand keeps sending my email to Junk mail with the line:

This message was identified as junk. It's not junk | Show blocked content

I found the this site mentioning Spam Confidence Level, and searching for some meaning, it is suggested that a 0 means it is good, and 5 means straight to junk. The email headers (see below) show the offending email is an SCL 0.

X-MS-Exchange-Organization-SCL: 0

Authentication-Results: spf=pass (sender IP is 139.162.179.128)
    smtp.mailfrom=yourbud.co.za; hotmail.com; dkim=pass (signature was verified)
    header.d=yourbud.co.za;hotmail.com; dmarc=pass action=none
    header.from=yourbud.co.za;compauth=pass reason=100

Received-SPF: Pass (protection.outlook.com: domain of yourbud.co.za designates
    139.162.179.128 as permitted sender) receiver=protection.outlook.com;
    client-ip=139.162.179.128; helo=yourbud.co.za;

Received: from yourbud.co.za (139.162.179.128) by
    CO1NAM11FT027.mail.protection.outlook.com (10.13.174.224) with Microsoft SMTP
    Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
    15.20.3216.10 via Frontend Transport; Fri, 24 Jul 2020 10:28:16 +0000

The only problems(s) I can foresee being an issue is:

  1. The email that is sent is a registration acknowledgement email. The email contains remote content (hosted on a different site - an image), and
  2. also contains 2 tags referencing javascript files hosted remotely.
  3. Reverse DNS lookup doesn't point to the domain (but this is only shown as a 'warning')

If non of these are an issue, I can only resort to Outlook with its internal (blackbox) spam rules causing this 'junk' email being assigned.

Any suggestions or reasons why my email(s) would be considered Junk by Outlook?

Email headers as copied from Outlook

Received: from CO1NAM11HT064.eop-nam11.prod.protection.outlook.com
(2603:10a6:800:bc::31) by VI1PR0402MB3568.eurprd04.prod.outlook.com with
HTTPS via VI1PR0602CA0021.EURPRD06.PROD.OUTLOOK.COM; Fri, 24 Jul 2020
10:28:18 +0000
Received: from CO1NAM11FT027.eop-nam11.prod.protection.outlook.com
(2a01:111:e400:3861::4a) by
CO1NAM11HT064.eop-nam11.prod.protection.outlook.com (2a01:111:e400:3861::98)
with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.10; Fri, 24 Jul
2020 10:28:17 +0000
Authentication-Results: spf=pass (sender IP is 139.162.179.128)
smtp.mailfrom=yourbud.co.za; hotmail.com; dkim=pass (signature was verified)
header.d=yourbud.co.za;hotmail.com; dmarc=pass action=none
header.from=yourbud.co.za;compauth=pass reason=100
Received-SPF: Pass (protection.outlook.com: domain of yourbud.co.za designates
139.162.179.128 as permitted sender) receiver=protection.outlook.com;
client-ip=139.162.179.128; helo=yourbud.co.za;
Received: from yourbud.co.za (139.162.179.128) by
CO1NAM11FT027.mail.protection.outlook.com (10.13.174.224) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.3216.10 via Frontend Transport; Fri, 24 Jul 2020 10:28:16 +0000
X-IncomingTopHeaderMarker:
OriginalChecksum:D6E88F9C3151AD1520248CC6645772B9A844F849CC8DD8AE6FC5EE749606FDCD;UpperCasedChecksum:6D610C90E52DC49F78193B59691F7671260AB8D9FA44022959281D00B67325CE;SizeAsReceived:1057;Count:9
Received: from yourbud.co.za (li1496-128.members.linode.com [139.162.179.128])
by yourbud.co.za (Postfix) with ESMTPSA id 516F360788
for <cybergurken2@hotmail.com>; Fri, 24 Jul 2020 10:28:15 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=yourbud.co.za;
s=default; t=1595586495;
bh=rf9CbVnEOPPPXRX4Xn4gJ7V+mAmKS3JLdceKFyVbv0Y=;
h=From:To:Subject:Date:From;
b=SY5KOcJyv9CT5M3ZOcquaxxG3jB9r2Dvv4dJIGy+jDbwfn+Jo/QdKjF27D+CeCfwg
QWxAemMvskyt5Rk4faiMaSZVV3PId5P39OUXaapdvwihX6euQCUbKroV3nJK8ERM1y
CL6zYcOzUgPiLwukszQQvTY8NaeTmPjFhHs3GOi2hmoaZGsiFdu1FqsHszZBi41Jrj
fH2xU5PK/JrrT6Jy2Ad7hRA1NPdLurGc/g//V6i57oy21u9ZltwWeqBTOaKEETSgd4
Mjyw5P9JxT7hrUyGZRKv67fGrKjoXGZ2e+jqAa8dQ1lOWFczXULnFGt2U3NFlvqQKV
CxeC+WPJBYRPQ==
Content-Type: multipart/alternative;
boundary="--_NmP-5b401d2cab41559d-Part_1"
From: admin@yourbud.co.za
To: cybergurken2@hotmail.com
Subject: Welcome to YourBud.co.za
Message-ID: <c83152f9-34b4-3443-9d12-4868de1a1fe9@yourbud.co.za>
Date: Fri, 24 Jul 2020 10:28:15 +0000
X-IncomingHeaderCount: 9
Return-Path: admin@yourbud.co.za
X-MS-Exchange-Organization-ExpirationStartTime: 24 Jul 2020 10:28:16.7587
(UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id:
2d6caf9e-b012-4f6b-a528-08d82fbc472f
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-MS-PublicTrafficType: Email
X-MS-Exchange-Organization-AuthSource:
CO1NAM11FT027.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-UserLastLogonTime: 7/24/2020 10:27:30 AM
X-MS-Office365-Filtering-Correlation-Id: 2d6caf9e-b012-4f6b-a528-08d82fbc472f
X-MS-TrafficTypeDiagnostic: CO1NAM11HT064:
X-MS-Exchange-EOPDirect: true
X-Sender-IP: 139.162.179.128
X-SID-PRA: ADMIN@YOURBUD.CO.ZA
X-SID-Result: PASS
X-MS-Exchange-Organization-PCL: 2
X-MS-Exchange-Organization-SCL: 0
X-Microsoft-Antispam: BCL:0;
X-Forefront-Antispam-Report:
CIP:139.162.179.128;CTRY:DE;LANG:en;SCL:0;SRV:;IPV:NLI;SFV:NSPM;H:yourbud.co.za;PTR:li1496-128.members.linode.com;CAT:NONE;SFTY:;SFS:;DIR:INB;SFP:;
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Jul 2020 10:28:16.5688
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 2d6caf9e-b012-4f6b-a528-08d82fbc472f
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-AuthSource:
CO1NAM11FT027.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:
00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO1NAM11HT064
X-MS-Exchange-Transport-EndToEndLatency: 00:00:02.1114274
X-MS-Exchange-Processed-By-BccFoldering: 15.20.3195.028
X-Microsoft-Antispam-Mailbox-Delivery:
abwl:0;wl:0;pcwl:0;kl:0;iwl:0;dwl:0;dkl:0;rwl:0;ucf:0;jmr:0;ex:0;auth:1;dest:J;OFR:SpamFilterAuthJ;ENG:(5062000282)(90000022)(90005022)(91005020)(90014020)(91030020)(91040020)(9000001)(9005001)(9010001)(9030002)(9050020)(9100041)(5061607266)(5061608174)(4900115)(8390131)(8377080)(8386120)(8385121)(8383139)(875032)(8403011)(98390011)(58390011)(8399029)(4920090)(6350004)(4950130)(4990090)(9140004);RF:JunkEmail;
X-Message-Info:
qoGN4b5S4yo5umTJnHtKQWtfa0SN0JXhKWe6INf3tAikNr42t9YIFWqlQp4yP5oT2O+dVVhN9XgsSIGBa0nlS8WXG26Qyl8N7jb+3A7mXo1my7M5pXsXt706fyCgbzlD71VE9nGR/mFTxbtfOYJYo4CTBDoMMNDY9LcCPKehnFljrwC4vjmxtN1zrbZblSnTUOytcKVQ5Mx3gJWwEayQ6g==
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtHRD0yO1NDTD02
X-Microsoft-Antispam-Message-Info:
=?utf-8?B?YVdMNWpKU05KY2ZBYXZ4Y0FHWHlPM0VQaU1vNnoxYXVJZUp5QldCOVRjZTZR?=
=?utf-8?B?b0tqS2Y1Qjk2UXpXeVhHaWlGOFhtdCtmR3JnS0FWVmp3KzZtKzhLY1k5Tm9H?=
=?utf-8?B?SVlzc1lsTjdHZ0N1NnFKU0FxaTc4K1oxQWRYcjVaN1dUOXZvc1JXeUV2NkRU?=
=?utf-8?B?ZTFVbVE2aTdFVDVUS08rN29xWGlJK3FRYVlmdUtIMWtZSFdvMTU2aGlva0Ux?=
=?utf-8?B?RzdBQUNCNTVZbWpuRC9ieHg3NGNWK2Mrc2paMko4R2pEOVVQaTlWblYvYmNi?=
=?utf-8?B?NTFBbS9jcXp4TDZwTzV1UnR2SXhIYnRZMFF3V0hIZnZycjgxQmlURXNDNXRN?=
=?utf-8?B?Y3BJckFMMU5zTnhLTTk1dXFUQVBkbkExUmVDRmd1ZXk0N3QvK3hlY0x6TStY?=
=?utf-8?B?VDlycVk0QXZOZk1IczhrSG0xVkZpOWlSY2xlQjNSTmJRMkorU3QxY1RiajZj?=
=?utf-8?B?VUNYbXk4TVlzUmpvUHNLZ1Q5MUtSN1NRUWE5RGNFdXRLRWdFWFNRTHkvVDVs?=
=?utf-8?B?anltNW1sRGdtS2RPVUVhU0lRQUhxclhWdjJHNnNvb2VMdDJ2Y3BwdEF4ZnEy?=
=?utf-8?B?b2NPUjZiWlVPZ0hVVEtDL21VZmFIK3BscFQ3VkRXbjhMWkY0K2Zyai9UNFN6?=
=?utf-8?B?eWxZZFdvN3JSRytoakNuQlRZeDljSEpwZ1hacC9SOW1ZSm13VVN1UjIyWHBo?=
=?utf-8?B?MUg3SGtydDBoVFhxclVvVjF4TjYxdU00SDV4eTZFeXZKQ1VVVTkvMHJ0RFA2?=
=?utf-8?B?YWV5MHR1YnFSc1RqcTI1Q3p1Rlg4TlBqdWZWT2hOc21aeGlRQ0ZmUkZBeVZ1?=
=?utf-8?B?MnhrZlF5WUdGa0dvTW5qTkY2MThCU09zaWVuR3Qyb0l5L2dYVXRodVBIU2NB?=
=?utf-8?B?LytZbW1nNENuWmZoWnpWRWZObDY5RndyMzc1bEQxcUdhMFE0aGpWc3JiUDJQ?=
=?utf-8?B?K1EwLy9zZm9UdzNaVFlzaE84TEdBZTMzZU00eEJzZXBrUGF1N2t3Z090eEgy?=
=?utf-8?B?Tng0NHpwOHMwQjh4QjVVL0QvMGtZTDZZTHVxbXpiejV5bCtLcHBwS2NiQzRG?=
=?utf-8?B?ZUdUNEFpNnFwSWRQU2NUVitPcXdUc0s4UUNCbEVVNjkxc05SSGFHc2ZSU2Fz?=
=?utf-8?B?bjg2cGluWDVQeVVLVWZMZ2VTS2dqbHcrNGxDZFpBbjdFd3U1dnZMWXRFd2dF?=
=?utf-8?B?REtKUFZ4UnJjOGZQYmt5U05oSkRQaW9pTWJTSTZKZkdmV3lCZGZlQkNiOXFj?=
=?utf-8?B?emI5RWc1Vm4rWHc4anNxR3BmMHczamtUQTRPTi9NWHVHMnlMa3VxcGRYUXVM?=
=?utf-8?B?UFRLbTlucnY1djk5R3pqcDhFbmFOYkpNZXlQWEVRaWE2dGhNcHhkd3NqYW92?=
=?utf-8?B?RXlaNGFEbHRDWEdDNW9FMWtlMktyOGtNUkZXaDNZTG9oaXB0a0krNnR2YnpN?=
=?utf-8?B?TlFlT0pZOTlIcmxOU3R2ZW13Vm0ydGdqNCs5eWFkOCtBeEdoaWRjdDkzNWVF?=
=?utf-8?B?eXh2cHJTT2t3SEttTWlyUzQvT3oxM0w4QW9yQk9NNzRJRGRkeFBjd2JtUkpZ?=
=?utf-8?B?Q1BrQT09?=
MIME-Version: 1.0
CybeX
  • 323
  • 2
  • 7
  • 18
  • 1
    Your guess is as good as anyone else's. MS is one of the most aggressive at marking actually wanted mail as junk, and as it's been going on for years with apparently no large number of complaints from customers, I suspect most people don't know or care that they're losing mail. I try to gently steer people away from MS's email products primarily for this reason. – Michael Hampton Jul 24 '20 at 12:40

2 Answers2

2

Microsoft, Google and Yahoo have to be aggressive on spam, as Michael says. They have millions of customers, receiving potentially billions of spam emails a day. Consider the cost in data storage alone. Let alone bandwidth, etc.

I think that you have already mentioned it. Hosting an image on a different web-site is a good marker for phishing. You should host it on your own web-site, under the yourbud.co.za domain somewhere. Try sending your email without it.

All links should be internal to the domain too. Ideally, they should be reasonably static. Avoid common markers used for tracking, such as link to https://www.yourbud.co.za/?id=your@email.com or https://www.yourbud.co.za/?id=swfofj3490834h.

Even something as simple as using HTTP rather than HTTPS could be the root cause.

I would also try changing the wording of the email. Try avoiding common phrases used by spammers and phishers. Look in your own Spam folder for phrases and wording to try and ignore.

You are using a cheap, maybe free, SSL certificate provider. With SSL certificates, you get what you pay for. Google their name in line with "hotmail" to see if there are any issues there.

I feel that testing different messages will be your only option.

If this does turn out to be the root cause, then you should ensure that you regularly email your hotmail account to ensure that MS has not changed their rules to your detriment.

Good luck!

Marcus Anderson
  • 21
  • 2
1

Based on the header X-Forefront-Antispam-Report: having spam confidence level SCL:0 it seems indeed that the email server didn't mark the message as junk, but it's more likely it's Outlook that was internally filtering the message.

As I've explained on my answer to your another question, it may have been the message contents that are causing this. One is that the message is loading suspicious external content, but it may also affect the spam filtering results that yourbud.co.za is a cannabis business. If the message contains word marijuana, that alone might be an indicator of spam in the eyes of US companies like Microsoft. I can imagine email marketing might be hard for a legal cialis or viagra business, too.

Esa Jokinen
  • 46,944
  • 3
  • 83
  • 129