Email being detected as spam - domain isn't blacklisted

[gavm99]

Hi all,

This is a strange one.

I have a domain which has around 15 users running Exchange 2003 and either Outlook 2000, 2003 or 2007 on the desktop.

Some users (not all users) are having problems when they email customers, their email is being detected as spam. Another user on the same domain can email the spam customer and it will be delivered ok. This is happening with multiple customers.

The users have Word as their editor and do not have linked graphics or images in their email signatures.

Their email domain is not blacklisted.

I think it might be related to the older Outlook versions, but I have seen it happen with 2007 so that sort of counters that argument.

Has anyone seen this before?
Does anyone have any suggestions on how to fix this?

Thanks.

Gavin Moorhouse

http://www.lucidcomputersolutions.co.uk

 

[58sniper]

We can't assume that all mail going into the remote domains is going through the same solutions at the remote end. So, the sporadic nature may be from that side.

However, we need to look at a few things.
1. What's the rDNS entry look like for the public IP that your email goes out on?
2. What's the hostname that the server presents in the ehlo handshake?
3. The domain might not be blacklisted, but have you checked your public IP to see if it is?

Pat Richard MVP

 

[gavm99]

Hi,

Ok the check results are:

1. rDNS entry - there isn't one for the public IP
2. The hostname in the HELO handshake (not ELHO) is server.domain.local which matches the server and site.
3. The IP isn't blacklisted.

What I have also noticed is that in Exchange System Manager there is no SMTP connector showing under Connectors?!!

I look forward to your comments.

Gavin Moorhouse

http://www.lucidcomputersolutions.co.uk

Interested in my personal blog?

http://www.thelucidview.co.uk

 

[58sniper]

1. It's required by RFC. Call the ISP and have one configured for the same name that appears in your MX record (like "mail.domain.com"). Essentially, if I do an MX record lookup, and a rDNS lookup from the servers reported address, having them both be the same is a good thing. If you're using a cloud based hygiene service, this isn't possible. I'm making an assumption that the IP address that mail is going OUT is the same IP where mail comes IN. Interesting to note that the same RFC says that you cannot drop delivery of mail coming from systems with no or invalid rDNS entries, but a lot of systems do it.

2. That's a problem, as remote servers that do lookups against that name won't be able to find domain.local. You need to configure a masquerade name or FQDN in Exchange.

3. good.

BTW - this might be better served posted in the forum955 forum.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[franklin97355]

gavm99, you might also check as to what format they are sending the mail, html, rtf or plain text.

The answer is "42"