Mail problems

[SteveRiley]

In my own testing, I discovered that the combination of no PTR plus no SPF would reliably cause Gmail to junk any messages from my domain. When I created an SPF record, Gmail stopped junking mail and would deliver it correctly. Only after I switched ISPs was I able to get a static address and thus have a correct PTR record for my MX. I have not yet tested what Gmail would do if I removed my SPF and relied only on the PTR.

[Feathers McGraw]

I think "damn my colour blindness"

Having only recently learned about SPF records, I'm not one to talk, but it does seem odd that they don't have one to stop other domains from sending spam using their addresses in the headers.

Still, the lack of SPF records shouldn't affect earthlink's outgoing email because of the matching PTR records. Their DNS servers have funky names too:

feathers-mcgraw@Hobbs-T440s:~$ dig -x 207.69.195.71

; <<>> DiG 9.9.5-4.3ubuntu0.1-Ubuntu <<>> -x 207.69.195.71
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34706
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;71.195.69.207.in-addr.arpa.    IN      PTR

;; ANSWER SECTION:
71.195.69.207.in-addr.arpa. 86400 IN    PTR     pop-siberian.atl.sa.earthlink.net.

;; AUTHORITY SECTION:
195.69.207.in-addr.arpa. 86400  IN      NS      [B]itchy.earthlink.net.[/B]
195.69.207.in-addr.arpa. 86400  IN      NS      [B]scratchy.earthlink.net.[/B]                      
                                                                                             
;; Query time: 254 msec                                                                      
;; SERVER: 127.0.1.1#53(127.0.1.1)                                                           
;; WHEN: Wed Feb 18 22:27:34 GMT 2015                                                        
;; MSG SIZE  rcvd: 145

Slightly off-topic: it's difficult to get information about Gmail's spam filtering - I guess it pays to be a bit secret about it. I've been trying to figure out if I really am getting more questions about Gmail's spam blocking because they changed something, or if it's just coincidence.

I wasn't running my server for long before I had my PTR record changed, so I'm not certain if my email was flagged as spam back then or not. IIRC Gmail was flagging it when I had a dynamic IP address, and I fixed it by switching to static IP. I think I found out the PTR using MX Toolbox's SMTP server test, which noticed the reverse DNS mismatch - not because of a spam problem.

Do you know if they've changed something recently, or am I just imagining?

[SteveRiley]

Here are the headers in the mail you sent:

Return-Path: <[I]...redacted@earthlink...[/i]>
Delivered-To: <[I]...redacted@rileyz...[/I]>
Received: from m92p.rileyz.net
        by m92p.rileyz.net (Dovecot) with LMTP id 1gmeAqfR5FQ/UgAAx4hJxQ
        for <[I]...redacted@rileyz...[/I]>; Wed, 18 Feb 2015 09:53:43 -0800
[COLOR="#008000"]Received: from pop-siberian.atl.sa.earthlink.net (pop-siberian.atl.sa.earthlink.net [207.69.195.71])
        by m92p.rileyz.net (Postfix) with ESMTP id C91A616A0586
        for <[I]...redacted@rileyz...[/I]>; Wed, 18 Feb 2015 09:53:40 -0800 (PST)[/COLOR]
[COLOR="#B22222"]Received: from [216.73.205.119] (helo=[192.168.1.123])
        by pop-siberian.atl.sa.earthlink.net with esmtp (Exim 3.36 #1)
        id 1YO8oc-0005MH-00
        for [I]...redacted@rileyz...[/I]; Wed, 18 Feb 2015 12:53:38 -0500[/COLOR]
Message-ID: <54E4D1AB.9030201@earthlink.net>
Date: Wed, 18 Feb 2015 09:53:47 -0800
From: [I]...redacted@earthlink...[/I]
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:32.0) Gecko/20100101 Firefox/32.0 SeaMonkey/2.29.1
MIME-Version: 1.0
To: [I]...redacted@rileyz...[/I]
Subject: Testing!
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Red section. 216.73.205.119 is in the address block ERLK-TW-LOSANGELES05 (216.73.192.0/19) -- this is, I'm guessing, the public IP address you get from Time Warner. The first machine inside Earthlink that sees your message is pop-siberian.atl.sa.earthlink.net (207.69.195.71). You wrote that you configured mail.earthlink.net as your sending server. That DNS name maps to any address in the range 209.86.93.201..211. Picking one of these at random -- 209.86.93.205 -- and performing a reverse lookup results in pop04.earthlink.net. Telneting to port 25 on that results in a message indicating that I've connected to pop-tawny.atl.sa.earthlink.net, which resolves to 207.69.195.67. Here we are back to a 207 machine again. There's obviously a farm of machines here: pop-SOMETHING.atl.sa.earthlink.net, popNN.earthlink.net. The server claims a different identity for itself (DNS name and IP address) inside the SMTP conversation -- but since this happening within Earthlink's message routing, it's probably not the source of the spam score. In any event, it's obvious that your mail client isn't trying to make a direct connection to a recipient's SMTP server.

Green section. Earthlink's server has correct A and PTR records in DNS, which is something that many receiving servers check. So that's good. It's interesting to note that Earthlink's mail servers aren't attempting to use TLS. Most ISPs have switched to using TLS so that mail is encrypted in transit. But again, I don't think Gmail would use the lack of TLS to increase a spam score.

Earthlink has no SPF record, which is rather unusual for an ISP today.

Anyway -- this is a pretty basic email exchange here. The only thing that stands out as a possible explanation is the lack of an SPF record. Feathers, what do you think?

[SteveRiley]

Hey, DYK: please send me an email (I'm PMing you my address). I'd like to take a look at the headers on your outbound email. This will help diagnosing potential problems. One immediate question it will answer is whether you're sending mail via Earthlink or if your computer is trying to make an SMTP connection directly to the recipient's mail server, as Feathers alluded to.

[life0riley]

Here are some additional things to check.

Check the port in the Outgoing Server (SMTP) Settings of SeaMonkey. I'm not sure when Earthlink enforced this.
http://www.wonk.com/SecureAuth.html

Try sending them an email using your EarthLink Web Mail to see what happens.

Could this be a blacklist issue? Here are some links.
Email Blocked by EarthLink
Email bounces because your IP address is blacklisted
Email Whitelist Instructions

[Feathers McGraw]

I think something about gmail's spam filtering changed recently, based on the questions I get from people setting up email servers.

Seems like they've tightened up a bit, you now need a matching PTR or SPF record or the email goes straight to spam. I'm pretty sure that wasn't the case before.

When you send email, how is it sent? Do you send it straight from your machine or is it submitted to earthlink? If it's sent directly then the records won't match, but the whole IMAP after SMTP thing would mean the email is still moved to your sent box.

[DoYouKubuntu]

Just a thought if you haven't done this already. Have you added your friend's email address to your contacts and has your friend done the same with your email address?

I almost never physically look at my address book (I have SM set to automatically add contacts), but I just looked and, yes, they're in there. I can't speak for my two friends--but I shouldn't need to, as we're all using e-mail addresses that were not previously having any of these problems. In other words, my Earthlink address is ~20 years old, my friends' gmail addresses are from...how long ago was it that gmail let the general public in? However long, that's how long it's been! So until just recently we were all merrily cruising along...and then something odd happened.

Can you tell if the email is getting trapped in the spam filter on the server?

Which server? Earthlink? Hmmmm... I long ago set my e-mail preferences [in my account on Earthlink] to the lowest/least oppressive filtering options, because I'm a big girl and don't need their hand-holding! I never use their webmail. Within SM, its adaptive junk filtering [or whatever it's called] correctly identifies junk and sends it to a folder I check before emptying. Definitely NONE of the missing e-mails has gone there.

[life0riley]

Just a thought if you haven't done this already. Have you added your friend's email address to your contacts and has your friend done the same with your email address?
Can you tell if the email is getting trapped in the spam filter on the server?

[DoYouKubuntu]

For the last few months I've had a variety of mail issues. One in particular is driving me nuts but I have no idea why it's happening, so I can't fix it. First, here's a rundown of what's happening, just off the top of my head:

1) sending mail fails (this is the super-annoying issue)

2) two friends aren't receiving my mail

3) Google/gmail thinks my mail is spam and prohibits it from going through--sometimes

4) I don't receive mail--from the same two friends as above

Regarding #1, SeaMonkey gives this message:

An error occurred while sending mail. The mail server responded: Unexpected failure, please try later. Please check the message and try again.

*BUT* the message closes AND goes to my 'sent' folder, as if it really did get sent. But it hasn't. Is that clear? The error message says it didn't send, it ends up in 'sent' as if it did send, but really it didn't send. Note that, normally, if sending mail fails for some reason, the mail remains open after you clear the error modal, and it does NOT get routed to the 'sent' folder.

Now, if I 'edit message as new' and try again, SOMETIMES it'll send on this second try and sometimes it won't. Sometimes it takes 3, 4, 5 attempts before I don't get that error message (and the mail really gets sent).

Regarding #2, there are two friends whose gmail accounts I send to and--sometimes--they never receive my mail. 99% of the time when this happens nothing bounces back to me--so as far as I know, I sent it, it went through, they received it...but they didn't. Here's what the ONE message that's bounced back to me said:

This message was created automatically by mail delivery software (Exim).

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

   FRIEND'S_ADDRESS@gmail.com
     SMTP error from remote mailer after end of data:
     host gmail-smtp-in.l.google.com [74.125.21.27]:
     550-5.7.1 [207.69.195.67      12] Our system has detected that this 
message is
     550-5.7.1 likely unsolicited mail. To reduce the amount of spam 
sent to Gmail,
     550-5.7.1 this message has been blocked. Please visit
     550-5.7.1 
http://support.google.com/mail/bin/answer.py?hl=en&answer=188131 for
     550 5.7.1 more information. y189si14689115ykb.127 - gsmtp

The page it points to says:

Why has Gmail blocked my messages?

Here at Gmail, we work very hard to fight spam. While in some cases we may classify a message as spam and deliver it to the spam folder, we also try to find ways to reduce the amount of spam being sent to Gmail in general. If we detect that a message has a strong likelihood of being spam, we’ll block the message from being sent to Gmail.

A message might be blocked if it contains suspicious-looking or spammy text or if the sending IP has had a history of sending unsolicited messages.

Is all of the mail I’m sending being blocked?

It’s likely that only a subset of the messages which have a strong likelihood of being spam are being blocked and not all of your messages. However, to help improve your deliverability, we recommend reviewing our Bulk Sender Guidelines.

If you’re forwarding mail to Gmail and your domain also forwards spam, we recommend reviewing our mail forwarding best practices.

Since nothing else applies, I'm guessing that the sentence I put in bold (above) is the relevant issue here.

'host' yields this:

$ host 207.69.195.67
67.195.69.207.in-addr.arpa domain name pointer pop-tawny.atl.sa.earthlink.net.

The e-mail account I'm having trouble with is my Earthlink address that I've had for ~20 years. Since switching from DSL to cable Internet, my service has been provided by Time Warner, but it's still an Earthlink account. When I send mail from any of my other accounts, i.e., non-Earthlink, such as from any of my domains, I don't have that annoying sending problem. And my friends don't typically send mail to me at any address but Earthlink (and I've been too lazy to have them test it).

And, if all that isn't fun enough, SOMETIMES I fail to receive mail FROM those two same people! But they get NOTHING back at their end, so we have no idea why it didn't come through.

My outgoing SMTP server is the same across the board, mail.earthlink.net (and SeaMonkey is the client I use across the board).

Ideas?