6

My website is sending out email that RackSpace email is marking as spam. I'm trying to figure out why the email is being marked as spam and what I can do about it.

The most interesting header that the spam filter adds is the X-CNFS-Analysis header that looks like it has lots of information about what the spam filter is seeing. However, I don't know how to interpret the information in that header.

Here are all the headers that the spam filter has added to one of my emails:

X-Virus-Scanned: OK
X-Spam-Threshold: 95
X-Spam-Score: 100
X-MS-Exchange-Organization-SCL: 9
Precedence: junk
X-Spam-Flag: YES
X-Virus-Scanned: OK
X-MessageSniffer-Scan-Result: 0
X-MessageSniffer-Rules: 0-0-0-6537-c
X-CMAE-Scan-Result: 100
X-CNFS-Analysis: v=2.1 cv=N/QQSQNB c=1 sm=0 tr=0 p=9ykYl8AZAAAA:8 a=Nk1C7OHzZdtRZR7HpOBzRA==:117 a=Nk1C7OHzZdtRZR7HpOBzRA==:17 a=6KVD7agYW9oA:10 a=DYL8iF3SNlAA:10 a=pdDdBm1-2EwA:10 a=m6qU47vR8oQA:10 a=8StPLQsqK-w3qlaorP8A:9 a=57urXIHmFmcA:10 a=abufaKy4Sp0A:10

More info about my specific situation: These emails are being sent to me at my Rackspace email address. The server is hosted on Amazon AWS. The emails are being sent using Amazon SES. I also send a newsletter this way. I'm not having problems with the newsletter, only the email alerts that my server sends to me to let me know of problems.

I feel that if I could decipher the headers, I could diagnose the problem.

Improve this question
5
  • also check spamcop(spamcop.net) website and make sure it is not listed their. To do that enter your hosting IP here(spamcop.net/bl.shtml)
    – Bala
    May 10, 2014 at 12:54
  • 1
    I have had good luck checking mxtoolbox.com/blacklists.aspx for customers in the past. Odds are, you are on a black list somewhere. Some subscriber IP addresses and other similar IP addresses, for some sites, can be blocked. It does not make sense of course since dang near %100 of many small businesses and SOHOs use subscriber lines. Is RackSpace being as misguided as AT&T? Who knows.
    – closetnoc
    May 10, 2014 at 14:08
  • Hi Steve, Am I correct in saying your using a VPS or Server to send emails that is hosted at Rackspace? additionally is there any pratically email providers spam blocking it, i.e gmx, hotmail, gmail etc. Also are you aware of any apps blocking such as outlook, antivirus and so on... Email spam is a very complicated issue and there's so many tiers that spam can be marked as. I'm not too familar with Analyzing the headers but I do know services and products that can assist with a ideal workaround.
    – Simon Hayter
    May 10, 2014 at 14:21
  • @bybe, no my server is at Amazon. I added more info to the question.
    – Stephen Ostermiller ♦
    May 10, 2014 at 15:43
  • @Stephen Ostermiller Sorry. But Amazon is not the best of neighborhoods. Check the header for sender domain name/ip address information and make sure it is not black listed. I would not be surprised if you find Amazon domains and ips black listed.
    – closetnoc
    May 10, 2014 at 19:04

2 Answers 2

Reset to default
5

The header X-CNFS-Analysis is added to emails processed by Cloudmark Authority, an email filtering engine, and appliances which use this engine such as Cloudmark Security Platform. In newer versions, it has been renamed to X-Authority-Analysis.

In the case of Rackspace, they use Cloudmark Server Edition, a plugin for Microsoft Exchange, to provide filtering for their hosted email product. A Cloudmark case study also shows Rackspace using Cloudmark Authority for SpamAssassin.

The Cloudmark web site has a support form for reporting false positives and instructions for using the form. You need to provide a complete copy of the message including full headers, and support might only be provided to the Cloudmark Authority user (here, Rackspace).

Cloudmark does not, as far as I can tell, provide any way for end users to decode the information in this header. Some of it appears to be Base 64 encoded, but all I got when decoding it was binary data. I didn't attempt to reverse engineer it any further.

Improve this answer
2

I had the same exact issue (in fact, sending with AWS SES and receiving with Rackspace). Just as you did, I had some emails that weren't flagged as SPAM, and some that were, so the way I debugged it was simply by swapping out content until I narrowed down what the problem was. In my case, it was such a stupid thing causing my problems: I had a shortened URL in the email body. (in fact, it was actually even commented out). Once I removed the http://goo.gl/ address, all the SPAM flags were cleared. So weird.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.