Author Topic: Mailmarshall blocks mail  (Read 4561 times)

mvanniekerk

  • Posts: 5
    • View Profile
Mailmarshall blocks mail
« on: January 22, 2007, 12:27:32 am »
Hi

I am sending  daily about 27000 mails to my lists with the dailymail scheduling feature.  Some time last year I start receiving some complaints from my subscribers that they do not receive the daily mail. Most of these subscribers were on a Mailmarshall system. I then tested the direct mailing option and they received the mail. Does this makes sence to you? What is the difference between the two mailing options? How can I change the Scheduling  option to get past the Mailmarshall scanning?

Regards
Michael

DW

  • Administrator
  • Posts: 3787
    • View Profile
    • https://legacy.listmailpro.com
Mailmarshall blocks mail
« Reply #1 on: January 22, 2007, 03:53:39 pm »
Michael,

It sounds to me like some content or a URL in your messages is being blocked.

The "Send Email" feature and "Scheduled Email" both use the same process, (SMTP if enabled).  The only messages that are sent with a different method (internal PHP mail) are the welcome, confirmation and some notification messages.

Do you know more about mailmarshall or have a URL I can visit for more information about the types of blocks they employ? (Sorry, I'm a bit pressed for time at the moment)  If so I may be able to offer some more advice.

Regards
Dean Wiebe
ListMailPRO Author & Developer - Help | Support | Hosting

mvanniekerk

  • Posts: 5
    • View Profile
Mailmarshall blocks mail
« Reply #2 on: January 23, 2007, 11:42:37 am »
Hi Dean

Thanks for your reply.

I've tested my message to a group of members on a mailserver serviced by Mailmarshall. They received the send mail messages by not the regular scheduled messages. i will get more info on Mailmarshall for you.

Regards from a very hot SA
Michael

DW

  • Administrator
  • Posts: 3787
    • View Profile
    • https://legacy.listmailpro.com
Mailmarshall blocks mail
« Reply #3 on: January 23, 2007, 02:13:20 pm »
Michael,

Do you receive the dailymail report each day stating the messages are being sent?  The headers/messages in a scheduled email should be exactly the same as when using "Send Email".

Regards
Dean Wiebe
ListMailPRO Author & Developer - Help | Support | Hosting

mvanniekerk

  • Posts: 5
    • View Profile
Mailmarshall blocks mail
« Reply #4 on: January 24, 2007, 01:58:13 am »
Hi Dean

Yes the headers is normally exactly the same. I do receive a Daily report.
In December I have received the following error message from one of the ISP's (using mailmarshall) thanks Michael

Quote
Sorry for the later response. Here is the feedback from the engineers.
It looks like the messages are not rfc compliant.
I have attached the log below of why the mall is being tagged as spam. The mail is not rfc compliant. They need to show this to their mail admin but looks like the message was not generated by a standard program like outlook:
3392 19:12:00.576 Message From <boodskap>, Return-path
<bnc>, Recipients (1) - <katle>
3392 19:12:00,576 Thread 1 StartIng to unpack <bA029212d9>
3392 19:12:00.576 Type= MAIL, slze=3092, Name= bA029212d9.00000001.mml
3392 19:12:00.576 Type= MHDR, slze=930, Name= MsgHeader.txt
3392 19:12:00.576 Type=MBODY, size=2160, Name=Piain.txt
3392 19:12:00.576 1 user(s) match ruieset - GLOBAL RULE(Incoming)
3392 19:12:00.576 1 user(s) match rule - Block Incoming Viruses
3392 19:12:00.592 virus scanner OK <NetIQ>
file <bA029212d9> after 16 mililsecs
3392 19:12:00.592 vIrus scanner OK <NetIQ>
file <MsgHeader> after 0 mililsecs
3392 19:12:00.607 virus scanner OK <NetIQ>
file <Piain> after 15 mililsecs
3392 19:12:00,607 Name=U1d9.00000001.mmi (MAIL,3092) False
3392 19:12:00.607 Name=U2.txt (MHDR,930) False
3392 19:12:00.607 Name=U2.txt (MBODY,2160) False
3392 19:12:00.607 1 user(s) match rule - Block URL Censor Spam
(Global)
3392 19:12:00.607 URLCensor: christians.co.za:
<christians> is OK (CACHED)
3392 19:12:00.607 Name=U1d9.00000001.mmi (MAIL,3092) False
3392 19:12:00.607 1 user(s) match rule - Reduce Incoming Spam via
Category
3392 19:12:00.623 Category <Spam> evaluation result
3392 19:12:00.623 - HTTP_LINK: (1.00) HTTP link in message
3392 19:12:00.623 - MSG_ONLY_TEXT: (-1.00) Only has text body
3392 19:12:00.623 - MSG_SIZE_1: (-1.00) IsBigger than 1K
3392 19:12:00.623 - MSG_SIZE_2: (1.00) Isbigger than 2K
3392 19:12:00.623 - MSG_SIZE_3: (-1.00) Isbigger than 3K
3392 19:12:00.623 - RH_GENR_HeaderSus2l: (30.00) Header pattern
common in spam
3392 19:12:00.623 - RH_GENR_HeaderSus247: (15.00) Header pattern
common in spam
3392 19:12:00.623 - RH_GENR_NotVerified: (0.00) Received: Not
verified
3392 19:12:00.623 - RH_GENR_RcvdSusPort: (34.00) Received: Line
Suspect
3392 19:12:00.623 Total score: (78.0) required(60.0)
3392 19:12:00.623 SpamFilter: Version 140 28-November-2006
3392 19:12:00.623 End of Category <Spam> evaluation
3392 19:12:00.623 Name=U1d9.00000001.mmi (MAIL,3092) TRUE
Terminal
3392 19:12:00.623 Requesting Action <GLOBAL> be run
3392 19:12:00.623 Requesting Action <GLOBAL> be run
3392 19:12:00.623 Action LogMessage for Component
U1d9.00000001.mmi
3392 19:12:00.623 Action MoveMessage for Component
U1d9.00000001.mmi



[/quote]

DW

  • Administrator
  • Posts: 3787
    • View Profile
    • https://legacy.listmailpro.com
Mailmarshall blocks mail
« Reply #5 on: January 24, 2007, 09:09:24 am »
I see the high score lines but it doesn't report the content of the lines...  This makes it difficult or impossible to understand exactly where listmail is going wrong.  I wonder if the ListMail header itself (X-Mailer: ListMail v1.xx) is causing it...  Is there any way to get more information from MailMarshall about the lines causing the high score?
Quote
3392 19:12:00.623 - RH_GENR_HeaderSus2l: (30.00) Header pattern
common in spam
3392 19:12:00.623 - RH_GENR_HeaderSus247: (15.00) Header pattern
common in spam
3392 19:12:00.623 - RH_GENR_RcvdSusPort: (34.00) Received: Line
Suspect

The last error says "Received", which might indicate a problem with one of the "Received:" headers in the email.  These headers are usually added automatically by your mail server software and are not set by ListMail.  It's possible your sending server, or one of your sending servers (your host could use a distributed system), has achieved a poor reputation.

Please let me know if you can get more information about the problematic lines.

Regards
Dean Wiebe
ListMailPRO Author & Developer - Help | Support | Hosting

BGSWebDesign

  • Posts: 625
    • View Profile
    • http://www.bgswebdesign.com
Mailmarshall blocks mail
« Reply #6 on: January 26, 2007, 05:59:34 am »
DW,

Quote
3392 19:12:00.623 - RH_GENR_HeaderSus2l: (30.00) Header pattern
common in spam
3392 19:12:00.623 - RH_GENR_HeaderSus247: (15.00) Header pattern
common in spam
3392 19:12:00.623 - RH_GENR_RcvdSusPort: (34.00) Received: Line


You should be actively pursuing this!  I've seen my mail rates drop considerably this last 6-12 months, in fact so much so that I'll probably very soon be moving to a different mailing script.

These little things need to be tracked down - if there is anything wrong with the headers I would think you would want to know???
Thanks,
-Brett
http://www.bgswebdesign.com/Contact-Us.php

*** I do custom List Mail Pro installations ***
Contact me through my website (above)

DW

  • Administrator
  • Posts: 3787
    • View Profile
    • https://legacy.listmailpro.com
Mailmarshall blocks mail
« Reply #7 on: January 26, 2007, 02:21:08 pm »
I did do some investigation but could not find any information about the matching lines.  Today I've appealed to the mailmarshal forum for more information:

http://www.marshal.com/forum/Topic6874-3-1.aspx

What I really need is a test server where I can install Mailmarshal, SpamAssassin, etc. and take a look at how different ListMail messages fare.

I am investigating solutions for blocking problems that seems to plague shared hosts and even, sometimes, dedicated servers.   I think the best solution might be shared hosting where each user has their own IP.  Full success/failure log file auditing would be ideal, but I fear this may not be feasible without a separate copy of the mail software for each hosted user - so that wouldn't be impossible either. ;)

I'm off-topic somewhat - back to Mailmarshal.  Let's hope the response to my forum post is helpful and/or Michael can provide more precise information about why each line scored so high.

Regards
Dean Wiebe
ListMailPRO Author & Developer - Help | Support | Hosting

mvanniekerk

  • Posts: 5
    • View Profile
Mailmarshall blocks mail
« Reply #8 on: January 27, 2007, 12:12:17 am »
Hi Dean

Sorry for the late reply.  I am trying to reach the ISP tech. people again to get some answers on your questions.

Quote
The last error says "Received", which might indicate a problem with one of the "Received:" headers in the email. These headers are usually added automatically by your mail server software and are not set by ListMail. It's possible your sending server, or one of your sending servers (your host could use a distributed system), has achieved a poor reputation.


Remember Mailmarshall accepted the Send mail - emails but not mails send by Dailymail. Will the headers be different?

Regards
Michael

DW

  • Administrator
  • Posts: 3787
    • View Profile
    • https://legacy.listmailpro.com
Mailmarshall blocks mail
« Reply #9 on: January 27, 2007, 02:03:31 pm »
Michael,

Yes, it sounds like the headers will be different, but I'm not sure how.  We need more information about the high-scoring lines...

No help from the MailMarshal forums.... The staff basically said they cannot tell me what is causing the high score....
Quote
Indeed, most of the HeaderSus rules are created strictly by looking...well, at header patterns common in spam - meaning, we've received heaps of spam with that header pattern, almost zero legitimate e-mail, and have adjusted our definitions accordingly.

The best recommendation I could give, is to ensure, for one, that your messages adhere absolutely as strictly as possible to RFC 822/2822. For example, many webmail scripts send lower-case header fields, making them an obvious target. The information within SpamCensor is proprietary, primarily for the protection of our own customers - if we made it public knowledge every last item we look for to determine whether or not something is spam, it'd be quite simple for people to get around many of the checks, exposing our customers to the stuff.

If the recipient trusts the sender, they should whitelist the address - plain and simple. I can however, say that we look at a combination of things beyond *just* the X-Mailer being used.

That's about as much as we can say really. I don't know of an anti-spam software vendor on the market who's interested in sharing with people how to circumvent their filters. Your clients will need to contact the recipients, and/or the admins on the remote side. If the recipient has indeed opted-in to receiving the blocked message in question, we can help them out quite easily.

I will have to do some tests to see if ListMail, perhaps, changes the headers at dailymail as opposed to during "Send Email", although it shouldn't because it uses the exact same domail() loop process from admin.php... :S  I may have time to do such testing later this afternoon (2pm now) or in the early evening.
Quote
What I really need is a test server where I can install Mailmarshal, SpamAssassin, etc. and take a look at how different ListMail messages fare.

This may be the only way....

Regards
Dean Wiebe
ListMailPRO Author & Developer - Help | Support | Hosting