Inward emails being rejected as Spam (error 550/552)

[#1]

I have discovered that emails from a working colleague of mine have not been getting through to me, but are being rejected (it seems) by the Plusnet servers as Spam.  So I have simply never received or seen them.

My colleague has passed on to me (using another email address!) the full text of the rejection notification, the error details, and the full header and contents of one of the messages he tried - unsuccessfully - to send to me.

I don't want to copy and paste all that information into open forum.  But the error details say

Error: 550 5.7.350 Remote server returned message detected as spam -> 552 Spam Message Rejected
Message rejected by: avasin-peh-001.plus.net

I can't interpret this, but it seems to me that the spam filter software on Plusnet's servers (is that "avasin"?) is bouncing the message back.  Presumably there is something in the message, or the sender details, which it doesn't like?

We have looked at the obvious possibilities.  There are no links within the message.  There are no attachments.

The sender's address is in my [Thunderbird] Address Book, so is - or should be - treated as legitimate and "whitelisted".

Having said that, his email address is in a slightly unusual 'corporate' format.  It does not have ".com", ".org" or ".co.uk" as the suffix.  The sender address is simply [his first name]@[company name].design.  (It is an architecture firm, hence that suffix).  Is it being rejected for that reason?

More to the point, what can be done to resolve this?

[#2]

The sender's address is in my [Thunderbird] Address Book, so is - or should be - treated as legitimate and "whitelisted".

@br1anst0rm That's largely irrelevant Im afraid, the message is clased as spam long before your whitelist is checked.

Having said that, his email address is in a slightly unusual 'corporate' format.  It does not have ".com", ".org" or ".co.uk" as the suffix.  The sender address is simply [his first name]@[company name].design.  (It is an architecture firm, hence that suffix).  Is it being rejected for that reason?

The first thing to check with your sender is do they have SPF and/or DKIM configured for their domain, and is the sender sending via an authorised server

[#3]

Thanks @MisterW ...  I did rather suspect that the inbound messages were being rejected by Plusnet before they reached my own email client or Inbox.  So no great surprise that my "whitelisting" of the sender's address doesn't help.

But as for doing further checks... I fear I don't have the expertise.  What is SPF?  What is DKIM?  Can I check this, or does the sender have to investigate and tell me all about his domain settings?  How can he - or I - ascertain whether the server he is using is "authorised"?  Who gives authorisation anyway?  Not Plusnet....

What I do know is that he sends emails successfully to all his other contacts.  If he couldn't do so, or if his email/server setup was dodgy, his business would swiftly be in trouble.  The only problem is sending emails to me.  And that's down to Plusnet.  The issue seems to be with Plusnet not liking his emails or seeing them as spam.  And it is hard to understand why.

After browsing some other forum threads I did go to a website called MXtools.com, and put the sender's address in the search box.  It produced a long list of read-outs or attributes, but none of them meant anything to me.  There was nothing in that list which featured a warning or a red flag.  So I deduce that the sender's address is legitimate and correct.

[#4]

What is SPF?  What is DKIM? 

@br1anst0rm  ok, SPF & DKIM are methods used to authenticate emails.

SPF is Sender Policy Framework , basically its a facility for a domain owner to specify which mailservers are permitted to send mail from that domain. This helps detection of spam mail with spoofed addresses, since by implication a spammer would not have access to the authorised mail servers.

DKIM is Domain Key Identified Mail , mail from a domain is signed using a private key by the sending mail server. The domain DNS specifies a public key which can be used to check the signature. Again this prevents spammers faking emails from the domain.

The standards have existed for some time but they are now being used more & more to assist with spam detection. Emails from domains that have neither SPF or DKIM authentication may either be tagged as spam or in the worst case rejected. Plusnet use the Cloudmark anti-spam system and it will use lack of SPF or DKIM to increase the likely spam score.

After browsing some other forum threads I did go to a website called MXtools.com,

If you go to mxtoolbox.com , enter their domain name and click MX lookup. Then use the dropdown arrow to select SPF record lookup and click, that will at least check if they have an SPF record.

[#5]

---

@MisterW wrote:

If you go to mxtoolbox.com , enter their domain name and click MX lookup. Then use the dropdown arrow to select SPF record lookup and click, that will at least check if they have an SPF record.

---

Thanks - have just done exactly that.  The readout indicates that the sender domain does have an SPF record.  In fact the readout has about a dozen criteria relating to SPF, and there is a green "tick" against every one of them.

Do i deduce therefore that the sender domain is "clean" and not suspicious?  If so, then that makes Plusnet's rejection even harder to understand.

I do have the full text (header and all) of one of the rejection notifications which the sender got from Plusnet.  I don't want to impose on your goodwill, @MisterW , but would it help with the troubleshooting if I PM'd that to you?

[#6]

Do i deduce therefore that the sender domain is "clean" and not suspicious?  If so, then that makes Plusnet's rejection even harder to understand.

@br1anst0rm it means that at least they are aware of the standards and have a properly configured domain.

I do have the full text (header and all) of one of the rejection notifications which the sender got from Plusnet.  I don't want to impose on your goodwill, @MisterW , but would it help with the troubleshooting if I PM'd that to you?

By all means PM me, I'd be happy to have a look and see if there's anything obvious from the headers.

[#7]

Is the email which is being rejected, being sent direct to a @account.plus.com (or PLUSNET hosted personal domain address) or to some third-party hosted domain which then redirects to the Plusnet Mailbox?

If there is a "man in the middle" here and they do not implement SRS for redirecting emails, then the SPF rules WILL be broken.

[#8]

@Townman from the headers, it's going directly to an account.plus.com address, the sending domain has SPF but no DKIM.

It's being sent by outlook 365 via ms-exchange and one of the  servers in the transit path is on a blacklist.

[#9]

Elsewhere (emails to CAMRA servers) I’ve seen similar due to spam cop (incorrectly?) identifying shared Outlook 365 server IP addresses. Given that there’s a multitude of users on the Outlook 365 servers, it is highly likely that someone somewhere has abused them, giving rise to the risk of them being black balled. CAMRA decided to whitelust the servers.

I’ve raised this previously with the usual contacts but have not yet received a response. One for Monday may be?

[#10]

MXtools.com redirects to https://abusix.com/#

https://mxtoolbox.com/ doesn't.