Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We have an application that sends mail in bulk, via a mail provider (Mailjet). Our clients are professional organizations, and they send important mails about meetings and stuff like that, to about 10 to a few hundred contacts at once. Our mail provider has delaying rules, which means that if we ask them to send 1000 mails right away, they will send them over the lenght of a few minutes.

Our problem is that some of our client's clients do not receive the mails, and they do not know about it, and neither do we. Mailjet allows us to see which mails have been bounced, and wich ones have been marked as spam, but we do not see these mails marked as spam, only as "sent". My guess is that their antispam flags the mail as spam, deletes it, and does not bother to tell our server that our mail has been flagged.
The problematic addresses are seemingly always "high-security mails", like in banks, government offices, etc. When our client sends the same mail using Outlook, with the same content, they receive it.

How can we know what we have to alter so these mails pass through the security ?

I still have to be able to reach the problematic contacts to get the full headers, but I sent a test to myself. I only noticed a few things :

  • When we send it with our app, we use UTF8, but Gmail and Outlook use ISO. Can it contribute to flag the mail ?
  • The app do not set a return-path header, so Mailjet generates one. Can the fact that the return-path is "weird" contribute to flag the mail ?

The mail header when I send a test with Mailjet :

Delivered-To: bbb@domain.fr
Received: by 10.229.48.149 with SMTP id r21cs17382qcf;
        Fri, 6 Jan 2012 06:08:40 -0800 (PST)
Received: by 10.180.93.193 with SMTP id cw1mr11658683wib.5.1325858919127;
        Fri, 06 Jan 2012 06:08:39 -0800 (PST)
Return-Path: <xHzNRIHX.29p.1Ho.p.atMA7+bbb=domain.fr@bnc.mailjet.com>
Received: from o4.p4.mailjet.com (o4.p4.mailjet.com. [178.33.221.4])
        by mx.google.com with ESMTP id p1si2354766wix.6.2012.01.06.06.08.38;
        Fri, 06 Jan 2012 06:08:38 -0800 (PST)
Received-SPF: pass (google.com: domain of xHzNRIHX.29p.1Ho.p.atMA7+bbb=domain.fr@bnc.mailjet.com designates 178.33.221.4 as permitted sender) client-ip=178.33.221.4;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of xHzNRIHX.29p.1Ho.p.atMA7+bbb=domain.fr@bnc.mailjet.com designates 178.33.221.4 as permitted sender) smtp.mail=xHzNRIHX.29p.1Ho.p.atMA7+bbb=domain.fr@bnc.mailjet.com; dkim=pass header.i=sss@domain.fr
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/simple; q=dns/txt;
    d=makoa.fr; i=sss@domain.fr; s=mailjet;
    h=domainkey-signature:message-id:mime-version:content-type:from:to:subject:date:importance:x-priority:priority;
    bh=Ljfxa8uT4YjkMRYviTuXL2baxYw=;
    b=GC7EsJ5aSg6XDP8iaVa55OmVhmAvnGDxLdo7ZshN1V3vx2p+68g/c2O3QP3lkS8dfAMaojz6No/M719wvvrqR6nwVv+uDmzLWD1ypyHUxQrFOSvLxMmjom5uvOTIfXLz4YibeVcysg6ZfKyEJGTW5mkBrPJC8qSMQ5wiM+Jbnkk=
Domainkey-Signature: a=rsa-sha1; c=simple; q=dns;
    d=makoa.fr; s=mailjet;
    h=message-id:mime-version:content-type:from:to:subject:date:importance:x-priority:priority;
    b=WgvwrMHgsWQSmgbkwrWnwyKLFqAJK3BkNp4Ias0eRWKjbGEAZuK1hj/0lsLR8dCx7WypbK2/2uKxLvc4OQ+Q11vunbW1yRT3Pn6fNf8Bl+Voje40vqMK97VLQAogiJaCTVBwiYj3qYz//a3VhIUsru0Q2Ah44qQi96xYvTnnATI=
Message-Id: <xHzNRIHX.29p.1Ho.p.atMA7@mailjet.com>
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary=--boundary_0_9561fd4f-5e72-4946-afc8-a0fffb54f2de
From: Developpeur <sss@domain.fr>
To: bbb@domain.fr
Subject: Test headers mail
Date: 6 Jan 2012 15:08:26 +0100
Importance: high
X-Priority: 1
Priority: urgent

----boundary_0_9561fd4f-5e72-4946-afc8-a0fffb54f2de
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

(text content)

----boundary_0_9561fd4f-5e72-4946-afc8-a0fffb54f2de
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

(html content)

----boundary_0_9561fd4f-5e72-4946-afc8-a0fffb54f2de--

The mail headers when I send a test with Outlook :

Delivered-To: bbb@domain.fr
Received: by 10.229.48.149 with SMTP id r21cs17771qcf;
        Fri, 6 Jan 2012 06:18:21 -0800 (PST)
Received: by 10.180.90.136 with SMTP id bw8mr7606790wib.1.1325859499593;
        Fri, 06 Jan 2012 06:18:19 -0800 (PST)
Return-Path: <ttt@domain.net>
Received: from mail-wi0-f176.google.com (mail-wi0-f176.google.com [209.85.212.176])
        by mx.google.com with ESMTPS id er19si1294730wbb.10.2012.01.06.06.18.18
        (version=TLSv1/SSLv3 cipher=OTHER);
        Fri, 06 Jan 2012 06:18:19 -0800 (PST)
Received-SPF: pass (google.com: domain of ttt@domain.net designates 209.85.212.176 as permitted sender) client-ip=209.85.212.176;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of ttt@domain.net designates 209.85.212.176 as permitted sender) smtp.mail=ttt@domain.net
Received: by wibhq4 with SMTP id hq4so1702992wib.35
        for <bbb@domain.fr>; Fri, 06 Jan 2012 06:18:18 -0800 (PST)
Received: by 10.180.94.97 with SMTP id db1mr11647343wib.16.1325859498751;
        Fri, 06 Jan 2012 06:18:18 -0800 (PST)
Return-Path: <ttt@domain.net>
Received: from pcmickael (ppp-190.net-188-130-81.static.magiconline.fr. [188.130.81.190])
        by mx.google.com with ESMTPS id fy5sm148220887wib.7.2012.01.06.06.18.17
        (version=TLSv1/SSLv3 cipher=OTHER);
        Fri, 06 Jan 2012 06:18:17 -0800 (PST)
From: "test" <ttt@domain.net>
To: <bbb@domain.fr>
Subject: Tests headers Outlook
Date: Fri, 6 Jan 2012 15:16:13 +0100
Message-ID: <000001cccc7d$bf8e63e0$3eab2ba0$@net>
MIME-Version: 1.0
Content-Type: multipart/related;
    boundary="----=_NextPart_000_0001_01CCCC86.2152CBE0"
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: AczMfb7T1I471bDCSBeXyN5zkMwGJg==
Content-Language: fr

This is a multi-part message in MIME format.

------=_NextPart_000_0001_01CCCC86.2152CBE0
Content-Type: multipart/alternative;
    boundary="----=_NextPart_001_0002_01CCCC86.2152CBE0"


------=_NextPart_001_0002_01CCCC86.2152CBE0
Content-Type: text/plain;
    charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

(autogenerated text content)
------=_NextPart_001_0002_01CCCC86.2152CBE0
Content-Type: text/html;
    charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

(html content)
------=_NextPart_001_0002_01CCCC86.2152CBE0--

------=_NextPart_000_0001_01CCCC86.2152CBE0
Content-Type: image/jpeg;
    name="image001.jpg"
Content-Transfer-Encoding: base64
Content-ID: <image001.jpg@01CCCC86.208B3620>

(image data)

------=_NextPart_000_0001_01CCCC86.2152CBE0
Content-Type: image/png;
    name="image002.png"
Content-Transfer-Encoding: base64
Content-ID: <image002.png@01CCCC86.208B3620>

(image data)

------=_NextPart_000_0001_01CCCC86.2152CBE0--

Any idea as to what might be causing the antispam to mark our mails as spam ? Thanks !

share|improve this question

closed as off topic by Iszi, Rook, Rory Alsop Feb 2 '12 at 14:13

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
What's the security question you are looking to have answered? Have you asked over on the Stack Overflow site? –  Wayne In Yak Jan 6 '12 at 15:34
1  
There is nothign weird about the return-path path. What is more likely is one of the domains has a bad history and the providers in question just get rid of emails from that domain. It also is possible that the entire problem is cause by Mailjet –  Ramhound Jan 6 '12 at 15:55
1  
Hey, I'm from Mailjet and I'd like to investigate things further. Do you have a support ticket number? Otherwise just open a ticket to my attention. It may be related to headers we modify, or other specific rules the destination server have. We'll sort this out. –  Julien Tartarin Jan 7 '12 at 15:11
    
@JulienTartarin : thanks, I will send you a mail on monday. –  cosmo0 Jan 8 '12 at 11:01

1 Answer 1

You've rather buried the security question, which I believe is "Do high-security organisations use more aggressive spam filtering?" under "why is my mail being marked as spam?", which will get more love over on SuperUser.

The answer is "maybe".

A secure organisation should set the aggressiveness of it's spam filter appropriately as part of it's risk assessment and management program. That means neither too aggressive nor too permissive.

Now, if insecure orgs tend to err on the side of permissive, you'll find the secure orgs seem to be relatively more aggressive. Not sure if that's my experience though; plenty of people out there with filters that are badly configured and too aggressive.

share|improve this answer
    
No, I know for a fact that these clients are less permissive than most others. What I want to know is, what can be the cause of the flagging ? Is it the domain, one of the headers, can it be the content... –  cosmo0 Jan 8 '12 at 11:01
    
Ah, then I fear your question may be "a request for attack tools" in a sense, and not appropriate for this forum. If an organisation wishes to block inbound mail from bulk mail services, then that's their decision to make. Most spam filters have a whitelist system where users can indicate that there is some mail they wish to receive; that may be a possible way around this. As I used to always say in my messaging admin days: I can't change how someone else's mail system works. –  Graham Hill Jan 9 '12 at 16:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.