1

We are investigating emails which were marked as spam by Cloudmark's service Cloudmark Authority Engine (CMAE). We want to find out if they are false positives. When an user ask to investigate why a single mail was marked as spam, our approach is currently:

I know there are a lot factors that come into play when detecting spam (i.e. SPF, DKIM, blocklists, mail header check, content check, custom rules etc.).

We observed that apivoid's service often states "Suspicious Domain" (i.e. "Returns true if domain is suspicious, i.e known spam or parked."; see https://docs.apivoid.com/) when analyzing the from address. Then we report this observeration to the user with the explanation "you might have sent mails in the past which recipients could marked as spam. please ensure the opt-in of your recipients and be sure they can unsubscribe". Often users then stated they used to send newsletters once a month to a bunch of addresses (without opt-in).

When checking those suspicious domains in any domain block lists (i.e. https://www.spamhaus.org/dbl/) there are no matches. At the moment our current guess is that only massive spam domains land in domain block lists and apivoid.com is good at detection minor spam cases (maybe through the use of spam traps).

My questions:

  • Can somebody confirm the observations above?
  • Does anyone have insight how apivoid is so accurate (at least for our cases) with its email reputation check?
  • Does somebody know an equivalent service for email reputation check?
Improve this question

1 Answer 1

Reset to default
0

Cloudmark uses a collection of hashes based on several different engines. The list of hashes in its header shows what it did. a= before a hash means it was absent from the CMAE while p= means present, triggering a conviction. The engine is listed after each hash. A trailing :17 or :117 refers to their sender reputation system. Other engines refer to completely different heuristics.

APIVoid is an interesting service, but it is very basic and doesn't seem to be performing any reputation lookups. I'd go with something more like MultiRBL.valli.org, which would let you examine the sender's IP across dozens of different blocklists (some of which are stronger signals than others).

(Most email sender domain reputation systems are proprietary and can't be queried. Spamhaus DBL is one of the few you that is publicly available. The more classic view of email sender IP reputation is far better established and more publicly visible.)

However, if you're concerned about a false positive from Cloudmark, the only authoritative answers you can get will have to come from Proofpoint/Cloudmark.

See also this What should I do if my content has a Cloudmark spammy fingerprint? guide from Validity or the Cloudmark reputation reset form.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .