2

I have been trying to learn about phishing emails. I have read up quite a bit on it. I setup a domain somthing.tk (free domain), hosted a website on a VPS (Digital Ocean). Set up my own mail transfer agent (Postfix).

Now I have set up:

  1. DKIM
  2. DMARC
  3. SPF

All pass in GMail when I send the mail, but still the mails send by me are flagged as spam by GMail spam filter. What am I doing wrong?

Also I am using GNUMail to send emails via this command:

echo "anything" | mail -s "subject" anything@gmail.com

  • 1
    When Gmail puts a message in Spam, there's a giant banner at the top that says "Why is this message in spam?" followed by the answer. What does that say for your emails? – Joseph Sible Mar 10 at 17:57
  • Why is this message in Spam? It's similar to messages that were detected by our spam filters. – Vipul Nair Mar 10 at 18:04
  • then it is not the transport layer that it is detecting but the content – schroeder Mar 10 at 18:22
  • should i not use gnu mail?should i use it but increase my content? – Vipul Nair Mar 10 at 18:35
  • 1
    I bet using .tk has something to do with this. The same setup with .icu seemed to work fine. Not anymore! TLD reputation matters. – Esa Jokinen Mar 10 at 18:52
0

Unfortunately, .tk is one of the TLDs that are notoriously associated with certain threat actors and are used by malware to establish C2 channels (malware home-calling).

SNORT and Suricata (two most widely-used opensource IDS/IPS solutions) even have detection rules written for .tk, .pw and .ru URLs, it would generate an alert for the SOC analysts every time a hit is recorded against them in the network.

I'd suggest using a purchased domain name to get past the email filters. GL!


BONUS: You might want to check your URL/domain names at https://www.urlvoid.com to see if they're marked malicious or suspicious by security vendors/spam databases.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.