Issue After full test pass of server still email goes to spam

[Parminder Singh]

Dear sir,
In my Plesk server i have set SPF + DKIM as per your instruction and full test pass of server still email goes to spam in gmail etc. Please guide and support me to slve this issue cuz my client is getting loss of goodwill on me because of this plzz help me for my selfrespect and goodwill on customers. Plzz solve SPAM problem from my server

 

[Bitpalast]

SPF and DKIM are insufficient to guarantee proper delivery. Basically, it is impossible to guarantee delivery at all. Maybe your host's IP is on a blacklist (check some here: http://whatismyipaddress.com/blacklist-check), maybe your IPv6 configuration is incorrect so that a reverse resolution does not resolve to your mail server, maybe the same applies to your IPv4 configuration, maybe your client's domain has a bad reputation in Gmail for previously sending spam.

 

[Parminder Singh]

Dear sir,
Our all test is safe, plzz check screenshot for the same.Plzz help me still my email goes to spam.

Thanks

 

[themew]

Try sending an email and checking your score here for a detailed examination of your headers > https://www.mail-tester.com/

I ran your domain through > http://mxtoolbox.com and there are problems with your headers and email DNS settings.

Fix the problems found when running the 'Test Email Server' tool and you'll see exactly what you need to fix.

 

[Parminder Singh]

this is mail delivery report from gmail
Received: from webmail.mcssan.com (localhost [127.0.0.1])
by myserver.com (Postfix) with ESMTPA id D6E5B7FC008D
for <[email protected]>; Thu, 5 Jan 2017 13:36:28 +0530 (IST)

 

[Parminder Singh]

Dear sir,
this is http://www.mail-tester.com/ report

Plzz solve my problem asap

 

[Bitpalast]

Great that you did this test. It shows that Plesk generates a "perfect" mail. If you want to know why it still goes to GMails Spam folder, you need to ask Google/Gmail about it. As you can see from your tests, it cannot be an issue with Plesk. By the way, did you check that reverse DNS resolves to your mail server for IPv4 and IPv6?

 

[Parminder Singh]

IPv4 reverse DNS is already set, but my provider didn't provide me IPv6

 

[Bitpalast]

If you do not have a public IPv6 address on your provider's side, make sure that your server is not using IPv6 at all. Else it could happen that it is connecting to Gmail with its interface IPv6, hence Gmail will think the IP address has been forged and move the mail into spam.

Ubuntu, Redhat, Centos: Create /etc/sysctl.d/01-disable-ipv6.conf and insert this line into it:
net.ipv6.conf.all.disable_ipv6 = 1

 

[Parminder Singh]

If you do not have a public IPv6 address on your provider's side, make sure that your server is not using IPv6 at all. Else it could happen that it is connecting to Gmail with its interface IPv6, hence Gmail will think the IP address has been forged and move the mail into spam.

Ubuntu, Redhat, Centos: Create /etc/sysctl.d/01-disable-ipv6.conf and insert this line into it:
net.ipv6.conf.all.disable_ipv6 = 1

i have disabled IPv6 for my ubuntu server as you guided me, but still mails are going to spam, please help us

 

[Bitpalast]

Why not contact Google on this an ask why these mails are going into the Spam folder? It can still be that the IP has a bad reputation with Gmail or that a specific mail content, e.g. a footer with a link or advertisement or specific keywords, triggers spam detection. It can also be a high rate of e-mails sent to Gmail accounts within a short period of time. There are many possibilities. Probably Gmail support can help you out with a better analysis.

 

[Parminder Singh]

Dear Sir,
We ask to google they said if you are able to handle dedicated server then you must know email setting no help from that side plzz help me. After Our server email test pass but this report is getting today plzz help to solve this SPAM issue

n 10 15:53:56 lion postfix/smtp[15217]: B1F477FC11CC: to=<[email protected]>, relay=relay.verizon.net[206.46.232.11]:25, delay=246210, delays=246210/0.14/0.05/0, dsn=4.0.0, status=deferred (host relay.verizon.net[206.46.232.11] refused to talk to me: 571 Email from 209.126.107.213 is currently blocked by Verizon Online's anti-spam system. The email sender or Email Service Provider may visit http://www.verizon.net/whitelist and request removal of the block. 170110)
Jan 10 15:53:56 lion postfix/smtp[15200]: C7CFC7FC10F4: to=<[email protected]>, relay=relay.verizon.net[206.46.232.11]:25, delay=247109, delays=247108/0.07/0.05/0, dsn=4.0.0, status=deferred (host relay.verizon.net[206.46.232.11] refused to talk to me: 571 Email from 209.126.107.213 is currently blocked by Verizon Online's anti-spam system. The email sender or Email Service Provider may visit http://www.verizon.net/whitelist and request removal of the block. 170110)
Jan 10 15:53:56 lion postfix/smtp[15184]: C7CDE7FC11B8: to=<[email protected]>, relay=relay.verizon.net[206.46.232.11]:25, delay=246307, delays=246306/0.04/0.06/0, dsn=4.0.0, status=deferred (host relay.verizon.net[206.46.232.11] refused to talk to me: 571 Email from 209.126.107.213 is currently blocked by Verizon Online's anti-spam system. The email sender or Email Service Provider may visit http://www.verizon.net/whitelist and request removal of the block. 170110)
Jan 10 15:53:56 lion postfix/smtp[15209]: 6E0DA7FC116F: to=<[email protected]>, relay=dnvrco-pub-iedge-vip.email.rr.com[107.14.73.70]:25, delay=246610, delays=246610/0.09/0.13/0, dsn=4.0.0, status=deferred (host dnvrco-pub-iedge-vip.email.rr.com[107.14.73.70] refused to talk to me: 554 ERROR: Mail Refused - See http://csi.cloudmark.com/reset-request/?ip=209.126.107.213)
Jan 10 15:53:56 lion postfix/smtp[15217]: B1F477FC11CC: to=<[email protected]>, relay=relay.verizon.net[206.46.232.11]:25, delay=246210, delays=246210/0.14/0.05/0, dsn=4.0.0, status=deferred (host relay.verizon.net[206.46.232.11] refused to talk to me: 571 Email from 209.126.107.213 is currently blocked by Verizon Online's anti-spam system. The email sender or Email Service Provider may visit http://www.verizon.net/whitelist and request removal of the block. 170110)
Jan 10 15:53:56 lion postfix/smtp[15226]: 3DFEE7FC11A4: to=<[email protected]>, relay=cdptpa-pub-iedge-vip.email.rr.com[107.14.166.70]:25, delay=246284, delays=246284/0.16/0.13/0, dsn=4.0.0, status=deferred (host cdptpa-pub-iedge-vip.email.rr.com[107.14.166.70] refused to talk to me: 554 ERROR: Mail Refused - See http://csi.cloudmark.com/reset-request/?ip=209.126.107.213)
Jan 10 15:53:56 lion postfix/smtp[15200]: C7CFC7FC10F4: to=<[email protected]>, relay=relay.verizon.net[206.46.232.11]:25, delay=247109, delays=247108/0.07/0.05/0, dsn=4.0.0, status=deferred (host relay.verizon.net[206.46.232.11] refused to talk to me: 571 Email from 209.126.107.213 is currently blocked by Verizon Online's anti-spam system. The email sender or Email Service Provider may visit http://www.verizon.net/whitelist and request removal of the block. 170110)
Jan 10 15:53:56 lion postfix/smtp[15184]: C7CDE7FC11B8: to=<[email protected]>, relay=relay.verizon.net[206.46.232.11]:25, delay=246307, delays=246306/0.04/0.06/0, dsn=4.0.0, status=deferred (host relay.verizon.net[206.46.232.11] refused to talk to me: 571 Email from 209.126.107.213 is currently blocked by Verizon Online's anti-spam system. The email sender or Email Service Provider may visit http://www.verizon.net/whitelist and request removal of the block. 170110)
Jan 10 15:53:56 lion postfix/smtp[15220]: 903AA7FC11D8: to=<[email protected]>, relay=mx1.comcast.net[96.114.157.80]:25, delay=246161, delays=246161/0.14/0.2/0, dsn=4.0.0, status=deferred (host mx1.comcast.net[96.114.157.80] refused to talk to me: 554 resimta-po-23v.sys.comcast.net resimta-po-23v.sys.comcast.net 209.126.107.213 found on one or more DNSBLs, see http://postmaster.comcast.net/smtp-error-codes.php#BL000010)
Jan 10 15:53:56 lion postfix/smtp[15187]: C39A67FC1167: host mx1.comcast.net[96.114.157.80] refused to talk to me: 554 resimta-po-03v.sys.comcast.net resimta-po-03v.sys.comcast.net 209.126.107.213 found on one or more DNSBLs, see http://postmaster.comcast.net/smtp-error-codes.php#BL000010

 

[Parminder Singh]

I think this is problem under return report of email
localhost.localdomain [127.0.0.1]

 

[Bitpalast]

Parminder,

the error messages are very clear, and the symptoms are also very clear. Your server has been or is still sending spam, so it is listed on blacklists. The Verizon response message is saying just that, and Comcast obviously has the same result. No wonder, that GMail is blocking mails from that system. This is not an issue with Plesk. You must stop the spam that is being sent from your server.

Turn on outgoing mail control in Plesk. If that is already active and does not detect any overuse of mailboxes, check the process list for an "exim" entry:
# ps -aux | grep exim
If that returns at least two lines (one for the "ps" command, another one for exim process execution), an additional mail server called "Exim" was started on your server and is sending the spam, bypassing other security mechanisms. Please check that and return the result here.

 

[Noam Harel]

maybe this could help you, one time when i had similar problem, and everything looked good from the system perspective.
i have found that the server is sending small amount of Spam through a script from one domain on the server - meaning that the domain was hacked, a check through blacklist websites and sucuri scan didn't find anything but still Google was getting those Spam messages, thus making mail from that domain marked as Spam.
after removing those files and had a few days passing things went right again. also i would suggest using an anti-virus product that can block outgoing spam messages, this might work for you.

 

[Parminder Singh]

Parminder,

the error messages are very clear, and the symptoms are also very clear. Your server has been or is still sending spam, so it is listed on blacklists. The Verizon response message is saying just that, and Comcast obviously has the same result. No wonder, that GMail is blocking mails from that system. This is not an issue with Plesk. You must stop the spam that is being sent from your server.

Turn on outgoing mail control in Plesk. If that is already active and does not detect any overuse of mailboxes, check the process list for an "exim" entry:
# ps -aux | grep exim
If that returns at least two lines (one for the "ps" command, another one for exim process execution), an additional mail server called "Exim" was started on your server and is sending the spam, bypassing other security mechanisms. Please check that and return the result here.

result of ps -aux | grep exim

root 7725 0.0 0.0 14224 984 pts/0 S+ 05:55 0:00 grep exim

 

[Parminder Singh]

maybe this could help you, one time when i had similar problem, and everything looked good from the system perspective.
i have found that the server is sending small amount of Spam through a script from one domain on the server - meaning that the domain was hacked, a check through blacklist websites and sucuri scan didn't find anything but still Google was getting those Spam messages, thus making mail from that domain marked as Spam.
after removing those files and had a few days passing things went right again. also i would suggest using an anti-virus product that can block outgoing spam messages, this might work for you.

in plesk antivirus is on? how can i scan?

 

[Bitpalast]

in plesk antivirus is on? how can i scan?

Plesk Antivirus does not catch malware in websites that is sending Spam. But when you enable outgoing mail control in the host's mail settings, it will notify you of unusually high numbers of emails sent from specific subscriptions.

 

[Parminder Singh]

Plesk Antivirus does not catch malware in websites that is sending Spam. But when you enable outgoing mail control in the host's mail settings, it will notify you of unusually high numbers of emails sent from specific subscriptions.

but in outgoing mail control No attempts to exceed limits for Email addresses, Domains, Subscriptions

 

[Bitpalast]

One last try: What is your configuration in Tools & Settings > Server-wide mail settings > "Outgoing mail mode"?
If that is set to "... and use domain names in SMTP greetings", some blacklists block the server, because the same IP address is using different SMTP greetings. So that setting should be "It should be set to "Send from domain IP addresses" only.