I received an email today asking for assistance on a problem one of my fellow employees was having delivering email to another via our corporate mail system.
The email itself wasn’t anything special, as far as I could tell, but SpamAssassin (one of the most commonly used spam-fighting tools) scored the email high enough to consider it bad enough to be delivered to the recipient’s spam folder.
Here is a list of the tests which affected the score of the email.
- MSGID_DOLLARS
- RATWARE_MS_HASH
- RATWARE_OUTLOOK_NONAME
- SPF_HELO_PASS
- SPF_PASS
So, what’s interesting about these tests?
Well, before I tell you, I should inform you that the email was sent using Microsoft Outlook via a Microsoft Exchange Server. As some of you may know, this is a very common software combination in the corporate IT world.
So, on with the analysis!
The first three tests specifically address the headers (Message-ID, etc.) of the email, which are hidden from normal view to most users. These tests negatively influenced the score of the email; however, the other two tests (SPF_HELO_PASS and SPF_PASS) influenced the score in a positive fashion. They simply state that the mail server which sent the email was authorized to do so for our domain.
In researching this problem, I discovered that many people claimed that emails generated by Outlook were getting falsely classified as spam due to the above tests. It would specifically seem to be related to one or more missing headers when email is sent from a Windows Mobile phone via Exchange. I haven’t had a chance to verify if this was the case for our problem, but I wouldn’t be surprised.
The frustrating thing is that the spam-like qualities of the email are completely out of the control of the email sender. It isn’t like the email contained a bunch of bad keywords (e.g. Prozac, etc.), but instead the email client is producing (or not producing, as would be the case) headers that cause SpamAssassin to throw false positives.
So, what can we do about this?
Not much.
I ended up suggesting that the receiver try to have our domain whitelisted. That isn’t the easiest thing to accomplish, but probably the best in the long run.
Lets hope that the SpamAssassin folks and the Windows Mobile folks get this resolved.
Link: SpamAssassin Bug