All my emails to Yahoo!, Hotmail and AOL are going to Spam, though I've implemented every validation method (works for Gmail though)

Question

I've implemented everything and checked everything (SPF, DomainKey, DKIM, reverse lookup), and only Gmail is allowing my emails to go to Inbox. Yahoo, Hotmail and AOL are all sending my messages to Spam. What am I doing wrong? Please help!

Following are the headers of messages to Yahoo, Hotmail and AOL. I've changed names and domain names. The domain names I'm sending mail from are polluxapp.com and gemini.polluxapp.com.

Yahoo:

From Shift Licensing Tue Jan 26 21:55:14 2010
X-Apparently-To: [email protected] via 98.136.167.163; Tue, 26 Jan 2010 13:59:12 -0800
Return-Path:
X-YahooFilteredBulk: 208.115.108.162
X-YMailISG:
gPlFT1YWLDtTsHSCXAO2fxuGq5RdrsMxPffmkJFHiQyZW.2RGdDQ8OEpzWDYPS.MS_D5mvpu928sYN_86mQ2inD9zVLaVNyVVrmzIFCOHJO2gPwIG8c2
L8WajG4ZRgoTwMFHkyEsefYtRLMg8AmHKnkS0PkPscwpVHtuUD91ghsTSqs4lxEMqhqw60US0cwMn_r_DrWNEUg_sESZsYeZpJcCCPL0wd6zcfKmtYaIk
idsth3gWJPJgpwWtkgPvwsJUU_cmAQ8hAQ7RVM1usEs80PzihTLDR1yKc4RJCsesaf4NUO_yN1cPsbFyiaazKikC.eiQk4Z3VU.8O5Vd8i7mPNyOeAjyt
7IgeA_

X-Originating-IP: [208.115.108.162]
Authentication-Results: mta1035.mail.sk1.yahoo.com from=example.com; domainkeys=pass (ok); from=example.com;
dkim=permerror (bad sig)
Received: from 127.0.0.1 (EHLO gemini.example.com) (208.115.108.162)
by mta1035.mail.sk1.yahoo.com with SMTP; Tue, 26 Jan 2010 13:59:12 -0800
Received: from gemini.example.com (gemini [127.0.0.1])
by gemini.example.com (Postfix) with ESMTP id 3984E21A0167
for ; Tue, 26 Jan 2010 13:55:14 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=example.com; h=to
:subject:from:content-type:message-id:date; s=mail; bh=bRIHfxE3S
e+YeCrIOqziZsiESJA=; b=J+D56Czff+6wGjQycLEvHyT32+06Nngf+6h7Ep6DL
SmmJv3ihiAFJIJiPxiwLNpUsOSHhwJYjYQtynbBnag40A6EUBIsucDR+VoEYD+Cc
9L0dV3QD5D77VpG9PnRQDQa91R+NPIt5og9xbYfUWJ1b/jXkZopb0VTM+H9tandM
24=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=example.com; h=to:subject
:from:content-type:message-id:date; q=dns; s=mail; b=pO5YvvjGTXs
3Qa83Ibq9woLq5VSsxUD5uoSrjNrW9ICMmdWyJpb9oT5byFR9hMthomTmfGWkkh6
3VxtD0hb0HVonN+1iheqJ9QBBOctadLCAOPZV3mfA99XUu7Y0DR2qtkU/UkSe8In
5PENWFbwub88ZsRDiW3hCbNHl+UO8Jsc=
Received: by gemini.example.com (Postfix, from userid 502)
id 386DE21A0166; Tue, 26 Jan 2010 13:55:14 -0800 (PST)
To: [email protected]
Subject: Shift License For James Xavier
From: "Shift Licensing"
Content-type: text/html
Message-Id: <[email protected]>
Date: Tue, 26 Jan 2010 13:55:14 -0800 (PST) Content-Length: 282`

Hotmail:

X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtTQ0w9Ng==
X-Message-Status: n:0
X-SID-PRA: [email protected]
X-AUTH-Result: NONE
X-Message-Info: 6sSXyD95QpWzUBaRfzf3NMbaiSGCCYGXSczlzLw49r01I25elu3oYM0V2uNa8BV2O7DOiFEeewTBKMtN+PW+ig==
Received: from gemini.example.com ([208.115.108.162]) by snt0-mc4-f7.Snt0.hotmail.com with Microsoft
SMTPSVC(6.0.3790.3959);
Tue, 26 Jan 2010 13:18:53 -0800
Received: from gemini.example.com (gemini [127.0.0.1])
by gemini.example.com (Postfix) with ESMTP id 9431321A0167
for ; Tue, 26 Jan 2010 13:18:53 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=gemini.example.com; h=to
:subject:message-id:date:from; s=mail; bh=DLF0k+uELpY6If5o3SWlSj
7j0vw=; b=nAMpb47xTVh73y6a2rf6V1rtYHuufr46dtuwWtHyFC85QKfZJReJJL
oFIPjgEC28/1wSdy8VbfLG1g64W1hvnJjet3rcyv3ANNYxnFaiH5yt3SDEiLxydS
gjCmNcZXyiVsWtpv7atVRO/t/Own+oFB9zz/9mj43Bhm4bnZ2cTno=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gemini.example.com; h=to
:subject:message-id:date:from; q=dns; s=mail; b=sFpNxlskyz4MYT38
BA/rQ6ZAcQjhy7STkLPckrCDVVZcE4/zukHyARq7guMtYCCEjXoIbVEtNikPC97F
cGpJGGZrppTGjx62N0flxG8hvwejiJYnUJF1EIP4JckGWyEI+21vtWLLQ27eegtN
fs9OkIQ2iUPC/4u8N1eqiff0VZU=
Received: by gemini.example.com (Postfix, from userid 504)
id 8ED7221A0166; Tue, 26 Jan 2010 13:18:53 -0800 (PST)
To: [email protected]
Subject: Testing this
Message-Id: <[email protected]>
Date: Tue, 26 Jan 2010 13:18:53 -0800 (PST)
From: [email protected]
Return-Path: [email protected]
X-OriginalArrivalTime: 26 Jan 2010 21:18:54.0039 (UTC) FILETIME=[29CEE670:01CA9ECD]

AOL:

X-AOL-UID: 3158.1902377530
X-AOL-DATE: Tue, 26 Jan 2010 5:07:23 PM Eastern Standard Time
Return-Path:
Received: from rly-mg06.mx.aol.com (rly-mg06.mail.aol.com [172.20.83.112]) by air-mg06.mail.aol.com (v126.13) with
ESMTP id MAILINMG061-a1d4b5f6787a4; Tue, 26 Jan 2010 17:07:22 -0500
Received: from gemini.example.com (gemini.example.com [208.115.108.162]) by rly-mg06.mx.aol.com (v125.7) with
ESMTP id MAILRELAYINMG067-a1d4b5f6787a4; Tue, 26 Jan 2010 17:07:04 -0500
Received: from gemini.example.com (gemini [127.0.0.1])
by gemini.example.com (Postfix) with ESMTP id 32B3821A0167
for ; Tue, 26 Jan 2010 14:07:03 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=gemini.example.com; h=to
:subject:message-id:date:from; s=mail; bh=RL0GLHd3dZ8IlIHoHIhA/U
cLtUE=; b=BKg4p3qnaIdFRjAbvUa+Hwcyc6W91v4B4hN95dVymJrxyUBycWMUSC
nzKmJ5QllhCYjwO+S7GrRdmlFpjBaK8kt2qmdCyC2UuiDF6xY6MXx/DBF56QpYtZ
YDY4kXdiEMSbooH14B4CCPhaCTdC1wCtV0diat3EANCLxSDYAYq5k=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gemini.example.com; h=to
:subject:message-id:date:from; q=dns; s=mail; b=fDSjNpfWs7TfGXda
uio8qbJIyD+UmPL+C0GM1VeeV8FADj6JiYIT1nT3iBwSHlrLFCJ1wxPbE4d9CGl8
gQkPIV6T4TL7ha052nur0EOWoBLoBAOmhTshF/gsIY+/KMibbIczuRyTgIGVV5Tw
GZVGFddVFOYgee7SAu0KNFm7aIk=
Received: by gemini.example.com (Postfix, from userid 504)
id 2D5F521A0166; Tue, 26 Jan 2010 14:07:03 -0800 (PST)
To: [email protected]
Subject: Testing
Message-Id: <[email protected]>
Date: Tue, 26 Jan 2010 14:07:03 -0800 (PST)
From: [email protected]
X-AOL-IP: 208.115.108.162
X-AOL-SCOLL-AUTHENTICATION: mail_rly_antispam_dkim-d227.1 ; domain : gemini.example.com DKIM : pass
X-Mailer: Unknown (No Version)
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit

Solution 1

In looking at your failures, I have noticed several problems.

The first is that the originating ip for your emails (208.115.108.162) is listed on Five Ten's blacklist (http://www.five-ten-sg.com). Yahoo, Hotmail, and AOL all use their own internal blacklists, and to my knowledge don't rely on third party blacklists (such as Five Ten). That being said, it's a good indicator that something is afoot. You can delist yourself at five ten here: http://www.five-ten-sg.com/blackhole.php?ip=208.115.108.162&Search=Search. Delistings usually take around 12 to 24 hours. While this won't necessarily FIX your Yahoo, Hotmail, AOL problem... you should delist pronto.

The biggest problem is the lack of MX record for gemini.shiftapp.com. The emails are "FROM" [email protected]. It is a very common anti-spam tactic to lookup the MX record of the sending domain on incoming email. When AOL etc lookup the MX record for gemini.shiftapp.com, and they see none... they will likely classify as spam on the spot. At the very least, an MX will allow the recipients of these emails to reply.

Reverse DNS: You have a valid PTR record for that IP. AOL etc just simply look to see that PTR records exist... they don't really care what the PTR record returns so you are "good to go" as they say.

I didn't find any SPF records for gemini.shiftapp.com or shiftapp.com. That's ok because SPF never really caught on. Kinda like 8 track or Laser Discs... they look good on paper, but never gained critical mass.

My bet is the lack of MX records. One other thing to consider: make sure your email server is not an open relay (allowing unauthenticated users to send mail to other users not hosted on your server). Also, might be wise to do an audit of all email going through your system... if one of your users is (knowningly or UNknowingly) sending spam through your server, you'll be skating uphill!

Hope this helps, and best of luck! -Chris

Solution 2

Have you checked with Yahoo/Hotmail/AOL and the various anti-spam blacklisting services? It's possible that a previous user of your IP was committing nefarious deeds with those digits.

According to this tool, your IP (208.115.108.162) is on the FIVETEN blacklist. According to their site, your IP is listed for the following reason: "IP address 208.115.108.162 is listed here as creditoffersite.com. Category: misc".

According to FIVETEN, the description of the misc category is:

misc - Miscellaneous includes (but is NOT limited to) the following groups. Note that this does NOT include misc.spam which is listed under spam above. 1) /24 blocks of addresses containing systems that are apparently sending bulk email (in volumes apparently comparable with the volume from AOL, Earthlink, Google), with any of the following attributes: missing or bogus reverse dns, reverse dns names in domains with no web server, or domains with boilerplate web content. 2) Systems that are strongly suspected of being multistage open relays (where I have not been able to identify the input stage) or open proxies.

According to Google's DNS servers, creditoffersite.com is now hosted at 72.20.40.25, but may at one point have been hosted at your IP, and committed some not-so-nice bulk emailing, or had issues with their mail relay.

Now, this isn't necessarily the reason AOL/Yahoo/Hotmail are blocking you, as this is only one blackhole list, and not a major one at all, but it's a possible clue to the ultimate issue. Another clue is things like this line from the Yahoo headers:

X-YahooFilteredBulk: 208.115.108.162

Contact AOL/Hotmail/Yahoo teams to get things resolved for sure.

Solution 3

Try this Email Server Test. If it checks out, contact the Individual service providers and join their Feedback loop program. That will give you some idea of why your emails are classified as SPAM.

Solution 4

First, as already stated - you should work towards getting yourself removed from any black lists (such as Five Ten's blacklist). You should also have an MX record for your domain in your "From Address" (it looks like you've already fixed this).

One thing I noticed in your Yahoo headers was an apparent invalid DKIM signature:

"dkim=permerror (bad sig)"

You may have something not quite right DKIM wise, which should be corrected.

port25.com provides a very useful tool for checking all your authentication methods. You can send a test email to "[email protected]" and you'll get a response back showing the results of each authentication check (SPF, DomainKeys, DKIM, Sender-ID, and Spamassassin). It took about 12 hours for me to get a report, so be patient.

Each of the providers you mentioned handles things differently. My understanding is that they often rely on internal blacklists as opposed to public lists. I've recently been through this with Yahoo and MSN (Hotmail) and the process was different for each. In my case I was literally 100% clean on all blacklists and have functioning and matching forward and reverse DNS, DomainKeys, DKIM, and SPF records. In addition to this, I only send a handful of personal emails a month (no mailing lists, subscriptions, or bulk emails of any kind). **None the less, email from me was still getting tossed into Yahoo's "Spam" folder and Hotmail's "Junk" folder. Point being - even if you're doing everything "right" you may still need to take proactive steps with these providers to get your email through.

Yahoo: When I'd email a Yahoo user their SpamGuard filter would add a "X-YahooFilteredBulk:" header to the email, which put it by default into the spam folder. For me, the key turned out to be filling out their Mail Bulk Sender Form. The process was a little peculiar because it's a form for describing what type of bulk email you send and it's really intended for legitimate bulk email senders (whereas I don't send any bulk email at all) - but this seems to be the way to reach the right folks. I just explained in the comments field that I don't send any bulk email and enumerated the steps I'd taken to comply with Yahoo's policies (DomainKeys, DKIM, SPF, ...etc). The form submission acted a little strange, so be sure you get a return page confirming your submission. I actually had to go back and fill in the "Other" fields in order to get the form to submit for some reason (it wouldn't let me leave any fields blank).

Hotmail: When I'd email MSN (Hotmail) users, their wasn't anything quite so clear in the headers (other than a "X-AUTH-Result: NONE" header). MSN keys in on the Sender ID protocol (uses SPF records). You can read about how to set it up here and fill out a form to be included in the program.

AOL: I didn't have any issues emailing AOL users, but I believe this is because they also make use of SPF records which I already had.

Solution 5

I'll copy some of the content from my post over here.

Your email server may be on a blacklist or if you're on DSL it could look bad if it's too close to dynamic ranges (even if you have a static IP on "business class DSL"). Check the free tools on MXToolbox.com to see if any of those apply to you. Run the blacklist test at DNSBL.info as well.

Furthermore, are there any links that you have within the emails you're sending out? That can count against you as well. Ultimately, you'll have to take it up with the abuse team at each of the problem domains (as phoebus pointed out, whom I seem to be parroting today =) ).

View more solutions

Comments

[Zypher]

You should have gotten an NDR from yahoo with a custom 5xx error code and a link to their support site explaining it.

[Chetan]

I did get this several times before the email got successfully sent: Jan 26 22:33:34 cheetan102009 postfix/smtp[23145]: CC4E021A0167: host e.mx.mail.yahoo.com[67.195.168.230] refused to talk to me: 421 Message from (208.115.108.162) temporarily deferred - 4.16.50. Please refer to help.yahoo.com/help/us/mail/defer/defer-06.html

[Wesley]

Good sleuthing, Sherlock.

[Chetan]

Thanks for your help. This is how my GoDaddy MX records look like at the moment. What should I be changing / adding? >MX (Mail Exchange) Priority Host Goes To TTL Actions 10 @ gemini.shiftapp.com

[Chetan]

Wow, your suggestion made it work for AOL! However, Yahoo! and Hotmail are still marking my messages as Spam. What should I do now? I added the following to my MX records: 10 gemini gemini.shiftapp.com

[Chetan]

Note: My domain is not actually shiftapp.com, it's polluxapp.com. I changed it in the question posting to avoid spambots.

[MT.]

Whether SPF caught on or not - it's used by both Hotmail and AOL - which the original poster is having issues with.

[Gagan Pal]

Just to be clear - Sender ID is not the same as SPF. They are different.

[Naveed Abbas]

SPF did caught on, but it's a sender protection. If you set up DMARC I assure you that most big recipients do quarantine emails suspected of spoofing sender address per both SPF and DKIM.