1

I have just setup a new mailserver using Postfix on CentOS 7, the machine serves as mx for two domains, domain1.com and domain2.com. The server's hostname is domain1.com and it has the correct PTR record set. Both domains point their only MX record at domain1 and both have correct DKIM and SPF records.

The problem is that mail sent from an address @domain2.com is consistently marked as spam by GMail, while the exact same mail sent from @domain1.com is not.

Below are some of the DNS records as output by dig.

Domain 1

domain1.com.    300 IN  A   1.2.3.4
domain1.com.    300 IN  MX  1 domain1.com.
domain1.com.    300 IN  TXT "v=spf1 mx ~all"
default._domainkey.domain1.com 300 IN TXT "v=DKIM1\; k=rsa\; p=<blurp>"

Reverse DNS for the 1.2.3.4

4.3.2.1.in-addr.arpa. 3600 IN    PTR domain1.com

Domain 2

domain2.com.     300 IN  A   1.2.3.4
domain2.com.     300 IN  MX  1 domain1.com.
domain2.com.     300 IN  TXT "v=spf1 mx ~all"
default._domainkey.domain2.com. 300 IN   TXT "v=DKIM1\; k=rsa\; p=<blurp>"

The SMTP server responds as following to EHLO:

220 domain1.com ESMTP Postfix
EHLO banana
250-domain1.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH PLAIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

Again, the problem is that the exact same mail sent from @domain2.com is flagged as spam, but not mail from @domain1.com. I tried running the whole setup through several DKIM and SPF validators, and I also checked the IP against several blacklists. In addition I ran all the tests on mxtoolbom.com, none of these tools report any problem.

Below are two emails sent by the same user from respectively domain1.com and domain2.com as GMail sees them:

Non-spam (@domain1)

Delivered-To: test_account@gmail.com
Received: by 10.60.57.165 with SMTP id j5csp382145oeq;
        Tue, 28 Oct 2014 06:11:12 -0700 (PDT)
X-Received: by 10.112.168.2 with SMTP id zs2mr3138752lbb.25.1414501871638;
        Tue, 28 Oct 2014 06:11:11 -0700 (PDT)
Return-Path: <user@domain1.com>
Received: from domain1.com (domain1.com. [1.2.3.4])
        by mx.google.com with ESMTP id lm8si2545487lac.7.2014.10.28.06.11.10
        for <test_account@gmail.com>;
        Tue, 28 Oct 2014 06:11:11 -0700 (PDT)
Received-SPF: pass (google.com: domain of user@domain1.com designates 1.2.3.4 as permitted sender) client-ip=1.2.3.4;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of user@domain1.com designates 1.2.3.4 as permitted sender) smtp.mail=user@domain1.com;
       dkim=pass header.i=@domain1.com
Received: by domain1.com (Postfix, from userid 1001)
    id 7104140D41; Tue, 28 Oct 2014 14:11:10 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=domain1.com;
    s=default; t=1414501870;
    bh=6ycM+eq5HvFTqqe79TLije21S91XFijH+fOKPHMU5Zc=;
    h=From:Subject:Date:To;
    b=<blurp>
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on domain2.com
X-Spam-Level: 
X-Spam-Status: No, score=-1.1 required=5.0 tests=ALL_TRUSTED,DKIM_SIGNED,
    DKIM_VALID,DKIM_VALID_AU,URIBL_BLOCKED autolearn=ham version=3.3.2
Received: from [192.168.178.63] (dsl.provider.com [100.100.100.100])
    by domain1.com (Postfix) with ESMTPSA id 726E140D09
    for <test_account@gmail.com>; Tue, 28 Oct 2014 14:11:05 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=domain1.com;
    s=default; t=1414501865;
    bh=6ycM+eq5HvFTqqe79TLije21S91XFijH+fOKPHMU5Zc=;
    h=From:Subject:Date:To;
    b=<blurp>
From: That Guy <user@domain1.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Subject: Yellow Bananas
Message-Id: <F5746816-4146-4F80-ACFE-D337BF1B8792@domain1.com>
Date: Tue, 28 Oct 2014 14:11:05 +0100
To: test_account@gmail.com
Mime-Version: 1.0 (Mac OS X Mail 8.0 \(1990.1\))
X-Mailer: Apple Mail (2.1990.1)

Hi,

Do not forget to buy some bananas!

Marked as span (@domain2.com)

Delivered-To: test_account@gmail.com
Received: by 10.60.57.165 with SMTP id j5csp382123oeq;
        Tue, 28 Oct 2014 06:11:01 -0700 (PDT)
X-Received: by 10.112.167.130 with SMTP id zo2mr4018217lbb.4.1414501861369;
        Tue, 28 Oct 2014 06:11:01 -0700 (PDT)
Return-Path: <user@domain2.com>
Received: from domain1.com (domain1.com. [1.2.3.4])
        by mx.google.com with ESMTP id mj1si2507360lbc.40.2014.10.28.06.11.00
        for <test_account@gmail.com>;
        Tue, 28 Oct 2014 06:11:01 -0700 (PDT)
Received-SPF: pass (google.com: domain of user@domain2.com designates 1.2.3.4 as permitted sender) client-ip=1.2.3.4;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of user@domain2.com designates 1.2.3.4 as permitted sender) smtp.mail=user@domain2.com;
       dkim=pass header.i=@domain2.com
Received: by domain1.com (Postfix, from userid 1001)
    id E816D40D41; Tue, 28 Oct 2014 14:10:59 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=domain2.com;
    s=default; t=1414501859;
    bh=6ycM+eq5HvFTqqe79TLije21S91XFijH+fOKPHMU5Zc=;
    h=From:Subject:Date:To;
    b=<blurp>
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on domain2.com
X-Spam-Level: 
X-Spam-Status: No, score=-1.1 required=5.0 tests=ALL_TRUSTED,DKIM_SIGNED,
    DKIM_VALID,DKIM_VALID_AU,URIBL_BLOCKED autolearn=ham version=3.3.2
Received: from [192.168.178.63] (dsl.provider.com [100.100.100.100])
    by domain1.com (Postfix) with ESMTPSA id F326840D09
    for <test_account@gmail.com>; Tue, 28 Oct 2014 14:10:54 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=domain2.com;
    s=default; t=1414501855;
    bh=6ycM+eq5HvFTqqe79TLije21S91XFijH+fOKPHMU5Zc=;
    h=From:Subject:Date:To;
    b=<blurp>
From: That Guy <user@domain2.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Subject: Yellow Bananas
Message-Id: <AD7F87AA-B53B-4D25-AD8F-C38E4C7D660F@domain2.com>
Date: Tue, 28 Oct 2014 14:10:53 +0100
To: test_account@gmail.com
Mime-Version: 1.0 (Mac OS X Mail 8.0 \(1990.1\))
X-Mailer: Apple Mail (2.1990.1)

Hi,

Do not forget to buy some bananas!

According to Google the reason for blocking the second mail is: "Why is this message in Spam? It's similar to messages that were detected by our spam filters. Learn more", which is a link to https://support.google.com/mail/answer/1366858?hl=en&expand=5.

I've been at it for several hours now, but I can't seem to figure this out. I did everything Google recommends in their bulk email guide.

  • 1
    Try using different words in the email just to see if the problem is consistent (one server approved, the other not). You might be hitting some random weirdness unrelated to which server is sending the mail. Additionally, does either domain have a "suspicious" name like getfreesexhere.com or the word 'suck' in it or something? – barrycarter Oct 28 '14 at 17:57
  • I tried sending several mails from both domains, with different contents. The mails from the second domain are consistently flagged as spam. Both domains have regular non-suspicious english dictionary words. – Blubber Oct 28 '14 at 18:03
  • You might be running into the "Scunthorpe problem". Try sending an email with an @domain2.com address but send it through domain1.com (or any other server). That will distinguish whether it's the address or the server. – barrycarter Oct 28 '14 at 18:19
  • Both domains use the same MX (domain1.com), in fact, both the emails where sent through the same SMTP server. I tried sending exactly the same email through mailgun, that one was not flagged as spam. Then I resent the same email through my own smtp server, and it got flagged again. I guess it has something to do with the smtp server not being on the same domain as the email address, but the SPF record should take care of this afaik. – Blubber Oct 28 '14 at 19:10
  • Have you tried telnetting (or ncat'ing) to port 25 of one of gmail's MX servers from your server, and seeing exactly what happens? It's possible you'll get a more useful error message. – barrycarter Oct 28 '14 at 22:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.