Topic: returned mail marked as SPAM and lands in junkmail

[cirkit]

A lot of mailer daemon returned mails land in my junk mail folder.
I tried a test, i mailed myself at my sme mail address and that message landed in junk-mail as SPAM
How can this be avoided.
I am using outlook to view mail over pop3s hence if junkmail arrives i am uninformed.
I am surprised that mail sent tp myself from my own mailboz lands in junmail.
Please help

[cirkit]

my SPAM filter is enabled in server-manger panel
sensitivity=custom
tag level=4
rejection level=12
spam folder=enabled
modify subject of spam= yes

Even if this is enabled why should messages from my own mailbox to myself be marked as SPAM??

[janet]

cirkit

Look in the headers of the messages and see what score they get and the reason for the score.

[cirkit]

yes the score on the headers are higher than the score i have set, i put the headers for two e-mails here below, one mail is from an external sever while the other as i mentioned is to "myself" with a score of 5.7, Why does my own mail get a score of 5.7 and who and how these scores are assigned,what can be done so our own mails get a better score and do not land up as spam


header of mail example 1
Return-Path: <>
Delivered-To: nitesh-junkmail@mcp61.cardioacademy.org
Received: (qmail 1026 invoked by alias); 9 Aug 2008 07:30:01 -0000
Delivered-To: alias-localdelivery-nitesh-junkmail@cardioacademy.org
Received: (qmail 1023 invoked by uid 5007); 9 Aug 2008 07:30:01 -0000
Delivered-To: nitesh@mcp61.cardioacademy.org
Received: (qmail 1019 invoked by alias); 9 Aug 2008 07:30:01 -0000
Delivered-To: alias-localdelivery-nitesh@jst.net.in
Received: (qmail 1016 invoked by uid 453); 9 Aug 2008 07:30:01 -0000
X-Virus-Checked: Checked by ClamAV on cardioacademy.org
X-Spam-Status: Yes, hits=7.5 required=4.0
   tests=HTML_FONT_SIZE_HUGE,HTML_IMAGE_ONLY_28,HTML_MESSAGE,MY_CID_AND_STYLE,PART_CID_STOCK,PYZOR_CHECK,T_TVD_FW_GRAPHIC_ID1
X-Spam-Flag: YES
X-Spam-Check-By: cardioacademy.org
Received: from mx1.asus.com (HELO ms.asus.com) (220.228.144.28)
    by cardioacademy.org (qpsmtpd/0.40) with ESMTP; Sat, 09 Aug 2008 12:59:54 +0530
Received: from tp-ex-n15.corpnet.asus (HELO TP-EX-08.corpnet.asus) ([192.168.28.157])
  by ms.asus.com with ESMTP; 09 Aug 2008 15:29:48 +0800
Received: from tp-ex-09.corpnet.asus ([192.168.28.22]) by TP-EX-08.corpnet.asus with Microsoft SMTPSVC(6.0.3790.3959);
    Sat, 9 Aug 2008 15:29:48 +0800
From: postmaster@ccm.asus.com.tw
To: nitesh@jst.net.in
Date: Sat, 9 Aug 2008 15:29:48 +0800
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
   boundary="9B095B5ADSN=_01C88026E746BA060000D9DFtp?ex?09.corpnet"
X-DSNContext: 7ce717b1 - 1158 - 00000002 - 00000000
Message-ID: <aEpIdBIXv00000a7d@tp-ex-09.corpnet.asus>
Subject: ***SPAM*** Delivery Status Notification (Failure)
Return-Path: <>
X-OriginalArrivalTime: 09 Aug 2008 07:29:48.0248 (UTC) FILETIME=[B4015580:01C8F9F1]


header of mail example 2

Return-Path: <nitesh@heartproblem.in>
Delivered-To: nitesh-junkmail@mcp61.cardioacademy.org
Received: (qmail 7136 invoked by alias); 10 Aug 2008 07:12:02 -0000
Delivered-To: alias-localdelivery-nitesh-junkmail@cardioacademy.org
Received: (qmail 7133 invoked by uid 5007); 10 Aug 2008 07:12:02 -0000
Delivered-To: nitesh@mcp61.cardioacademy.org
Received: (qmail 7129 invoked by alias); 10 Aug 2008 07:12:02 -0000
Delivered-To: alias-localdelivery-nitesh@jst.net.in
Received: (qmail 7126 invoked by uid 453); 10 Aug 2008 07:12:02 -0000
X-Virus-Checked: Checked by ClamAV on cardioacademy.org
X-Spam-Status: Yes, hits=5.7 required=4.0   tests=HTML_MESSAGE,MIME_HTML_MOSTLY,PYZOR_CHECK,TVD_SPACE_RATIO
X-Spam-Flag: YES
X-Spam-Check-By: cardioacademy.org
Received: from static-mum-59.181.130.14.mtnl.net.in (HELO heartproblem.in) (59.181.130.14)
    by cardioacademy.org (qpsmtpd/0.40) with SMTP; Sun, 10 Aug 2008 12:41:57 +0530
Received: (qmail 13845 invoked by uid 453); 10 Aug 2008 07:11:53 -0000
X-Virus-Checked: Checked by ClamAV on heartproblem.in
Received: from [59.182.235.225] (HELO u8668) (59.182.235.225)
  (smtp-auth username nitesh, mechanism login)
  by heartproblem.in (qpsmtpd/0.40) with ESMTPA; Sun, 10 Aug 2008 12:41:53 +0530
Message-ID: <000901c8fab8$600dc220$0564a8c0@u8668>
Reply-To: "Nitesh Vasant" <jst@vsnl.net>
From: "Nitesh Vasant" <nitesh@heartproblem.in>
To: <nitesh@jst.net.in>Subject: ***SPAM*** rkhunter log
Date: Sun, 10 Aug 2008 12:41:54 +0530
Organization: J.S.Traders
MIME-Version: 1.0
Content-Type: multipart/mixed;
   boundary="----=_NextPart_000_0005_01C8FAE6.78629D90"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3028
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3100

[mrjhb3]

Look at the file /home/e-smith/files/users/your_user/.qmail.

You should see something like | condredirect your_user-junkmail headermatch 'X-Spam-Status: Yes'

So, if the header has X-Spam_Status: Yes, which your two samples do, then they end up in the junkmail folder.


John

[CharlieBrady]

A lot of mailer daemon returned mails land in my junk mail folder.

Many of those messages are SPAM messages, and have been "returned" to you, merely because your email address has been used as the "sender" address by the trojan/virus which sent the spam. This is called "backscatter".

This one for instance sure looks like spam to me:

Code: [Select]

X-Spam-Status: Yes, hits=7.5 required=4.0
   tests=HTML_FONT_SIZE_HUGE,HTML_IMAGE_ONLY_28,HTML_MESSAGE,MY_CID_AND_STYLE,PART_CID_STOCK,PYZOR_CHECK,T_TVD_FW_GRAPHIC_ID1

If you look further down in the message, you should be able to confirm that by seeing where the message actually originated.

For the messages which aren't spam messages, you should be more concerned with why the messages were returned to you, rather than worrying too much about how the messages are sorted.

[cirkit]

no the returned messages aren't spam they are returned from geneuine servers(people)

[alejandro]

Hi,  I have being thinking about this issue since I have a lot of "bounced" mail  landing in junk mail too
IMHO It should be clasiffied as spam cause in fact this is spam (unsolicited mail).
Consistence between originating mail domain address and/or IP address should be checked to avoid this huge traffic (it could be done at bouncer side or bounce receiver side.)
Further thinking could conclude that spammers are, in fact, using "bounce like" headers in order to reach some destination and some chance of being read. If you check this returned mails you would probably find links and font images, instead of a real bounce.
So, if the discussion is: "spam or not spam", I should consider this as spam. I dont want this false bounces in mail junk mail or elsewhere! even if the "pretended" sender is me@mydomain.ext

Ale
(sorry about my english!)