none
Emails received in spam

    Question

  • Hello,

    My company is an email service provider and we have our own email server.

    We are facing a problem in receiving emails on hotmail/exchange : almost everything arrives in spam. For our customers and even for our test mailboxes we receive lots of emails in spam directory.

    We have checked our configuration on postfix side and everything seems to be ok (dns, spf, dkim, dmarc are ok). When we send emails to mail-tester, it's pretty good (10/10) but when arriving on Microsoft related mailboxes it's not that good.

    Here are the SMTP headers for a legitime email arrived in spam


    Received: from DB6P195MB0071.EURP195.PROD.OUTLOOK.COM (2603:10a6:4:16::20) by
     AM5P195MB0067.EURP195.PROD.OUTLOOK.COM with HTTPS via
     DB6P18901CA0010.EURP189.PROD.OUTLOOK.COM; Thu, 29 Mar 2018 17:35:24 +0000
    Received: from VI1P195CA0012.EURP195.PROD.OUTLOOK.COM (2603:10a6:800:d0::22)
     by DB6P195MB0071.EURP195.PROD.OUTLOOK.COM (2603:10a6:4:c8::13) with Microsoft
     SMTP Server (version=TLS1_2,
     cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.609.10; Thu, 29
     Mar 2018 17:35:23 +0000
    Received: from HE1EUR02FT018.eop-EUR02.prod.protection.outlook.com
     (2a01:111:f400:7e05::201) by VI1P195CA0012.outlook.office365.com
     (2603:10a6:800:d0::22) with Microsoft SMTP Server (version=TLS1_2,
     cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.631.10 via Frontend
     Transport; Thu, 29 Mar 2018 17:35:23 +0000
    Authentication-Results: spf=pass (sender IP is ---------)
     smtp.mailfrom=----------; ---------.onmicrosoft.com; dkim=pass
     (signature was verified)
     header.d=------------;------------.onmicrosoft.com; dmarc=pass
     action=none header.from=----------;
    Received-SPF: Pass (protection.outlook.com: domain of ---------
     designates --------- as permitted sender)
     receiver=protection.outlook.com; client-ip=------------;
     helo=-----------;
    Received: from ---------- (------------) by
     HE1EUR02FT018.mail.protection.outlook.com (10.152.10.248) with Microsoft SMTP
     Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id
     15.20.631.7 via Frontend Transport; Thu, 29 Mar 2018 17:35:21 +0000
    DKIM-Signature: v=1; a=rsa-sha256;
     bh=SMiQ2lsjbqaIO0/QtW7b3+WgPvmk2NYL7X1+WRlz30U=; d=-----------;
     h=Message-ID: Date: Subject: From: Reply-To: To: MIME-Version: Content-Type:
     X-Transport: X-Mailer: List-Unsubscribe; i=@-------------; s=postfix;
     t=1522344921;
     b=opa+U3UU34UMHlZnxKjilSqWcSicD/Ad1utG9zu7t5FAch9pnkYSxZ//04h8DOKndp3wHqse/
     sWpEhBWGdhoy38meMlqNjOfhYB6rOkOR6KP1S/xLC+kaXGjY6/HAFcsV4ME4Xl+V3+zE6nGOf
     T8H3mez9Q4o9H4D1fHC7Wl4NA=
    Message-ID: <test-555-224-0DAiU>
    Date: Thu, 29 Mar 2018 19:35:21 +0200
    Subject: --------------------
    From: -------------------
    Reply-To: ---------------
    To: "----@--------.onmicrosoft.com"
     <---@------.onmicrosoft.com>
    MIME-Version: 1.0
    Content-Type: multipart/alternative;
     boundary="_=_swift_v4_1522344921_ee8af6464a5818a654c420d2085ebf38_=_"
    X-Transport: ------
    X-Mailer: --------- [version 4.22.1 =?utf-8?Q?20180323=5F11=3A?=
     =?utf-8?Q?16=0A=5D?=
    List-Unsubscribe: https://------------
    Return-Path: --------@-----------
    X-MS-Exchange-Organization-Network-Message-Id: e87c8cf6-ef53-415b-d12a-08d5959b7284
    X-EOPAttributedMessage: 0
    X-EOPTenantAttributedMessage: 6e9a243b-8a72-4bb2-9ea1-d7c59c87c148:0
    X-MS-Exchange-Organization-MessageDirectionality: Incoming
    X-Forefront-Antispam-Report: CIP:------------;IPV:NLI;CTRY:BG;EFV:NLI;SFV:SPM;
    SFS:(8156002)(2980300002)(438002)(189003)(199004)(62520400004)(5660300001)(1857600001)(606006)(33964004)(62590400003)(62580400003);DIR:INB;SFP:;SCL:5;SRVR:DB6P195MB0071;H:------;FPR:;SPF:Pass;PTR:---------;MX:1;A:1;CAT:SPM;LANG:fr;
    X-Microsoft-Exchange-Diagnostics: 1;HE1EUR02FT018;1:FEMry8pxaJKzvVYAvKGjV9Y5Ul+KVjhGQdyKyFxWbEWSB+XXQ5bs63wIw/FVjjlnIxnkUWLESMwV+EnNWX+8841ThCWQdcxjr6K7N8uRfvpTw0zgVQNWoGd8L/ekG1/N
    X-MS-Exchange-Organization-AuthSource: HE1EUR02FT018.eop-EUR02.prod.protection.outlook.com
    X-MS-Exchange-Organization-AuthAs: Anonymous
    X-MS-PublicTrafficType: Email
    X-MS-Office365-Filtering-Correlation-Id: e87c8cf6-ef53-415b-d12a-08d5959b7284
    X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(7020095)(5600026)(4604075)(4605076)(4608076)(4614076)(1401096)(8001031)(1402068)(71702078);SRVR:DB6P195MB0071;
    X-Microsoft-Exchange-Diagnostics: 1;DB6P195MB0071;3:74r2qPPaVk+FrM0wEh6YC1du1/QFvJN95WEnQAz9pL/xqLnLpLbpD7pO4pHN3q7bAL9xv1CBKlLSfIUxxkuYL5nNOhVRcFSpa/jWiBVlBbctUod1/c5/GwyL2jPnEGnfHYgS0ABrPQCMvnCjjJF8Nf84cit0MN/6Al3Nd8oIjnrluUggMnggT7eCFMzFQMCymMDTwprrN/a5uKGBoLbp8dKZnv+aR7Gsis7NGgUFBwDVqqgwprYHtcid7nrICKL8QJbLJjdvLz6jDlFQSp4gKsl3zV8zyP4LCLZtGvcnsdujhzXvX93OoawspOeHQThTlZ4VIha/TCdD7X66C48siuEyPkj3niKTKUE6yn8Fv4c=;25:IdkC+/8smAmMrW+UIDhpWBoHOtH2R2QIVA6u21RzC9b7LxFQfpFO2TfGgUIWfAXL7Y4dRZ1xxCoUxjHajvawEJRrx0qmslVl4JaTpuTNxfqkwxNKl4HGA4s0Py4pO3DImYrV5vGgSwe3hi1p5HN3Ymr+HwG+ICoQ84XsbVq3TOWQlcUWxocboudaeqGhfvwBtIAqhYoqhxOIRggKs7fRix294T4rAu15xhVYk0zi0eJDlnY45Ma5KVTX6Nu4boL3ArXAFwv2nUBMNZcpa2G4Q9yNXQ5A0mvpgcVi4xUFKMsMZofQjIdjzCE0C9dIJE0qe1Th8YqQySJSRg2VfieWUw==
    X-MS-TrafficTypeDiagnostic: DB6P195MB0071:
    X-Microsoft-Exchange-Diagnostics: 1;DB6P195MB0071;31:AXA67yQJ4wP7oC5IH1TCIbzpm3oB1ak16YNzVu89lgiPRreKfRQwzeB2oYSACRv22D/Y9ESY4s4JkIz2JL7U+xq7GspqC8B0fgwwDIlqXUBS3rBUyBzy3GgKf7Ye+XskY/D3eaN+vW1MFqTtPrXFTCn5Af3IIIIy6UW528Ry4XDbY/EBpQMR2qPG6U0YwECgyTfP6mvMZ7lIfF3IBdqy8FMUom6L9gLvsqaCG2YCmYY=;4:o4jJZgxodPUL0YGSV1UfZ+O1Sh2N+UTKdLfY9GANMZjuIRaWUfLiflVXud42mQYZ16hEswY2XGRi2+xpnAQpervhJAfg5B4wjSEf9LuSBf8xAZ/OPUrnh/G4G5altbD/Lu2GIsYiATaeVU8Q8Jx70A+99UO96Ug0iIxK/LueWEviRf2OBVrarae9u0gAOwzEKme4ntFlwnZUpsxZM+FJfXarQ58nQilAT3fplkJIOFQTzRqua2s6BOXSmRPwCLRRTF0GW7rbirj4kyhdcksdWg==
    X-Exchange-Antispam-Report-Test: UriScan:;
    X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(2401047)(8121501046)(1430347)(1431041)(1432103)(1551027)(9101536074)(3231221)(902075)(913077)(944500087)(944510158)(944921075)(946801075)(946901075)(52103095)(52105095)(52106095)(52401095)(52601095)(52606095)(52603095)(52606095)(52602095)(52606095)(52602095)(52606095)(52602095)(52606095)(52602095)(52505095)(52503095)(52406095)(93006095)(93005095)(3002001)(10201501046)(1610001)(8301001075)(8301003183)(201708071742011);SRVR:DB6P195MB0071;BCL:0;PCL:0;RULEID:;SRVR:DB6P195MB0071;
    X-MS-Exchange-Organization-SCL: 5
    X-Microsoft-Exchange-Diagnostics: 1;DB6P195MB0071;23:jkuvYVrOAL9SynraEwNWunDpUVFuh4s+seei2OtiqsQFiFikr+qTdr2s+nnbsUNHGGIxLCbZDqpyErrDjTeHnWT6x6fX0ZtIY8yto+MngC/TS7Z3hTCiT+BTsrgoyxNBZTa55GA/ksBzfKJAGq2YRWcYlw6Q/+Zv76RJtEgHR2oOPJ7oGqQpnfuUIcpAUD0lCCa7fPWkIlD2Rs6u9qNitSHxsuhDlFlQnWqIVcFFDCkPfEE1e4RU9zOHXivxcZKrrKKv+e5FuMGbskqQGjjFm7o/hGTqsQHJjCRD4x1H2UvNNWwyew1lclMidoIcj9AD4n+eTTXOrn+h0mZ+uMtdKaJUCkH/Ws4QTRNhC63pmeu3VKuH5gl/ymOw6GK830ixHkmb2T0FqQ9iJAEkZhkRf+H9oS/ODEz0O1tkRk/RVY4=
    X-Microsoft-Exchange-Diagnostics: 1;DB6P195MB0071;6:t9rOp2U6g/sgkVNwGWHnf6Tm4Tk0c8Box7eGeEvwd0YECiLZOSgYAhQvhXYgh2ewMZ0lc0SxYookOkYypNMn34QzMv9cE0A2WrJYF0mN7OrpXIi27sVdc90LQRIRG5+EPNfWo4pH4JetU8QmNOAchpElpTVT8ZI+zNSqlwYuu7SRe1Iq69aV37/W1+Hv+OtdhCdCeGGPW1O+phn6BQb7OGLTPH1QyuPstgMagsll4UuvhwjLIggxc9EgAnElIawIpvHZ87GjfNFgiTb78zI2t9zdKpmlfJ33+twa/Iy8kCgS/B4YbkjtzM2kcjxHeliDs1vl0iCrhzxv9tiEkm7XvXOrvcCgyns/UzoNfmb8IBL4WwUyU9qWuRNRSvykUZbLtdUcpvcSZyEViaSSHxWw8tnUfgm0JjVqbHOPXMUcFI1H/nfLBIpt/R1h8GsIttsPoFYAX1DzQnvJoOlB7pwi4bmcEn8LDWNjSFnQMSXzx8Gsfg+/K+9JlXRWfH8hyE8bgTxBxSTdvh7KyjAAUR9rXavOjmcqAKGY4vVa5hKUxRo=;5:KCvWYkfId0Y3jt0i6t+zSkeUaxjAfG6NJNXrLrp430tNTp60dxIFwFvZud7Rfki5DDJNKS6ZCXz+TBTh+kWzk/+YT/i6n71KK4j544AUI476xDo7uIzGwWEhGNyUZJF66q22ndO92xVyRoJMC4WCgfFmp++G0b5VIsMYBgy6rOs=;24:/FHU2I4UFdGGpUPUtI+uE8+YwJn5/QxXK/y7H1LrZZPRSGLA9Zpp2DXSevgYXHj3B1vA4zQA/Nd4alkEwCnVmA==
    SpamDiagnosticOutput: 1:22
    X-Microsoft-Exchange-Diagnostics: 1;DB6P195MB0071;7:MZlkeeSnTs4FdluRUD/kWP9bkIESsWeBWz7HffCAXq+EyysUquUO+20IoVWISzxCUVxCJdQckUCq54mB8Cjw+CQCD+LJZlWGlueY3HtGaY3wYodQoEkJsmbgBzoev5+gBmYUl4R4xkm4smTk3SYiMa/2tF3VgYGRhwZk38F4cQr8casK/xSef84GzwUOWg+kQ0d7nGDs7qKaOk/tlxxnAfGHkVKgXghSVS47chuucYLRMPK3uVTjJUIagAXGSK9W/MKui+c2T7SiCkExNqJxI6RMmidieHWnL46DtvJCH2k=
    X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Mar 2018 17:35:21.2819
     (UTC)
    X-MS-Exchange-CrossTenant-Network-Message-Id: e87c8cf6-ef53-415b-d12a-08d5959b7284
    X-MS-Exchange-CrossTenant-Id: 6e9a243b-8a72-4bb2-9ea1-d7c59c87c148
    X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
    X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6P195MB0071
    X-MS-Exchange-Transport-EndToEndLatency: 00:00:03.6486663
    X-MS-Exchange-Processed-By-BccFoldering: 15.20.0631.000
    X-Microsoft-Exchange-Diagnostics:
    	1;AM5P195MB0067;9:TTxHdCD7CzQ0jrMqEckaEZo1h7lf5iKBHRMtAdAMiXXPcddGHnvYerjqSLPR9sIu8e2gvYZClVW+FXUXTx6uRyIvCvm12DVGeC2flNmrbCFaWwn1h3WVoaspC0XhDvhB
    X-Microsoft-Antispam-Message-Info:
    	9rDrbx0VyApMdp37lEl6QEdjfNBiiVbrIe4UdYMW6I02cRYtrY3cxcGiH2/YQWzJymghwrQr8DWTou2+cKLKo7Ujcr4vccBYMc3QyLOm4o40sfLNseC528Ns+s4e/qQt8K4p01k0LfDIwrZPlPJblTWV6chva1tLP7U7Z9r1uzj6IZo9MoEObBcOhBXaaCAN2lYg5Lse35BcCqVDZZ5qPgvW0CP+LjrAqOas32mcvAJJcsfM7JCGJaCVNNrePM3as06W31SMutnOR5GAPfAVz36r6CQMsYwqQm3P6g/xKjRwsXQnBozInI9xYpvHOG4Ny+s+8a/4FJ5MaVRlfchje/JppmAc0ZCopAxBJPAYxVZdjajBMh4LyxELIa5jc5aQyk/Do+OFsc517bHHrtMdbQkzqH3omwts+0TR/5qsmNOSDLmPKvxqN4eej6W1DUY8lX+b2ur+HZxzbSTfogxqmaw+WLYGLhWNrEq7PGMZqx867SSrCEqVAhxtxCgLOCZ8U0JaJRv/k6bS+beKYLScsEfoyrOXUoZdz6JdixyUKDZ6iG9JmKXDGuuOuKmRs2XST2KXTzdiKjUrW29ZDQ8rdRp7kNfVT+K2PPwe+ujCNRCE+LhgvIL7v8k5/XXEX6ClkIDNioCEedl8dXB+TUyVJtR2MsUCzL5GuiSn/OPY450=
    X-Microsoft-Exchange-Diagnostics:
    	1;AM5P195MB0067;27:8eC6c5ORN0z+X9LYEb4EH7066Q1XgC+aIX5cyasYrW/Y4T225IXy1VYBZZYFUGtopy9qYJXNnnqdKacYOkT4pXwQIxkXRvdzBseFjWTUa2vgKdgZFERgRIguzsosz7R0

    The headers SFS & Diagnostic seem pretty interesting

    SFS:(8156002)(2980300002)(438002)(189003)(199004)(62520400004)(5660300001)(1857600001)(606006)(33964004)(62590400003)(62580400003);DIR:INB;SFP:;SCL:5;SRVR:DB6P195MB0071;H:------;FPR:;SPF:Pass;PTR:---------;MX:1;A:1;CAT:SPM;LANG:fr; X-Microsoft-Exchange-Diagnostics: 1;HE1EUR02FT018;1:FEMry8pxaJKzvVYAvKGjV9Y5Ul+KVjhGQdyKyFxWbEWSB+XXQ5bs63wIw/FVjjlnIxnkUWLESMwV+EnNWX+8841ThCWQdcxjr6K7N8uRfvpTw0zgVQNWoGd8L/ekG1/N

    X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(7020095)(5600026)(4604075)(4605076)(4608076)(4614076)(1401096)(8001031)(1402068)(71702078);SRVR:DB6P195MB0071;
    X-Microsoft-Exchange-Diagnostics: 1;DB6P195MB0071;3:74r2qPPaVk+FrM0wEh6YC1du1/QFvJN95WEnQAz9pL/xqLnLpLbpD7pO4pHN3q7bAL9xv1CBKlLSfIUxxkuYL5nNOhVRcFSpa/jWiBVlBbctUod1/c5/GwyL2jPnEGnfHYgS0ABrPQCMvnCjjJF8Nf84cit0MN/6Al3Nd8oIjnrluUggMnggT7eCFMzFQMCymMDTwprrN/a5uKGBoLbp8dKZnv+aR7Gsis7NGgUFBwDVqqgwprYHtcid7nrICKL8QJbLJjdvLz6jDlFQSp4gKsl3zV8zyP4LCLZtGvcnsdujhzXvX93OoawspOeHQThTlZ4VIha/TCdD7X66C48siuEyPkj3niKTKUE6yn8Fv4c=;25:IdkC+/8smAmMrW+UIDhpWBoHOtH2R2QIVA6u21RzC9b7LxFQfpFO2TfGgUIWfAXL7Y4dRZ1xxCoUxjHajvawEJRrx0qmslVl4JaTpuTNxfqkwxNKl4HGA4s0Py4pO3DImYrV5vGgSwe3hi1p5HN3Ymr+HwG+ICoQ84XsbVq3TOWQlcUWxocboudaeqGhfvwBtIAqhYoqhxOIRggKs7fRix294T4rAu15xhVYk0zi0eJDlnY45Ma5KVTX6Nu4boL3ArXAFwv2nUBMNZcpa2G4Q9yNXQ5A0mvpgcVi4xUFKMsMZofQjIdjzCE0C9dIJE0qe1Th8YqQySJSRg2VfieWUw==

    SCL:5 means SPAM but I am not able to see why the message is marked as spam. Anyone has the explanation of the different RuleIds ?

    The diagnostics seem to be encoded in base64, anyone knows how to make it readable ?

    Thanks for your help



    Thursday, April 5, 2018 7:36 AM

All replies

  • Hi,

    Thanks for contacting our forum. Do you have any AVs that scanning the inbound messages?

    Does this issue affect the internal messages? And what’s the detailed version of your Exchange server?

    It’s recommended to create a transport rule to set the value of SCL of the inbound message to 0 or -1.

    For decode we usually use the link below:

    https://www.base64decode.org/  

    Hope it helps.


    Best Regards,
    Jason Chao


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.


    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    Friday, April 6, 2018 2:01 AM
    Moderator
  • Hi,

    The emails experiencing the junk classification are sent from our servers (postfix) to outlook.com addresses. If there is any AV running, it's on oulook.com' side. I didn't any better forum to post the topic.

    The problem is concerning the reception on outlook.com (& live.com & lots of domains managed by exchange / office 365 that I am not admin of). Microsoft inbound softwares are finding something bad in the emails we are sending but I cannot see what. According to them, all my IPs are clean. We are following all the guidelines and the best practises, so what ?

    Is there any online documentation about the RuleIds used by the Exchange Antispam ?

    Or any documentation to decode the encoded reports ? When base64 decoded I get some binary streaming that I cannot understand, this is not basic base64 encoding, it's somtething more complex.

    Friday, April 6, 2018 9:53 AM
  • Thanks for your response. I would recommended to contact the Outlook.com, and refer to the following similar thread:

    https://answers.microsoft.com/en-us/outlook_com/forum/oemail-osend/emails-being-marked-as-spam-by-outlookcom/8b98b032-30ee-4d94-acea-bf19a91d8490?auth=1

    Outgoing mail wrongly classed as spam or phishing by Microsoft software

    Please note: Since the website is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information. And the changes made in the above blog is not supported officially by Microsoft.

    Hope it helps.


    Best Regards,
    Jason Chao


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.


    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    Monday, April 9, 2018 1:50 AM
    Moderator