topic Re: Spam not marked as [-SPAM-] in Email

Spam not marked as [-SPAM-]

PhilipHeyes — Wed, 29 Oct 2025 14:09:13 GMT

After 20/10/2025 no spam / junk messages have been marked with [-SPAM-] in the email Subject field.

In the Plusnet email management portal our long standing spam settings remain enabled and unchanged,
what has worked very well for years appears to have stopped functioning.

Re: Spam not marked as [-SPAM-]

marshmallow — Sat, 01 Nov 2025 15:59:22 GMT

All my spam is now appearing in Inbox and not marked as spam. After change of email provider?

Re: Spam not marked as [-SPAM-]

PhilipHeyes — Sat, 01 Nov 2025 16:39:04 GMT

We have not been notified of a migration to GreenBy for our <names>@<account>.plus.com style of email accounts.

Increasing the spam sensitivity setting in the Plusnet email portal made no difference.

The spam detection & [-SPAM-] flagging process has stopped working.

Re: Spam not marked as [-SPAM-]

Townman — Sun, 02 Nov 2025 08:48:57 GMT

@marshmallow

Until such time as you receive personal notification your email provider has not changed. Email routing has changed but everything still comes in via the antivirus / spam filtering platform.

Why its behaviour has apparently changed has been flagged to the business.

Re: Spam not marked as [-SPAM-]

gashouse — Thu, 13 Nov 2025 14:47:51 GMT

I have the same issue. In last two weeks the number of phishing emails has increased fourfold. I have reported them as spam but they keep coming.

Re: Spam not marked as [-SPAM-]

marshmallow — Thu, 13 Nov 2025 15:04:51 GMT

Is someone from Plusnet looking into this? The amount of spam is really annoying

Re: Spam not marked as [-SPAM-]

jab1 — Thu, 13 Nov 2025 15:08:13 GMT

@gashouse / @marshmallow Is the spam all of a particular 'type'?

Re: Spam not marked as [-SPAM-]

marshmallow — Thu, 13 Nov 2025 15:31:09 GMT

I get mcafee protection expired, b and q you’re a winner (lots and lots of those with different contents), Argos you’ve won an apple bundle, mediamarkt (all in German) you’ve won a MacBook. Is that what you wanted to know?

Re: Spam not marked as [-SPAM-]

jab1 — Thu, 13 Nov 2025 15:35:46 GMT

They all do sound similar in content, (apart from the mcafee one). Do you use an email client or just webmail?

Re: Spam not marked as [-SPAM-]

marshmallow — Thu, 13 Nov 2025 15:47:52 GMT

I generally use IOS. I have been getting this stuff for a long time but it used to be diverted into Spam

Re: Spam not marked as [-SPAM-]

marshmallow — Thu, 13 Nov 2025 15:49:20 GMT

As a matter of interest why are you interested in the content? Spam is spam and should be dealt with by plusnet

Re: Spam not marked as [-SPAM-]

jab1 — Thu, 13 Nov 2025 15:55:48 GMT

@marshmallow OK. I'll leave this for @Townman -- he has more of a handle on it than I have.

EDIT

As a matter of interest why are you interested in the content?

Because when you get a lot of spam, it quite often originates fro the same source - knowing where it comes from can be useful in suggesting ways of alleviating it.

Re: Spam not marked as [-SPAM-]

PhilipHeyes — Thu, 13 Nov 2025 17:04:23 GMT

The deluge of spam emails come in from a never ending array of new senders and on a broad range of topics.

If we could have the Plusnet Spam filter working again and marking the vast majority of this stuff as [-SPAM-] that would would bring considerable respite.

Here is a clip of a header from one of these junk messages :-

Authentication-Results: mail.enmail.co;
	dkim=none;
	spf=fail (mail.enmail.co: domain of czsxcxf@aliexpress.com does not designate 27.194.164.10 as permitted sender) smtp.mailfrom=czsxcxf@aliexpress.com;
	dmarc=fail reason="No valid SPF, No valid DKIM" header.from=aliexpress.com (policy=reject)

Re: Spam not marked as [-SPAM-]

jab1 — Thu, 13 Nov 2025 17:11:56 GMT

Ah, another one getting 'aliexpress' rubbish - and yes, these are coming from China.

Re: Spam not marked as [-SPAM-]

Protech — Thu, 13 Nov 2025 18:38:48 GMT

Here is a clip of a header from one of these junk messages :-

Authentication-Results: mail.enmail.co;
	dkim=none;
	spf=fail (mail.enmail.co: domain of czsxcxf@aliexpress.com does not designate 27.194.164.10 as permitted sender) smtp.mailfrom=czsxcxf@aliexpress.com;
	dmarc=fail reason="No valid SPF, No valid DKIM" header.from=aliexpress.com (policy=reject)

@PhilipHeyes

I took the liberty of analyzing those headers via an automated tool and the result is as follows

dkim=none No DKIM signature was found in the message headers.

Legitimate AliExpress mail always includes DKIM — so this message was likely spoofed.

spf=fail The sending IP (27.194.164.10) is not authorized to send mail for aliexpress.com. Strong evidence of spam or phishing.

dmarc=fail Since both SPF and DKIM failed, DMARC also fails.

The domain’s DMARC policy says to reject — so your mail server should have rejected this outright.

So technically, the message fails all major authentication checks.

Can you check the full headers to check the presence or absence of spam analysis headers (e.g., X-Spam-Status, X-Spam-Score, etc.).

It's looking like the previous spam filtering is being bypassed somehow. A routing change was mentioned in a previous post and when something that previously worked stops the first question to ask is what's changed?

Re: Spam not marked as [-SPAM-]

PhilipHeyes — Fri, 14 Nov 2025 08:01:27 GMT

Attached is the full header, the destination email has been redacted.

For whatever reason this forum rejects the same content as a TXT file but appears ok with a PDF

Re: Spam not marked as [-SPAM-]

Protech — Fri, 14 Nov 2025 11:24:56 GMT

@PhilipHeyes

Even though the message looked like it slipped through the filters, the headers show that Plusnet did detect it as spam:

X-Spam: Yes

X-pn-pstn-db: "Spam 99"

X-PN-Spam-Filtered: by PlusNet MXCore

It also failed SPF, DKIM and DMARC, and the sending server was listed on several spam and botnet blacklists. So the filtering engines recognised it as junk exactly as they should.

The reason it reached the inbox is that Plusnet’s system tags spam but doesn’t always move or block it automatically.

The reason it's not marked SPAM is hopefully under investigation @Townman

Re: Spam not marked as [-SPAM-]

PhilipHeyes — Fri, 14 Nov 2025 12:29:24 GMT

RE: X-Spam: Yes

I am going to create an MS Outlook Rule to detect "X-Spam: Yes" in the message header
and to move those messages to the Junk E-Mail folder. Lets see if that works out.

Re: Spam not marked as [-SPAM-]

PhilipHeyes — Fri, 14 Nov 2025 17:15:50 GMT

A very quick update, the Outlook Rule to detect "X-Spam: Yes" does work as intended, the spam messages from this afternoon have been removed from the Inbox.

One surprise, Plusnet Forum notification emails contain a "dmarc=fail" and "X-Spam: Yes" so also end up with the Junk E-mail.

dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=community-mailer.plus.net (policy=none)

Re: Spam not marked as [-SPAM-]

Bookworms — Fri, 14 Nov 2025 18:37:56 GMT

It's ages since I've posted here but I just want to add that i have also seen a marked increase in spam emails over the last week or so.

In fact, i have had virtually no spam for months but I have recently received several , mostly from 'ali express'. Others are generic begging emails from exiled African princes &c.

I'm not too good at making sense of email headers but looking at those on the latest one received a few moments ago, it does seem to have been recognised as spam several times along its journey to my inbox but it still got through and it hasn't been marked as spam.

Below is a snippet from the source, if anyone can make sense of it:

FREEMAIL_REPLYTO(0.00)[gmail.com];
MISSING_MID(0.00)[];
RBL_SPAMHAUS_BLOCKED(0.00)[103.235.118.147:from];
R_NO_SPACE_IN_FROM(0.00)[];
DMARC_NA(0.00)[test.com: no valid DMARC record];
FUZZY_BLOCKED(0.00)[rspamd.com];
R_DKIM_PERMFAIL(0.00)[test.com:s=c3cff8d0bbb19917];
R_SPF_NA(0.00)[no SPF record];
FROM_HAS_DN(0.00)[];
FREEMAIL_ENVFROM(0.00)[test.com];
ARC_NA(0.00)[];
NEURAL_SPAM(0.00)[0.987];
DKIM_TRACE(0.00)[test.com:~];
RECEIVED_SPAMHAUS_BLOCKED(0.00)

.....