cancel
Showing results for 
Search instead for 
Did you mean: 

Another 552 Spam Message problem

breslaw
Rising Star
Posts: 63
Thanks: 19
Registered: ‎12-01-2008

Another 552 Spam Message problem

I've read quite a lot of recent and earlier forum posts about Error 552 rejections. Now I'm the victim of them, but I'm not quite sure what to do.

First off, I have raised a ticket (#201670733) about it, but I don't think the problem will get resolved that way.

An organisation I belong to emails me regularly and has done so for the past 10 years or so from a gmail account. No problems. A few days ago, the secretary emailed me to say that some of the emails she had sent me were being rejected. She forwarded me the rejection notifications, which all showed the 552 error.

Strangely, only some of the emails to me were getting rejected. I looked through them, and whilst some had embedded links, others had nothing but plain text as content.

However, they were all mass mailed by GMass (https://www.gmass.co) which does embed a link to themselves at the end of every message. That link is a bit odd:-

<http://ec2-52-26-194-35.us-west-2.compute.amazonaws.com/x/d?c=7156182&l=81515585-e937-41f2-8064-07ba5eb6bb76&r=ac56963f-9647-46e0-b01f-d3ef366c6564>

but is the same whether the email was one that got through to me or was one that got rejected.

So I'm at a loss how to proceed. The secretary is not technical and is getting fed up with a growing pile of rejection notifications ostensibly from me. I should add that she mass mails to 167 other members, and I'm the only one that gets rejected.

Thanks for any suggestions.

 

21 REPLIES 21
Townman
Superuser
Superuser
Posts: 22,920
Thanks: 9,537
Fixes: 158
Registered: ‎22-08-2007

Re: Another 552 Spam Message problem

@JW  - are you able to assist with this one please?

Superusers are not staff, but they do have a direct line of communication into the business in order to raise issues, concerns and feedback from the community.

JW
Plusnet Staff
Plusnet Staff
Posts: 314
Thanks: 100
Fixes: 24
Registered: ‎09-11-2007

Re: Another 552 Spam Message problem

I can see that this has been passed through to the team who deals directly with this kind of issue. Normally, all we'd need to look at this would be the sender's email address, your email address and the date the rejection was seen.

In some cases, which I suspect this may be one, to review it fully we will ask for a full copy of the message that the sender is trying to send to you and is causing this problem. This is usually so that fingerprint's can be fine tuned if there is now legitimate email that is matching one of the algorithms that used to only match spam.

 Jon W
 Plusnet
breslaw
Rising Star
Posts: 63
Thanks: 19
Registered: ‎12-01-2008

Re: Another 552 Spam Message problem

I did upload the rejection message in my update to the ticket on 14 May. Since the original message was short, the rejection contains the entire original. Customer Support responded yesterday (17.5) evening, saying they are :- "raising this to our Networks Operations team for investigation". Meanwhile I have whitelisted the sender's address to see if that makes a difference.

breslaw
Rising Star
Posts: 63
Thanks: 19
Registered: ‎12-01-2008

Re: Another 552 Spam Message problem

As expected the ticket I raised for this problem is going nowhere. Support staff keep asking me to provide them with the original email so they can investigate.  They seem to fail to understand that because the server rejects the orginal email, I cannot do that. I have uploaded the rejection message (forwarded to me by my correspondent) both as .eml  and as message source saved from Thunderbird. They keep saying this isn't good enough, without saying what I should actually do to satisfy their requirements.

I've tried calling to ask them to explain what the previous written requirements in the ticket mean, but whoever I've spoken to says they don't understand them either.

And so it goes on.

I did speak to someone called [CSA Removed] who asked me to forward the rejection message to him via email. But this didn't seem to break the vicious circle.

One Support person suggested I stop using PlusNet for email. He's definitely got his eye on the Employee Of The Month medal. 😉

Any better suggestions?

Moderator's note by Dick (Strat): CSA name(s) removed (to an area staff can see) as per Forum rules.

 

Townman
Superuser
Superuser
Posts: 22,920
Thanks: 9,537
Fixes: 158
Registered: ‎22-08-2007

Re: Another 552 Spam Message problem

@JW

... use an email service with less assertive security measures ... interesting advice. Armed with date time, subject and sender might this be traced through the server logs if getting the original email into PlusNET’s well protected email regime appears to be impossible?

Superusers are not staff, but they do have a direct line of communication into the business in order to raise issues, concerns and feedback from the community.

bobpullen
Community Gaffer
Community Gaffer
Posts: 16,869
Thanks: 4,950
Fixes: 315
Registered: ‎04-04-2007

Re: Another 552 Spam Message problem

@breslaw, do you have access to a non-Plusnet email address? Might your correspondent be willing to send a copy of the email in question to that address so we can obtain a full copy of it?

Bob Pullen
Plusnet Product Team
If I've been helpful then please give thanks ⤵

breslaw
Rising Star
Posts: 63
Thanks: 19
Registered: ‎12-01-2008

Re: Another 552 Spam Message problem

Whilst I'm sure my correspondent could send the message to another email address, I don't think this would help you solve the problem for the following reason:-

As I said in my original posting of this issue, my correspondent sends regular emails to the 167 or so members of her organisation. Prior to about the end of February this year, emails to all members were sent from a fixed list, and there were never any rejections. As from the end of February, they started using the GMass mass mailing system within gmail. Rejection problems to myself started at the same time.

So if my correspondent sent a copy of one of the emails that were rejected to a different address (perhaps even an address that you provide), this would not (probably could not) be sent via GMass. Hence this might not trigger the spam detector.  You can see from the rejection message that I have uploaded in different formats to the ticketing system, that the original message is a simple piece of plain text. In my understanding, it is highly unlikely that the message itself is triggering your spam detector. It is much more likely that it's the link that GMass plants in the message body.

Why can't you extract the original message - including the GMass link - from the rejection message and work on that?

Thanks for making contact.

 

 

JW
Plusnet Staff
Plusnet Staff
Posts: 314
Thanks: 100
Fixes: 24
Registered: ‎09-11-2007

Re: Another 552 Spam Message problem

@Townman 

Whilst, normally, that information would be sufficient to locate the appropriate logs and discuss it with Cloudmark, there are occasions where this isn't the case. There are many things in an email that can cause a spam rejection, and if it's something simple such as a domain or URL, then just the rejection information from the Plusnet logs is sufficient. However, as appears to be the case here, there are some fingerprints that aren't just a yes/no. The only way that these can be reviewed further for false positives is for Cloudmark to see them in the original context as set by the sender. Any extra text or manipulation around this can cause issues with investigating the false positive, which is why it should be a copy of the original from the sender.

 Jon W
 Plusnet
MisterW
Superuser
Superuser
Posts: 14,575
Thanks: 5,411
Fixes: 385
Registered: ‎30-07-2007

Re: Another 552 Spam Message problem

From a quick google search , it would appear that using Gmass can easily cause a problem with email being falsely detected as spam.

They've even introduced a Spam solver https://www.gmass.co/blog/spam-solver-tweaks-emails/ to assist with this.

But I suspect more important is this https://www.gmass.co/blog/spammers-gmass-and-why-your-legitimate-emails-are-ending-up-in-spam-or-bei...

@breslaw  does your sender use the default tracking domain referred to in that link ? If so I would suggest that they take the advice in there and implement a dedicated tracking domain.

Superusers are not staff, but they do have a direct line of communication into the business in order to raise issues, concerns and feedback from the community.

breslaw
Rising Star
Posts: 63
Thanks: 19
Registered: ‎12-01-2008

Re: Another 552 Spam Message problem

Thank you.  This is the first good analysis of the problem I've seen. I had no idea what GMass was. I've looked at some of their advice about spam, and notice that as well as (or instead of) implementing a dedicated tracking domain on GMass, there is also the possibility of turning off tracking. This looks simple to try.

Thanks again.

MisterW
Superuser
Superuser
Posts: 14,575
Thanks: 5,411
Fixes: 385
Registered: ‎30-07-2007

Re: Another 552 Spam Message problem

The others who posted earlier, have very likely analysed the problem as being a domain in the email as being marked by Cloudmark, just as I have postulated. The problem is that without knowing what domain that is they can't check the Cloudmark signatures, hence they needed a copy of the original email.

My suggestion is a different approach, in that it requires the sender to take steps to avoid using a domain which may be suspect. 

TBH that's something that any organisation should be doing anyway. The problem with spam is only going to get worse and anyone using a free mass mailing system is, sooner or later, going to see problems.

Superusers are not staff, but they do have a direct line of communication into the business in order to raise issues, concerns and feedback from the community.

bobpullen
Community Gaffer
Community Gaffer
Posts: 16,869
Thanks: 4,950
Fixes: 315
Registered: ‎04-04-2007

Re: Another 552 Spam Message problem


@breslaw wrote:

Why can't you extract the original message - including the GMass link - from the rejection message and work on that?


I did, before I posted my last reply to you.

All the content you have provided our support team checks out fine.

My suggestion would be to have the list maintainer add a non-Plusnet hosted email address for you so a second copy can be sent (and hopefully received) from the GMass mailer, that we can then analyse to establish what about it our servers are taking a dislike to.

Bob Pullen
Plusnet Product Team
If I've been helpful then please give thanks ⤵

breslaw
Rising Star
Posts: 63
Thanks: 19
Registered: ‎12-01-2008

Re: Another 552 Spam Message problem


@bobpullen wrote:

 

My suggestion would be to have the list maintainer add a non-Plusnet hosted email address for you so a second copy can be sent (and hopefully received) from the GMass mailer, that we can then analyse to establish what about it our servers are taking a dislike to


Thank you for your suggestion.  There are a couple of difficulties with this. One is that, since not all messages are rejected,  we would have to wait and keep checking in order to correlate a rejected email with one received by the non-Plusnet address. Secondly, and unfortunately, my correspondent thinks she has already done enough for me by forwarding rejection messages on request. Not being a technical person, she views it as my problem that I should solve.  Temporarily messing about with her mailing list is just not on.

However,  assuming that it is the GMass tracking links planted in the body of the emails that are causing the problem, I might be able to persuade her to switch off GMass tracking on "ethical" grounds. 🙂

MisterW
Superuser
Superuser
Posts: 14,575
Thanks: 5,411
Fixes: 385
Registered: ‎30-07-2007

Re: Another 552 Spam Message problem

she views it as my problem that I should solve

@breslaw  whilst I can see why it would appear like that to her, its going to be a bigger problem sooner or later. Unless she takes some action to fix it, she's likely to start getting spam rejections from more and more of her correspondents...

PlusNet dont use a proprietary spam detection, rather, I believe, they use a commercial system, Cloudmark (see https://www.cloudmark.com/en/s/products/cloudmark-security-platform-for-email ). If that's marking the mail as suspect, which it would appear it is, then other commercial systems will likely do so as well.

Superusers are not staff, but they do have a direct line of communication into the business in order to raise issues, concerns and feedback from the community.