spam filter not working

[#1]

ive had a plus net emails for years and now the last few months ive had loads of spam all from the US how can i stop them if the spam not even picking them up someome please help 

[#2]

@missy2210, are the messages being identified as spam? If not, then can you private message me with a copy of one of the emails including headers? To get header information from Webmail, highlight the email in the message list, then click the cog in the toolbar and select 'Show source'.

[#3]

hi none is going into my spam and there all from the US  and i do not know how to copy the email as am not good at all this 

[#4]

@missy2210

To get the information Bob requested, log into webmail, then highlight one of the spam emails by clicking its title in the list. That should get you to the start point marked in the following image

Now click the cog as shown and select (click) Show source on the drop down menu.

That should open another window displaying all the message source. Right-click inside this window and select (click) Select All. All the text should now be highlighted.

Right-click in the highlighted text and select Copy.

Finally create a Private Message to Bob (please ask if you are unsure of how to do this). After some explanatory text click the </> Insert code icon, right-click in its text entry box and select Paste. Click OK to add this to the message then send it.

Note: the copied email contains your email address, so best not paste the text into this forum.

[#5]

Hi Bob

Afraid the fix isn't working !

The (.US) domain spam is still coming and nothing is getting marked as Spam.

Andy

[#6]

Damn
Travelling today so might not get the chance to take a look. If I dont, I'll pick it up when I'm back in the office.

[#7]

Moderator's note:

Threads merged.

[#8]

@casman1, can you message me a recent example, using the guidance provided by @spraxyt a few posts back?

Edit: a quick test suggests things should be fixed  

~$ telnet mx.core.plus.net 25
Trying 212.159.8.1...
Connected to mx.core.plus.net.
Escape character is '^]'.
220 mx.core.plus.net ESMTP Exim Fri, 21 Jul 2017 10:56:36 +0100
ehlo core
250-inmx19.plus.net Hello core [84.93.219.165]
250-SIZE 104857600
250-8BITMIME
250-PIPELINING
250 HELP
mail from:<>
250 OK
rcpt to:<****@*o***c*.plus.com>
451-Plusnet: Please route email according to MX record
451 (*o***c*.plus.com/84.93.219.165)
421 inmx19.plus.net: SMTP command timeout - closing connection
Connection closed by foreign host

[#9]

Hi Bob

Don't know if this is relevant ?

But just logged onto webmail to send info and it contains no messages apart from the 3 emails sent when you reset my account last week ?

Absolutely nothing else

so whats going on?!

Andy

[#10]

Hi

Since Saturday not had any spam! hurray! so hope its working now, however still nothing coming through in the webmail?

Andy

[#11]

Sorry to hear webmail isn't working. I've sent the ticket on your account back to our mail team to further investigate.

[#12]

Spam started again tonight. 2 so far usual .us domains.

[#13]

---

casman1 wrote:

Since Saturday not had any spam! hurray! so hope its working now, however still nothing coming through in the webmail?

It won't come into Webmail. The problem is that spammers were trying to send messages directly to the servers at mx.core.plus.net - this shouldn't be allowed if you have spam filtering enabled. With spam filtering enabled, your email is supposed to get delivered via the servers at mx.avasin.plus.net.

Below was before we applied the fix i.e. emails to your address were getting accepted by mx.core.plus.net:

220 mx.core.plus.net ESMTP Exim Wed, 12 Jul 2017 14:01:31 +0100
ehlo core
250-inmx10.plus.net Hello core [84.93.219.165]
250-SIZE 104857600
250-8BITMIME
250-PIPELINING
250 HELP
mail from:<>
250 OK
rcpt to:<[REDACTED]@[REDACTED].plus.com>
250 Accepted

And this is after the fix. Now attempts to bypass the spam filters are being met with a temporary 4xx SMTP rejection:

220 mx.core.plus.net ESMTP Exim Fri, 21 Jul 2017 10:56:36 +0100
ehlo core
250-inmx19.plus.net Hello core [84.93.219.165]
250-SIZE 104857600
250-8BITMIME
250-PIPELINING
250 HELP
mail from:<>
250 OK
rcpt to:<****@*o***c*.plus.com>
451-Plusnet: Please route email according to MX record
451 (*o***c*.plus.com/84.93.219.165)
421 inmx19.plus.net: SMTP command timeout - closing connection
Connection closed by foreign host

The spammers will still be trying to send to mx.core.plus.net, but now all of their attempts will be getting bounced back with a 451 error message. These emails will all be outright rejected, and therefore you shouldn't expect to see them in your spam folder, or anywhere else when checking Webmail.

@casman1 wrote:
Spam started again tonight. 2 so far usual .us domains.

---

Different situation. These messages *are* now being received via our spam filters, but are simply not being identified as spam. Note below that they are correctly being routed via our 'avasin' servers? You can also see an 'X-CM-Score' header which means the message has been looked at by our spam filters (you can access the below info yourself, by highlighting a message in Webmail, clicking the cog in the task bar and then clicking 'Show source'):

Return-path: <Frank.K@jail.teaf.us>
Envelope-to: [REDACTED]
Delivery-date: Tue, 25 Jul 2017 14:04:45 +0100
Received: from [212.159.9.108] (helo=avasin18.plus.net)
	  by inmx16.plus.net with esmtp (PlusNet MXCore v2.00) id 1dZzW1-00080B-3p 
	  for [REDACTED]; Tue, 25 Jul 2017 14:04:45 +0100
Received: from jail.teaf.us ([172.93.237.251])
	by avasin18.plus.net with Plusnet Cloudmark Gateway
	id p14i1v0045S7lto0114keR; Tue, 25 Jul 2017 14:04:45 +0100
X-CM-Score: 0.00
X-CNFS-Analysis: v=2.2 cv=Ua4hcOaN c=1 sm=1 tr=0
 a=sBm/lKtzS1D8Rmp7lb3PuQ==:117 a=sBm/lKtzS1D8Rmp7lb3PuQ==:17
 a=MKtGQD3n3ToA:10 a=7W2AyVZsVmwA:10 a=ZZnuYtJkoWoA:10 a=_Kngrbu4AAAA:8
 a=wPyyH8I7ZQ4V2-Ur20cA:9 a=-FEs8UIgK8oA:10 a=NWVoK91CQyQA:10 a=SSmOFEACAAAA:8
 a=bTIFF1b0Kgffj5XG57YA:9 a=7Zwj6sZBwVKJAoWSPKxL6X1jA+E=:19
 a=Fmbl852rIoLMkYZz:21 a=04ohzbIP1JqIeQyS:21 a=gzDby2VGdWbYFkw_:21
 a=_W_S_7VecoQA:10 a=QEXdDO2ut3YA:10 a=p403mkujtbAA:10
 a=EPO1CI6PDxR-ZaTbNdRC:22
Date: Tue, 25 Jul 2017 06:00:01 -0700
Message-ID: <2039772715142411-d91374ab1a39bc9f6eb9a1bbd0db3592@jail.teaf.us_bx6>
To: [REDACTED]
Content-Transfer-Encoding: 8bit
Content-Type: multipart/alternative; boundary="20397727_15142411_20397727"
Mime-Version: 1.0
From: Frank.K <Frank.K@jail.teaf.us>
X-PN-Virus-Filtered: by PlusNet MXCore (v5.00)
X-PN-Spam-Filtered: by PlusNet MXCore (v5.00)
Subject: Why You Should Carry and Know How to Use a Tactical Laser.

Probably worth highlighting these messages in Webmail and clicking the 'Mark as Spam' button in the task bar if they continue.

@casman1 wrote:

...however still nothing coming through in the webmail?

Do you mean no email is coming through at all? If so, make sure you're logging into the correct mailbox (you have three). The first you log into using your normal Member Centre username, for the others you'll need to use the format 'username+mailbox_name' (minus quotes), e.g. username+andy

@Gandalf wrote:
Sorry to hear webmail isn't working. I've sent the ticket on your account back to our mail team to further investigate.

I've sent the ticket back to Andy because I don't see there being anything further our engineers need to do.

[#14]

Hi

ahh yes sorry i was logged into wrong mail box.i see mail now in my inbox.!

still confused as to how the obvious spam is bypassing your filters as it has never been the case?

also still not getting removed spam with the (spam) mark added to subject line  moved to the junk box?

Andy

[#15]

---

@casman1 wrote:

... still confused as to how the obvious spam is bypassing your filters as it has never been the case?

No spam solution is perfect. At the moment though, I can't see anything untoward.

... also still not getting removed spam with the (spam) mark added to subject line  moved to the junk box?

Not sure I understand. Are you saying you're receiving emails with '[SPAM]' in the subject line that aren't being automatically moved to the junk folder? If so, I'd need to see an example to work out what's happening.