Plusnet SMTP server incorrectly rejecting outgoing email as spam

[#1]

I'm trying to send an email containing the text www.freeagentcrm.com

Any email containing that text, whether it is formatted as a link or is simply plain text, is rejected by Plusnet's SMTP server as follows:

SMTP Response: 552 rOmheUx0XT6RfrOmieyYB6 message rejected due to spam or virus. If you believe this is in error please login to your portal or contact your ISP support team.

I've tried sending to different recipients (myself included), all with the same result.

I've tried stripping out all the text in the email leaving only www.freeagentcrm.com and the rejection still occurs.

If I change the text to www.freeagent.com the email is not rejected.

Note that www.freeagentcrm.com is a valid (non-spam, non-phishing) business site (as is www.freeagent.com)

Why is this rejection happening please?

Plusnet can you fix it asap please, so I can send my legitimate email.

Thanks

[#2]

I have just tied sending that URL to my PN account from an oulook.com email address and got the following...

Error Details

Reported error: 550 5.7.350 Remote server returned message detected as spam -> 552 Spam Message Rejected DSN generated by: HE1PR0902MB1962.eurprd09.prod.outlook.com Remote server: avasin13.plus.net

xxx

Message Hops
HOP	TIME (UTC)	FROM	TO	WITH	RELAY TIME
1	01/03/2018 18:08:38	HE1PR0902MB2153.eurprd09.prod.outlook.com	HE1PR0902MB2153.eurprd09.prod.outlook.com	mapi	*
2	01/03/2018 18:08:38	HE1PR0902MB2153.eurprd09.prod.outlook.com	HE1PR0902MB1962.eurprd09.prod.outlook.com	Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256)	*

-----------------------------

Original Message Headers

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=xxxxxx.onmicrosoft.com; s=selector1-XXXXXX-co-uk0i; h=From: Date:Subject:Message-ID:Content-Type:MIME-Version; bh=9ZYOy+EZoyB7egqUjc3b0AS2Ox2RHuu47mC3UemlKQw=; b=gCUbtbSsGFdFbfBm/pxBDrgWq1gF4RBOK92L6C71LVYgsDnITXKqY+FBN5Fs4+PzTfhw3PJIXfUQNYrdfVNo1BoPicoJBS0uGQWZtNqRl30CI1Fh7+c/U9y0yMXzQM43X380gbWY2+2ipbev41yfgBKv/fRLxgXG4Yj9u2Idjv8=Received: from HE1PR0902MB2153.eurprd09.prod.outlook.com (10.171.197.147) by HE1PR0902MB1962.eurprd09.prod.outlook.com (10.170.252.150) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.506.18; Thu, 1 Mar 2018 18:08:38 +0000Received: from HE1PR0902MB2153.eurprd09.prod.outlook.com ([fe80::91df:4305:c467:a67c]) by HE1PR0902MB2153.eurprd09.prod.outlook.com ([fe80::91df:4305:c467:a67c%13]) with mapi id 15.20.0527.022; Thu, 1 Mar 2018 18:08:38 +0000From: Neil XXXXX <neil@XXXXXX.co.uk>To: Kevin XXXXX<kevin.XXXXX@XXXX.me.uk>Subject: SPAM testThread-Topic: SPAM testThread-Index: AdOxiEu/FO44g2v9SDiVaNV3N7v1RA==Date: Thu, 1 Mar 2018 18:08:38 +0000Message-ID: <HE1PR0902MB2153F007D15A1486562CE4E1A3C60@HE1PR0902MB2153.eurprd09.prod.outlook.com>Accept-Language: en-GB, en-USContent-Language: en-USX-MS-Has-Attach: yesX-MS-TNEF-Correlator:authentication-results: spf=none (sender IP is ) smtp.mailfrom=neil@xxxxxx.co.uk; x-originating-ip: [80.229.190.xxx]x-ms-publictraffictype: Emailx-microsoft-exchange-diagnostics: 1;HE1PR0902MB1962;7:RLL2sOZCOGCks5yublIaJUf8ASRpyCpWsAqU0kHfpvVSo+NGcHtIdM367ZkWp6RkUQhQDaFIqTLmLKS5hG45myeWVAHEmWiEAjvr5TK6LHDARE1x7bRrB6DPiJs5v7B3qndGwOW4REm0I/zWv5MESC63T2Uxv8ed0Ba1kb5o5OUwow9SIC8dZgIpL/C3Dps522x9n+wuKPXe6LEheSmxvL1rLO7LSN/D1rm5d8JJwW5BHow3hnIm8v3l5+EHmZ9fx-ms-exchange-antispam-srfa-diagnostics: SSOS;x-ms-office365-filtering-correlation-id: 80f127cd-7744-4feb-800b-08d57f9f7506x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(7020095)(4652020)(7021125)(5600026)(4604075)(3008032)(4534165)(7022125)(4603075)(4627221)(201702281549075)(7048125)(7024125)(7027125)(7028125)(7023125)(2017052603307)(7153060)(49563074)(7193020);SRVR:HE1PR0902MB1962;x-ms-traffictypediagnostic: HE1PR0902MB1962:x-ld-processed: ef2670de-1741-454e-a8f5-e9de1feed42b,ExtAddrx-microsoft-antispam-prvs: <HE1PR0902MB1962D9D33893A8C0EAEC14CDA3C60@HE1PR0902MB1962.eurprd09.prod.outlook.com>x-exchange-antispam-report-test: UriScan:(147031080116667)(28532068793085)(207045540264911)(86561027422486)(21748063052155)(64217206974132);x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(102415395)(6040501)(2401047)(8121501046)(5005006)(93006095)(93001095)(3002001)(3231220)(944501161)(52105095)(10201501046)(6041288)(20161123560045)(20161123562045)(20161123564045)(20161123558120)(2016111802025)(6043046)(6072148)(201708071742011);SRVR:HE1PR0902MB1962;BCL:0;PCL:0;RULEID:;SRVR:HE1PR0902MB1962;x-forefront-prvs: 05986C03E0x-forefront-antispam-report: SFV:NSPM;SFS:(10009020)(39830400003)(346002)(376002)(39380400002)(396003)(366004)(189003)(199004)(102836004)(74316002)(6916009)(99286004)(81166006)(59450400001)(81156014)(68736007)(86362001)(3480700004)(3280700002)(3660700001)(74482002)(606006)(7736002)(5660300001)(14454004)(2900100001)(478600001)(105586002)(8936002)(221733001)(66066001)(33656002)(186003)(8676002)(236005)(316002)(790700001)(99936001)(106356001)(6436002)(3846002)(733005)(55016002)(54556002)(54896002)(6306002)(6116002)(7116003)(861006)(9686003)(5890100001)(5250100002)(25786009)(26005)(2906002)(6506007)(97736004)(7696005)(53936002);DIR:OUT;SFP:1101;SCL:1;SRVR:HE1PR0902MB1962;H:HE1PR0902MB2153.eurprd09.prod.outlook.com;FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en;received-spf: None (protection.outlook.com: xxxxx.co.uk does not designate permitted sender hosts)x-microsoft-antispam-message-info: EUQWEqDydVM5AJql6aPSEu9XSXp9H50qK1HU7/dW1fiGbGddI5ez7pAP/K8LztIfAAB9a4gtuBRZTVJfnp1cff00ti6Kg2y7/UwR9V0069DO+I4RrI485qa6+QHJz1KcfPrI+81fKq7ljmdHL2b+uZ5yIRTcqpgx5O3vQs53Aq0=spamdiagnosticoutput: 1:99spamdiagnosticmetadata: NSPMContent-Type: multipart/related; boundary="_011_HE1PR0902MB2153F007D15A1486562CE4E1A3C60HE1PR0902MB2153_";        type="multipart/alternative"MIME-Version: 1.0X-OriginatorOrg: xxxxx.co.ukX-MS-Exchange-CrossTenant-Network-Message-Id: 80f127cd-7744-4feb-800b-08d57f9f7506X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Mar 2018 18:08:38.1743 (UTC)X-MS-Exchange-CrossTenant-fromentityheader: HostedX-MS-Exchange-CrossTenant-id: ef2670de-1741-454e-a8f5-e9de1feed42bX-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0902MB1962

[#3]

I have also been having emails bounced with the same message. In my case, it was when sending a PDF file. It does contain a number of links, all UK travel related, tripadvisor types and websites of attractions. Wrapped it in a ZIP file and was able to send okay.

Would add, this is via the John Lewis named servers.

[#4]

My Mum is having the same error (see attached screenshot).  It seems to happen for her only when sending an attachment.  

But today it has been intermittent - I sent emails with attachments from her account successfully to a Gmail address and to a non-Gmail-connected Plusnet address of my own.  But when she tried again to send an email with an attachment that had failed with the error yesterday, it failed again with the same error (in this case it was being sent to a btinternet.com address, though the error isn't restricted to these addresses).  [added: We've had a success and a failure today with an MSWord .docx attachment.]

In case it makes a difference... She is using our family's own domain name, which is DNS hosted by Plusnet.  And her email account, associated with this domain name, is also hosted by Plusnet (on their legacy system from back when they provided email accounts to their customers).  And she is using Gmail, me having setup her domain name's email account in Gmail's "Send mail as" so that Gmail collects mail from Plusnet's POP3 server and sends mail through Plusnet's (unsecured) SMTP server.

What setup is everyone else using - those of us who are experiencing the error?  Are you using Gmail to send and receive your Plusnet email?  Are you using a domain name hosted by Plusnet (rather than the standard emailaccount@username.plus.com)?

[#5]

My Mum is still getting the 552 error bounce back when sending an email through the Plusnet SMTP server from her Gmail.

A correction from my previous message: while she can successfully send an MSWord .docx attachment to a gmail address (one that does NOT use the Plusnet servers), she can NOT send an MSWord attachment to a Plusnet email address (my address, which uses the same domain name) or a btinternet.com address.

I've just tested a couple of other things.  She can successfully send an email (without attachment) that contains the text www.freeagent.com and her signature, but not one containing www.freeagentcrm.com, nor one containing the text http://www.pinewoodproperties.co.uk (NB Gmail converts all these URLs to links).

This is from the bounce back email containing the pinewoodproperties URL:

The response was:

552 sD2pe91ND1g0XsD2qevyUu message rejected due to spam or virus. If you believe this is in error please login to your portal or contact your ISP support team.

Final-Recipient: rfc822; [I've removed the intended recipient's email address here (mine)]
Action: failed
Status: 5.0.0
Remote-MTA: dns; relay.plus.net (212.159.9.107, the relay for the domain.)
Diagnostic-Code: smtp; 552 sD2pe91ND1g0XsD2qevyUu message rejected due to spam or virus. If you believe this is in error please login to your portal or contact your ISP support team.
Last-Attempt-Date: Sat, 03 Mar 2018 11:42:12 -0800 (PST)

The bounce back messages are very similar, except for the Date & Time and the bit after 552 in the Diagnostic-Code.  The bit from the Diagnostic-Code when sending the freeagentcrm URL was:

552 sD42eQbSWoqCwsD44esr4b

Is this the same for other people sending www.freeagentcrm.com as text in an email without an attachment?

[#6]

I sent an email from an external service to a Plusnet email address containing only

http://www.pinewoodproperties.co.uk

...and it was rejected by PlusNet's email servers.

@bobpullen / @Kelly -can you offer any insight please?

[#7]

Can confirm @Townman's finding above:
SMTP error from remote server for TEXT command, host: mx.avasin.plus.net (212.159.9.200) reason: 552 Spam Message Rejected

[#8]

Yep, now I'm getting the same 552 error when sending from my own Plusnet account as my Mum is from hers.

It happens when sending specific attachments or when sending specific URLs in the text of the email (whether as links or plain text) - and it's the same attachments or URLs that do or do not lead to the error whether I am sending the email from my own account or whether my Mum is sending the email from her account:

• www.freeagentcrm.com
• www.pinewoodproperties.co.uk (NOTE: I spotted this domain in relation to a slightly different problem in another thread)

But NOT www.freeagent.com

My setup for my own account does not use Gmail - I use Apple's Mail program on macOS 10.12, connecting through a Plusnet broadband account, using a personal domain name hosted by Plusnet, and the Plusnet POP3, IMAP, and SMTP servers.  I therefore don't have to wait for a bounce-back email message to let me know of the error and failure to send - I get an error message within the Mail program immediately on sending (see attached screenshot).

(In answer to my own question in an earlier post, the string of seemingly-random letters in the Diagnostic-Code changes every time I try and send an email with the error-triggering content - even if it's the same content or even the same email.)

[#9]

I tweeted @plusnethelp and got a response asking for the message headers. But the messages which trigger the error haven't arrived anywhere, so I think the headers of what would be an unsent message won't reveal anything except details about the program/agent used to create the email. So it looks like I'll be hanging on the telephone tomorrow waiting for a CS agent...

@plusnethelp I'm unable to send email through Plusnet's SMTP server with certain content - get 552 error. See https://community.plus.net/t5/Email/Plusnet-SMTP-server-incorrectly-rejecting-outgoing-email-as-spam... for more detail - others are having same problem. Please tell me someone is looking at this and will sort it.

— Martin Burch (@snozboz) March 4, 2018

Hi Martin. We'll need a copy of the mail headers to be able to investigate this further -Matt

— Plusnet Help (@plusnethelp) March 4, 2018

[#10]

It’s the headers in the rejection email attachment as per post #2.

Superuser escalation

This topic has been escalated by one of the Superusers; please allow time for Plusnet to respond before commenting further.

Escalation does not imply progressing this matter will be given priority, nor that a different outcome will result.

Reason for escalation:  Request Response

[#11]

Hi all. We've raised this internally to look into, and we'll update when we know more.

Sorry for the inconvenience this is causing.

[#12]

---

@Gandalf wrote:

Hi all. We've raised this internally to look into, and we'll update when we know more.

Sorry for the inconvenience this is causing.

---

Nothing heard yet.

However, Plusnet's SMTP server no longer rejects emails containing the text www.freeagentcrm.com, therefore I assume that somebody has tweaked the filter configuration somewhere.

Thank you.

The problem reported in the 1st and 2nd message is now fixed.

I am unable to say whether the related problems reported by the other posters are resolved.

[#13]

I am unable to say whether the related problems reported by the other posters are resolved.

I spoke to Plusnet initially on Monday 5th March; they acknowledged the problem was real, couldn't do anything immediately, and passed it to another team for investigation.

By Sunday 11th, emails containing www.pinewoodproperties.co.uk were no longer failing to send.  Plusnet asked me to send them more email headers which I did that day.

I was informed on Thursday 15th in my Question/Ticket (number 169781487) that the spam filter for emails containing www.freeagentcrm.com had been reset - which meant that such emails could now be sent successfully.

However I replied that day to say that this hadn't solved the problem for emails containing certain attachments, and that therefore the general problem had NOT been resolved.  I haven't heard anything more.

Is resetting the spam filters for specific email content (i.e. instances of the error) the only solution available to Plusnet and their anti-spam-solution provider?

If so, are we as customers to expect to have to report headers of problem emails on an ongoing basis (and have to wait this long for a solution each time)?  And therefore are Plusnet content to have to receive reports of headers of problem emails on an ongoing basis too?  These are genuine questions - while it is frustrating, I would like to know.  This is not intended to be a whining complaint, but instead an attempt to learn at what level to set my expectations.

[#14]

Why this happens was explained in a recent post by a staff member

---

@bobpullen wrote on 14-03-2018 10:29 PM:
It's born from our anti-spam vendor. They're good guys really, and there's always a legitimate reason for such false positives, but sometimes the nice guys get on the naughty guys' list. Typically from others reporting messages as spam, or messages hitting global spam traps.

---

Since the spam peddlers are unlikely to abandon their craft, avoiding us getting swamped requires means to be found to block it - and unfortunately blocking sometimes throws up false positives. To those affected it's a major nuisance but overall the problem will be relatively small.

A fiddly process and significant timescales to resolution have been mentioned here. These are issues the superusers can and will take up with Plusnet to seek improvement, but please be aware this might take a while.

[#15]

I had another response to my ticket/question (169781487) on Tuesday 20th, but have only been able to reply today.

Unfortunately the response was less than satisfactory.  The first sentence was difficult to comprehend due to a typo/spelling mistake/poor grammar. Also it seemed that the CSC Analyst hadn't fully understood the issue, and was asking for information I had already previously given.  So I've had to, yet again (assuming this is what the CSC Agent wants), compose and send emails containing an attachment that had previously failed to send (in Plusnet's Webmail, Apple Mail, and my Mum's Gmail), and give details of these along with details of the errors.

I understand the point about false positives in the ongoing arms race against spammers etc. But, along with a solution to the problem, I would still like answers to my questions:

---

Is resetting the spam filters for specific email content (i.e. instances of the error) the only solution available to Plusnet and their anti-spam-solution provider?

If so, are we as customers to expect to have to report headers of problem emails on an ongoing basis (and have to wait this long for a solution each time)?  And therefore are Plusnet content to have to receive reports of headers of problem emails on an ongoing basis too?

With incoming spam, Plusnet's Email Settings -> Manage My Mail -> Spam in the Members Area/Portal gives me some sense of control and understanding.  But with this problem of outgoing spam/not-spam, I feel no such understanding or sense of control.  For example, can there be no equivalent mechanism to the White/Blacklist Filtering (in Plusnet's Manage My Mail) for easily resolving false positives for outgoing email?

This is made worse by the "lack-of-process" I've been experiencing around getting my issues resolved. CSC Agents/Analysts don't seem to have fully understood, and have come back to me as if they have solved it but haven't fully read everything I've given them. And they ask for email headers but, with the exception of Gmail, email programs/clients including Plusnet's Webmail don't give bounce-back emails with headers - so I'm uncertain whether giving the CSC Agents/Analysts email headers of unsent emails has any value.  I've given the "Diagnostic-Code" from the error messages when they appear, but the CSC Agents/Analysts don't seem interested in this.

Or maybe it's a more fundamental problem with the global electronic mail infrastructure and protocols? I think I remember reading that there are systemic flaws because the system wasn't designed to provide mechanisms to prove that a particular message is legitimate or not.