Spam not marked as [-SPAM-]

[#1]

Attached is the full header, the destination email has been redacted.

For whatever reason this  forum rejects the same content as a TXT file but appears ok with a PDF

[#2]

@PhilipHeyes 

Even though the message looked like it slipped through the filters, the headers show that Plusnet did detect it as spam:

X-Spam: Yes

X-pn-pstn-db: "Spam 99"

X-PN-Spam-Filtered: by PlusNet MXCore

It also failed SPF, DKIM and DMARC, and the sending server was listed on several spam and botnet blacklists. So the filtering engines recognised it as junk exactly as they should.

The reason it reached the inbox is that Plusnet’s system tags spam but doesn’t always move or block it automatically.

The reason it's not marked SPAM is hopefully under investigation @Townman 

[#3]

RE: X-Spam: Yes

I am going to create an MS Outlook Rule to detect "X-Spam: Yes" in the message header
and to move those messages to the Junk E-Mail folder.    Lets see if that works out.

[#4]

A very quick update,  the Outlook Rule to detect "X-Spam: Yes" does work as intended, the spam messages from this afternoon have been removed from the Inbox.

One surprise,  Plusnet Forum notification emails contain a "dmarc=fail" and "X-Spam: Yes" so also end up with the Junk E-mail.

dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=community-mailer.plus.net (policy=none)

[#5]

It's ages since I've posted here but I just want to add that i have also seen a marked increase in spam emails over the last week or so.

In fact, i have had virtually no spam for months but I have recently received several , mostly from 'ali express'. Others are generic begging emails from exiled African princes &c.

I'm not too good at making sense of email headers but looking at those on the latest one received a few moments ago, it does seem to have been recognised as spam several times along its journey to my inbox but it still got through and it hasn't been marked as spam.

Below is a snippet from the source, if anyone can make sense of it:

FREEMAIL_REPLYTO(0.00)[gmail.com];
MISSING_MID(0.00)[];
RBL_SPAMHAUS_BLOCKED(0.00)[103.235.118.147:from];
R_NO_SPACE_IN_FROM(0.00)[];
DMARC_NA(0.00)[test.com: no valid DMARC record];
FUZZY_BLOCKED(0.00)[rspamd.com];
R_DKIM_PERMFAIL(0.00)[test.com:s=c3cff8d0bbb19917];
R_SPF_NA(0.00)[no SPF record];
FROM_HAS_DN(0.00)[];
FREEMAIL_ENVFROM(0.00)[test.com];
ARC_NA(0.00)[];
NEURAL_SPAM(0.00)[0.987];
DKIM_TRACE(0.00)[test.com:~];
RECEIVED_SPAMHAUS_BLOCKED(0.00)

.....

[#6]

@Bookworms 

Can you post the full headers in the same way as here in post #16 on this thread 

Redacting any personal information.

[#7]

Thanks for taking look.

I haven't got time at the moment to filter out all personal info from it but I can confirm that the header does state:

X-Spam: Yes

and also:

X-pn-pstn-db:" Spam 99
X-PN-Virus-Filtered: by PlusNet MXCore (v5.00)
X-PN-Spam-Filtered: by PlusNet MXCore (v5.00)
Subject: Dearest in Christ...

[#8]

Don't know if anyone has looked at the 'AliExpress' mail headers, but that rubbish is most certainly coming from that country - wonder if they've upset their government and this is a back-handed way of them destroying their reputation? 

[#9]

@Bookworms
Thanks, that confirms that these emails are being spam scored correctly.

The other headers I've seen shows mail entering Plusnet mailboxes passing through Enmail/Enix relays (mail.enmail.co) before Plusnet’s MXCore handles final delivery.

The presence of avasin-ptp-005.plus.net as the last hop shows internal Plusnet infrastructure is still used for the mailbox itself.

This is consistent with a phased migration, where Enmail handles inbound email relaying and spam filtering, while Plusnet handles final delivery.

What appears to be happening is that the initial spam scoring done by Enix is being ignored by
Plusnets MXCore delivery to your mailbox.

The increase in spam emails reaching user mailboxes seems to coincide with the routing change to the Enix relays.

My take on this is that as the Enix relays are trusted ( whitelisted) by Plusnet's MXCore the spam scoring is ignored and the emails subsequently delivered.

If I'm wrong on this I've no doubt I'll be told!!!

[#10]

That would be a plausible and logical conclusion.

[#11]

I use Apple Mail and can’t see headers in my emails
I’ve recently been getting lots of emails saying I’ve won something or been selected for a prize
They come from addresses like:
offers@walmart.com
oralB@offers.com
noreplay@costco.com
offers@amazon.com
support@walmart.com
Usps@no-reply.com
Harbor@freight.com
My spam filter is 5
My email is of the form me@mydomain.force9.co.uk
I don’t understand the technicality but is this the right topic/thread. Will this be sorted soon as I don’t know what to do. Thanks

[#12]

We are using MS Outlook and Thunderbird email applications on Windows,
both have been configured to detect "X-SPAM  Yes" in the email headers
and to move X-SPAM message to the Junk / Spam folder.

The loss of of the previous style of spam detection & handling process does appear to be part of the journey
of our email accounts being divested from Plusnet to GreenBy.

I kind of doubt what we had got used to before, will ever be coming back.

[#13]

---

@Leftshark wrote:

I use Apple Mail ...
... ... ...
... Will this be sorted soon as I don’t know what to do.

---

@Leftshark 

Does this help ? - YouTube : Does Apple Mail Have A Spam Filter? 

If you keep marking the unwanted messages as SPAM, then in a short time it should learn to filter them out by itself.

For more difficult or persistent unwanted messages, you should be able to create your own junk filtering rules.

[#14]

Thank you, both PhilipHeyes and Maxsync for your nice replies.

[#15]

The volume of spam getting through has dropped considerably, since Friday I have received seven, all from Ali express. None have come marked as SPAM-.

So hopefully the filter is back in play