Spam sent from my email address

[#1]

@maranello

Unfortunately I've no experience of using whitelisting so like you I would have to experiment.

The Plusnet Spam Protection Guide gives some guidance. In particular it says emails from whitelisted senders will never be seen as spam. I take that to mean they will always be delivered to Inbox, however it wouldn't surprise me if messages with perceived spam characteristics were still tagged with [-SPAM-]. But that can be switched off using one of the Spam settings.

In fact having that on is optional if "move to spam folder" is used since anything detected as spam at the chosen aggressiveness level will be sent there.

Have you ever checked how "spammy" your 'mailing list' messages are judged to be? That would mean looking for the Level value in the headers. If these were just slightly spammy (eg Level 5 or 4) then with aggressiveness set at Level 1 (which I think you said you used) they wouldn't end up in the Spam folder even if "move to spam folder" was set - but they would still be tagged in the Inbox unless tagging was turned off.

[#2]

@spraxyt

Thanks for the link, which I had read before but a fresh read has cleared up my inaccurate understanding of how the Plusnet spam protection works. 

I still have more checking of mail headers as I have messages from some senders which are inconsistently marked as spam. I'll post more details here when I get the chance to try out a few options.

[#3]

@maranello occasional marking of messages from some (genuine) senders as spam could be an indication the tagged ones are seen as only slightly 'spammy'.

It might help to report these as "Not spam" from Webmail by ensuring they are in the Spam/Junk folder, selecting them (one by one) and reporting them using the Not Spam button.

[#4]

@spraxyt

For some reason I do not appear to have the Spam button in Webmail. Any idea why it isn't present?

[#5]

@maranello

I experienced this a while ago, but the problem fixed itself after a few days and isn't present now. I can't be certain but I think it was with Chrome or Vivaldi (which is Chromium based). Firefox was OK.

My current version of Chrome is 70.0.3538.77 (Official Build) (32-bit). With this I notice a combined (greyed out) Spam & Notspam button image shows between the red Delete and Mark buttons whilst the Inbox loads, then the image is cropped to display the appropriate button when load completes. I imagine this is done using JavaScript and possibly a script error might cause the image to vanish. Just a guess though.

Which browser are you using?

[#6]

@spraxyt

At the time I noticed the missing button I was using Chrome version 70.0.3538.80 on a tablet running Android 4.4.4. I can try out IE11 on the laptop later, or the Silk browser on an alternative Amazon Fire tablet (my current preferential use device). 

[#7]

Now it appears that my email address has been spoofed to send to other addresses. I have an 'Undelivered' message in my Inbox, details below with some parts redacted.

From	postmaster@chailly.com

Delivery has failed to these recipients or groups:

pmultin@chailly.com

The email address you entered couldn't be found. Please check the recipient's email address and try to resend the message. If the problem continues, please contact your email admin.

Diagnostic information for administrators:

Generating server: SRV-MAIL.msp.fr

pmultin@chailly.com
Remote Server returned '550 5.1.10 RESOLVER.ADR.RecipientNotFound; Recipient not found by SMTP address lookup'

Original message headers:

Received: from SRV-MAIL.msp.fr (192.168.55.3) by SRV-MAIL.msp.fr
 (192.168.55.3) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1415.2; Tue, 6 Nov 2018
 08:57:30 +0100
Received: from 90-154-207-147.ip.btc-net.bg (90.154.207.147) by
 SRV-MAIL.msp.fr (192.168.55.3) with Microsoft SMTP Server id 15.1.1415.2 via
 Frontend Transport; Tue, 6 Nov 2018 08:57:29 +0100
From: "pmultin@chailly.com" <xxxxx@xxxxxm.plus.com>
To: <pmultin@chailly.com>
Subject: Viaggra-Cailis-Leevitra buy onlline sex piills
Date: Tue, 6 Nov 2018 10:29:26 +0100
Message-ID: <001301d475b7$0657d6ca$2f66efbf$@xxxxxx.plus.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: Ac9dmj6h0lejm9mn9dmj6h0lejm9mn==
Content-Language: en
x-cr-hashedpuzzle: 2D4= mj6h 0lej m9mn 9dmj 6h0l ejm9 mn9d mj6h 0lej m9mn 9dmj 6h0l ejm9 mn9d mj6h;1;0lejm9mn9dmj6h0lejm9mn9dmj6h0lejm9mn9dmj6h0lejm9;Sosha1_v1;7;\{F51CE54F-A00C-B60A-E31A-B05FF349F51C\};ZQB3AGUAZgmj6h0lejm9mn9dmj6h0lejm9mn9dmj6h0lejm9;6 Nov 2018 10:29:26 +0100;mn9dmj6h0lejm9mn
x-cr-puzzleid: \{F51CE54F-A00C-B60A-E31A-B05FF349F51C\}
Return-Path: xxxxxx@xxxxxx.plus.com

Reporting-MTA: dns;SRV-MAIL.msp.fr
Received-From-MTA: dns;90-154-207-147.ip.btc-net.bg
Arrival-Date: Tue, 6 Nov 2018 07:57:30 +0000

Final-Recipient: rfc822;pmultin@chailly.com
Action: failed
Status: 5.1.10
Diagnostic-Code: smtp;550 5.1.10 RESOLVER.ADR.RecipientNotFound; Recipient not found by SMTP address lookup

Is this something I should be concerned about?

[#8]

Hi @maranello,

As this is a non delivery report, I would recommend changing your password for the email address in case it has been compromised.

You can change your password here if it is the default mailbox or via the manage my mail section of our website. Once complete monitor your mailbox via web-mail to see if the issue persists.

Thank you.

[#9]

@maranello

This is a example of backscatter, receiving it is a nuisance, but it's not something to worry about. You might receive a number of these rejected from various spammed addresses but they should stop when the spammers choose a different sender name to forge.

In this case the From address would have been shown as

From: "pmultin@chailly.com" <xxxxx@xxxxxm.plus.com>

which has the intended recipient name as sender, but with your email address. That style seems to tally with the sort of thing mentioned in your original post.