E-mail spam conundrum

[#1]

Please move this if it is in the wrong section (not sure if Ironport has been started on the account in question).
I sent a message to a friend who is also on Force9. It was marked as spam despite the fact that I have put my address in her whitelist (it has happened before).
I re-sent the same message using webmail (the first one was sent using WM) and it went through OK and wasn't marked as spam.
I sent it again from Windows Mail and lo and behold, it was again marked as spam.
Can anybody say what is going on here please?

[#2]

Can you get hold of the full headers from an email that was marked as spam and post them please?

[#3]

Thank you for the reply Jelv. Have deleted the original e-mail but have recreated it with the same result. Have therefore taken a snip of the headers and will send them on to CS.

[#4]

We might be able to advise you quicker than waiting for a CS response if you post them here.
Replace all sensitive information with something else (e.g. fred@bloggs.plus.com with xxx@yyy.plus.com)

[#5]

Jelv - have now got round to collecting and posting the headers (as follows). I can replicate it every time I send a message to this person using Windows Mail. I use Avast AV with outward bound scanning and certification text on.
Return-path: <xxxxxxxxx.co.uk>
Envelope-to: xxxxxxxxx.f9.co.uk
Delivery-date: Wed, 12 Nov 2008 07:17:12 +0000
Received: from [64.18.0.165] (helo=psmtp.com)
    by pih-sunmxcore12.plus.net with smtp (PlusNet MXCore v2.00) id 1L09yR-0003Rb-Of
    for xxxxxx.f9.co.uk; Wed, 12 Nov 2008 07:17:12 +0000
Received: from source ([212.159.14.18]) (using TLSv1) by exprod5mx245.postini.com ([64.18.4.11]) with SMTP;
    Tue, 11 Nov 2008 23:17:11 PST
Received: from [80.229.163.73] (helo=xxxxxPC)
    by pih-relay05.plus.net with esmtpa (Exim) id 1L09yO-0005Cu-OI
    for xxxx.f9.co.uk; Wed, 12 Nov 2008 07:17:08 +0000
Message-ID: <4A8374D583DC4B84BC248DDAA0937967@xxxxxPC>
From: "xxxxxxxxxx" <xxxxxxxxxxx.co.uk>
To: <xxxxxxx.f9.co.uk>
Date: Wed, 12 Nov 2008 07:15:06 -0000
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----=_NextPart_000_0003_01C94496.63F65140"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Windows Mail 6.0.6001.18000
X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6001.18049
X-Antivirus: avast! (VPS 081111-0, 11/11/2008), Outbound message
X-Antivirus-Status: Clean
X-Plusnet-Relay: fd448b3cee806412253394274ca36f8f
X-pstn-neptune: 0/0/0.00/0
X-pstn-levels: (S: 0.00277/95.78690 CV:99.9999 )
X-pstn-settings: 1 (0.1500:0.1500) cv gt3 gt2 gt1
X-pstn-addresses: from <xxxxxxxxxx.co.uk> [db-null]
X-pn-pstn: Spam 1
X-PN-Virus-Filtered: by PlusNet MXCore (v4.00)
X-PN-Spam-Filtered: by PlusNet MXCore (v4.00)
Subject: [-SPAM-] test

[#6]

Strange - it has the X-Plusnet-Relay header which I was half expecting to be missing.

[#7]

Thank you for looking at the headers Jelv. I get the same result when I send an email to myself from Windows Mail.
Hope that someone from PN can throw some light on it as I am really curious.

[#8]

Have you tried sending a message where the from is xxx@username.f9.co.uk rather than from your domain?

[#9]

What an excellent idea Jelv - have just reset Windows Mail to username@username.f9.co.uk and lo and behold it was not marked as spam so obviously it is something to do with the domain name. Any comments from PN would be appreciated.

[#10]

Here are the headers when I use my  username@username:
Return-path: <xxxx@xxxx.f9.co.uk>
Envelope-to: xxxx@xxxx.co.uk
Delivery-date: Wed, 12 Nov 2008 12:35:03 +0000
Received: from [64.18.0.170] (helo=psmtp.com)
    by pih-sunmxcore15.plus.net with smtp (PlusNet MXCore v2.00) id 1L0Ew2-000387-He
    for xxxx@xxxx.co.uk; Wed, 12 Nov 2008 12:35:02 +0000
Received: from source ([212.159.14.18]) (using TLSv1) by exprod5mx250.postini.com ([64.18.4.10]) with SMTP;
    Wed, 12 Nov 2008 07:35:02 EST
Received: from [80.229.163.73] (helo=xxxxPC)
    by pih-relay05.plus.net with esmtpa (Exim) id 1L0Evy-00069s-6A
    for xxxx@xxxx.co.uk; Wed, 12 Nov 2008 12:34:58 +0000
Message-ID: <5321651F874041B3BBC7490F5FBCB9C9@xxxxPC>
From: "xxxx" <xxxx@xxxx.f9.co.uk>
To: <xxxx@xxxx.co.uk>
Date: Wed, 12 Nov 2008 12:32:58 -0000
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----=_NextPart_000_0021_01C944C2.CB34A920"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Windows Mail 6.0.6001.18000
X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6001.18049
X-Antivirus: avast! (VPS 081111-0, 11/11/2008), Outbound message
X-Antivirus-Status: Clean
X-Plusnet-Relay: 579c4100f259d0e86b4b2b7ec2d1f6da
X-pstn-neptune: 0/0/0.00/0
X-pstn-levels: (S: 0.00626/97.48531 CV:99.9999 )
X-pstn-settings: 1 (0.1500:0.1500) cv gt3 gt2 gt1
X-pstn-addresses: from <xxxxx@xxxxxx.f9.co.uk> forward (org good) [17/1]
X-PN-Virus-Filtered: by PlusNet MXCore (v4.00)
X-PN-Spam-Filtered: by PlusNet MXCore (v4.00)
Subject: test
       

[#11]

@Poppy
I havnt got a domain as such, but I have got three names, the first official is @user.free-online.co.uk, the second form for @user.idps.co.uk (Stands for I Dont Pay subscriptions) the third was given to me after the "Leak" @user.me.uk.
If I send an e-mail from user.me.uk to one of the others it gets tagged as spam, I have had to give that as a trusted mail in "Manage your e-mail"
this seems to be what the problem is with yours.  i.e. it doesn't recognise your domain as a friend
All other incomming e-mails  freeonline, idps or me all get delivered to default
Hope that helps

[#12]

Thank you for the reply Pierre. I had already whitelisted my domain address in my friend's Manage My Mail section on the portal but it appears to make no difference. This is one of the things that I cannot understand.

[#13]

Unfortunately Postini has almost always scored any Plusnet to Plusnet message as spam, and both your messages (from domain and username) are scored by Postini as spam. Plusnet introduced the X-Plusnet-Relay header to enable their mail servers to bypass this problem, but unfortunately it works only with the username sender, not the domain one. Hence the problem. Hopefully the introduction of IronPort will put an end to this nonsense.
I'm not sure why whitelisting doesn't work with your domain address on your friend's account. However as I said hopefully this will soon be confined to history.

[#14]

Thank you for the explanation. It still is a bit funny that it only scored it as spam when sent from Windows Mail - goes through fine from Webmail.

[#15]

could be (my idea) that window mail goes via USA and webmail stays here?