Suspect spam in subject line

[Johnr749]

Suddenly when sending e-mails the words "SUSPECT SPAM" appears in subject line when it reaches its destination. I have tried sending messages to myself using Hotmail and outlook express and it is OK. It only happens when using thunderbird. I am on 1.5.0.14. Looking at message source it seems to be something to do with ironport. Any suggestions. John

[tanstaafl]

Thunderbird never uses the word spam. I'd assume its due to whatever smtp server you're using, a security suite or a router/security appliance. See if outlook express uses the same smtp server etc.

Whats a ironport?

[Guest]

you never heard of it? me either

http://www.gcn.com/print/25_14/40915-1.html#

[Johnr749]

Ironport.com is an anti spam product (part of Cisco). I think that Tiscali must use it as part of their filtering. However this problem only occurs when I send using Thunderbird not with Hotmail or Outlook Express.

[tanstaafl]

I suspect you're not using the same SMTP servers, or somehow sending a message thats formatted differently. See if there are some headers beginning with an X that IronPort added that might have some information about the spam score and what tests were run. For example, my email provider uses SpamAssassin so it added to one spam message:

X-Spam-score: 7.3
X-Spam-hits: BAYES_99 3.5, SUBJECT_NEEDS_ENCODING 0.001, SUBJ_ILLEGAL_CHARS 1.586, TVD_SPACE_RATIO 2.219, BAYES_USED global

and I can look up in http://spamassassin.apache.org/tests_3_2_x.html what the strings in X-Spam-hits mean.

[Johnr749]

This is what it says
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AgfQALdpL0lYai5w/2dsb2JhbACCLwSEWohQwXCCfQ
Subject: [POSSIBLE SPAM] (no subject)
X-IP-Spam-Verdict: SUSPECTEDSPAM
X-IronPort-AV: E=Sophos;i="4.33,680,1220223600";
d="scan'208";a="112709863"

Dont really know what all this means.

[tanstaafl]

It looks like its using Sophos anti-virus. Other than that its gibberish. Talk to somebody at Tiscali and see if they can decrypt the value of the X-IronPort-Anti-Spam-Result: header, and whether its possible for them to disable anti-spam testing for your account.

[Johnr749]

One other thing I have checked with Spamhaus and my IP is listed on the PBL database. They say that the problem might be that the smpt authentication is turned off. Can you advise how I check that it is on. All this is a bit technical for me.

[tanstaafl]

SMTP authentication means that you need to provide a username and password when sending. You could modify the SMTP server entry by unchecking the username field and see if you can't send any more to somebody in a different domain. If it needs it you will probably get a 5.7.1 Unable to relay error message.

You said your IP address is listed in thier policy block list database. I found some text at thier web site that said "The Spamhaus PBL is a DNSBL database of end-user IP address ranges which should not be delivering unauthenticated SMTP email to any Internet mail server except those provided for specifically by an ISP for that customer's use."

All that really means is that you're not somebody working in a company who uses a SMTP server on thier LAN, so you need to prove who you are when trying to use the SMTP server over the Internet.

While a security appliance might increase your spam score a little because you're not using SMTP authentication it would have to be paranoid to label your mail as spam just due to that.

[Johnr749]

The latest. None of the suggestions that Tiscali support gave worked, and now no e-mails send via Thunderbird are getting through at all. They are just dissapearing onto a black hole!

[tanstaafl]

Do you have another account that provides a SMTP server? Typically you can use a SMTP server with any account as long as it requires its own username/password.

[Johnr749]

A call from Tiscali today to say that the problem is not with them. They blame Thunderbird which they say they do not support. The only suggestion is to completely uninstall T/B and reinstall. The only problem with that is losing my address book and all the message in the inbox, is there any way round this? Looking at various forums it seems that I am not the only one with this problem, it is just that Tiscali do not want to know and say that I should use Outlook Express or Tiscali webmail.

[Daifne]

You should say that you are using Outlook Express. Uninstalling Thunderbird won't do anything. If there was a problem with Thunderbird, which this isn't, the problem would be in your profile folder, not the program. The profile is separate from the program which is why you also wouldn't lose anything by reinstalling.

[mikeymike]

One of my customers is having this problem as well (mails sent by Thunderbird get "POSSIBLE SPAM" in the subject line, ones from OE don't). I've been checking over their machine today and there is no sign of anything dodgy-malware-ish.

[Daifne]

It's probably on a server somewhere.