Possible cause for high spam counts

Love phplist and been using it for years. Truly a great product with fantastic community support and innovation.

I sent out a campaign the other day and noticed a high spam count on my outbounds. So I did a test and found one particular way that providers will flag your email as spam and which you may be contributing to, depending on how you queue and send you messages.

Try this test.

Create an email campaign and send to a user for whom you can exmaine the message headers and source. With this first message, send as a cron job NOT as a “place message in queue” and not followed by “process queue”. Only send this test message as a cron job.

Then do the same thing to a different email to which you also have access to message headers and source code of the email but do not send as a cron job but rather as a “place message in queue” and then click “process queue”.

You will likely see in the one sent by clicking “process queu” the following or similiar header in the message:

Received: from cpe-xxx-xxx-xx-xx.ewr.res.rr.com [xx.xx.xxx.xxx] by www.some-domain.com with HTTP; Fri, 15 Jan 2021 23:29:31 +0000

That header alerts mail systems to you as a possible spammer because it links your home ip address to a bunch of outbound emails, i.e., SPAM.

Eximine the header for the email sent via cron job and it will only contain the Received: from [your server ip] NOT your home ip address.

Granted, not a lot of people send out mass emails using the “process queue” feature but many do when testing before sending out the campaign, so beware.

And granted even if you test using “process queue” you might think that the cron job will not contain the residential ip address. But remember this, once a spam system has captured the body of your intended email as a hash or other conflation of features within it, it can and may be tagged as spam not on the originating ip any longer, but by the features of its content.

I don’t know if it’s feasible to not include the FROM: in the message headers when testing with “process queue” or using “process queue” for any type of sending.

Important update: the “home” or residential ip address is passed through to the email headers FROM: even if the process queue is performed on the server running phplist and which is a different IP address and from where the email truly originates FROM. The home or residential ip address is only the trigger, so truly it is not FROM that ip address. Perhaps this is something phplist engineers care to elaborate on?

@pancakehollow This issue was raised several years ago but nothing happened about it.
https://mantis.phplist.org/view.php?id=17377
It may be better if you add comments to the Mantis issue.

Thank you.

If you are reading this then please follow Duncan’s link and post your suggestions to the Mantis issue. I believe only the folks there at Mantis can change this. It’s not only a privacy issue but a functionality issue and leads to false spam counts against users of phplist.

https://mantis.phplist.org/view.php?id=17377

Something to note is that my tests have shown that when I send using process queue my server gets listed in the RATS Dyna list and when not sending via process queue, stays out. So something to consider in terms of severity.

Perhaps my testing is flawed but I would suggest to users who find their server blacklisted to not use the process queue whenever possible and stick with cron jobs to send out your campaigns, even when just testing. For me, it’s the testing emails that puts my home ip address in blacklists - and I’m not talking about the ones that most home users are on simply because they are residential.