Yahoo and Hotmail goes to Spam folder

Discussion in 'Server Operation' started by jem, Nov 21, 2020.

  1. jem

    jem New Member

    I need help trying to figure out why emails from my server goes to Hotmail and yahoo spam folder.
    I think its because postfix is using the localhost. CONNECT from localhost[]. i have research online and try many different configuration which did not work. i don't know what to do next. if someone could help me that would be great.

  2. florian030

    florian030 ISPConfig Developer ISPConfig Developer

    enable dkim + dmarc and check the mailheader at the destination.
  3. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    and make sure you have a SPF record for the domain and a rDNS record with your hostname for the external IP of your server.

    Eventually do a test with and share the outcome.
  4. jem

    jem New Member

    Just let you know i have already have dkim + dmarc enabled.
    Here is the result for


    Here is the header result from yahoo
    the email still goes to the spam folder

    Received: from
    by with HTTP; Sun, 22 Nov 2020 15:02:56 +0000
    Return-Path: <[email protected]>
    Received: from (EHLO
    by with SMTPs; Sun, 22 Nov 2020 15:02:56 +0000
    X-Originating-Ip: []
    Received-SPF: pass (domain of designates as permitted sender)
    dkim=pass [email protected] header.s=default;
    X-Apparently-To: [email protected]; Sun, 22 Nov 2020 15:02:56 +0000
    X-YMailISG: imJccJMWLDvqMdet0j7zSEJedn3kT8f1uoESXft07ywVAkW.
    Received: from localhost ( [])
    by (Postfix) with ESMTP id DE59F21E18
    for <[email protected]>; Sun, 22 Nov 2020 10:02:55 -0500 (EST)
    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;; h=
    :message-id:date:date:subject:subject:from:from; s=default; t=
    1606057375; x=1607871776; bh=0/Rd4N2V67OsHD4oWbS3hBs+H7e6BSGhLJi
    k/ByXEE8=; b=pAa+f8J6KFOgJyNXmGy2PRFOL2QGiDG1ybVFGztMgOr3vywkClc
    X-Virus-Scanned: Debian amavisd-new at
    Received: from ([])
    by localhost ( []) (amavisd-new, port 10026)
    with ESMTP id OiKKNFG_8fdo for <[email protected]>;
    Sun, 22 Nov 2020 10:02:55 -0500 (EST)
    Received: from Jemdesktop ( [])
    (Authenticated sender: [email protected])
    by (Postfix) with ESMTPSA id 52C9421E17
    for <[email protected]>; Sun, 22 Nov 2020 10:02:55 -0500 (EST)
    From: "jem" <[email protected]>
    To: <[email protected]>
    Subject: reply to this email please
    Date: Sun, 22 Nov 2020 10:02:55 -0500
    Message-ID: <[email protected]>
    MIME-Version: 1.0
    Content-Type: multipart/alternative;
    X-Mailer: Microsoft Office Outlook 12.0
    Thread-Index: AdbA4IRgz9yklpL3TWCZ6A/b/YG66w==
    Content-Language: en-us
    X-Antivirus: Avast (VPS 201122-2, 11/22/2020), Outbound message
    X-Antivirus-Status: Clean
    Content-Length: 3115

    This is a multipart message in MIME format.

    Content-Type: text/plain;
    Content-Transfer-Encoding: 7bit

    reply to this email please

    This email has been checked for viruses by Avast antivirus software.

    Content-Type: text/html;
    Content-Transfer-Encoding: quoted-printable

    <html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:eek:=3D"urn:schemas-micr=
    osoft-com:eek:ffice:eek:ffice" xmlns:w=3D"urn:schemas-microsoft-com:eek:ffice:word" =
    xmlns:m=3D"" xmlns=3D"http:=

    <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; charset=3Dus-ascii"=
    <meta name=3DGenerator content=3D"Microsoft Word 12 (filtered medium)">
    /* Font Definitions */
    {font-family:"Cambria Math";
    panose-1:2 4 5 3 5 4 6 3 2 4;}
    panose-1:2 15 5 2 2 2 4 3 2 4;}
    /* Style Definitions */
    p.MsoNormal, li.MsoNormal, div.MsoNormal
    a:link, span.MsoHyperlink
    a:visited, span.MsoHyperlinkFollowed
    @page Section1
    {size:8.5in 11.0in;
    margin:1.0in 1.0in 1.0in 1.0in;}
    <!--[if gte mso 9]><xml>
    <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
    </xml><![endif]--><!--[if gte mso 9]><xml>
    <o:shapelayout v:ext=3D"edit">
    <o:idmap v:ext=3D"edit" data=3D"1" />

    <body lang=3DEN-US link=3D"#0563C1" vlink=3D"#954F72">

    <div class=3DSection1>

    <p class=3DMsoNormal>reply to this email please<o:p></o:p></p>


    <div id=3D"DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2"><br />
    <table style=3D"border-top: 1px solid #D3D4DE;">
    <td style=3D"width: 55px; padding-top: 13px;"><a href=3D"https://ww=
    ig-email&utm_content=3Demailclient" target=3D"_blank"><img src=3D"https://i=
    peat-v1.gif" alt=3D"" width=3D"46" height=3D"29" style=3D"width: 46px; heig=
    ht: 29px;" /></a></td>
    <td style=3D"width: 470px; padding-top: 12px; color: #41424e; font-size: =
    13px; font-family: Arial, Helvetica, sans-serif; line-height: 18px;">Virus-=
    free. <a href=3D"
    rce=3Dlink&utm_campaign=3Dsig-email&utm_content=3Demailclient" target=3D"_b=
    lank" style=3D"color: #4453ea;"></a>
    </table><a href=3D"#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2" width=3D"1" heigh=
    t=3D"1"> </a></div></body>



    Attached Files:

  5. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    It might be that the spamfilter thinks the link to Avast is suspicious in combination with the short message, which is also a bit of spammy text?
  6. jem

    jem New Member

    Thanks for replying.
    is it possible to have my external ip show instead of Received: from localhost ( []).
    i used reject_rbl_client in smtpd_recipient_restrictions and it was blocking all emails.
    54 5.7.1 Service unavailable; Client host [] blocked using; -> Query Refused. See for more information [Your DNS IP:];
  7. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    Yes, it would be possible to configure amavis to run on a public ip and you connect there, but this is not a problem, as thousands of other servers use this setup without causing any issue.

    Open the link from your log message and it explains what your issue is (ie. why is denying your DNS queries).
    Th0m likes this.
  8. jem

    jem New Member

    Just thank you all for your help. bellow is an error message i am getting from Yahoo. I think clients a sending massive email at once to yahoo clients what can i do to resolved this issue. thanks.

    (host[] said: 421 [IPTS04] Messages from temporarily deferred due to unexpected volume or user complaints -; see (in reply to end of DATA command))
  9. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    Find out who is sending out large volumes by looking into your mailq and mail.log. Change that user's password.

    I have this set in my Postfix
    anvil_rate_time_unit = 1h
    smtpd_client_recipient_rate_limit = 30
    Along with the default and ISPConfig settings this limits the max emails / h to 100 and max recipients to 30.
  10. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    Does the limiting work by discarding the 101st e-mail?
    Or the 101st e-mail during an hour is delayed and sent at the next hour?
  11. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    Also clear spam sitting in your mail queue after changing the password.

    You can look into postfwd for a more configurable/flexible rate limiting setup.
    Th0m likes this.
  12. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    I think you start getting a temp failure when sending, so an mta would queue and retry, while regular clients would need to resend manually; spammers might do either, but often do not retry.
    Th0m likes this.
  13. jem

    jem New Member

    Thank you all. i really appreciate the help. I received this error from Gmail. I do have DMARC policy
    this is not the first time this client get this error.

    enabled. what could be the reason why.
    <>: host[2607:f8b0:4001:c19::1a]
    said: 550-5.7.26 Unauthenticated email from is not accepted
    due to 550-5.7.26 domain's DMARC policy. Please contact the administrator
    of 550-5.7.26 domain if this was a legitimate mail. Please
    visit 550-5.7.26 to learn
    about the 550 5.7.26 DMARC initiative. r9si6014144ill.52 - gsmtp (in reply
    to end of DATA command)
    Last edited: Nov 26, 2020
  14. jem

    jem New Member

    here's my configuration

    # See /usr/share/postfix/ for a commented, more complete version

    # Debian specific: Specifying a file name will cause the first
    # line of that file to be used as the name. The Debian default
    # is /etc/mailname.
    #myorigin = /etc/mailname
    myhostname =
    smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
    biff = no

    # appending .domain is the MUA's job.
    append_dot_mydomain = no

    # Uncomment the next line to generate "delayed mail" warnings
    #delay_warning_time = 4h

    readme_directory = /usr/share/doc/postfix

    # TLS parameters
    smtpd_tls_cert_file = /etc/postfix/smtpd.cert
    smtpd_tls_key_file = /etc/postfix/smtpd.key

    smtpd_use_tls = yes
    smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
    smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

    # See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
    # information on enabling SSL in the smtp client.

    smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination

    alias_maps = hash:/etc/aliases, hash:/var/lib/mailman/data/aliases
    alias_database = hash:/etc/aliases, hash:/var/lib/mailman/data/aliases

    #mydestination =, localhost, localhost.localdomain
    mydestination =

    #mydestination = /etc/postfix/local-host-names
    relayhost =
    #mynetworks = [::1]/128
    #mynetworks = [::1]/128
    mynetworks = [::1]/128

    mailbox_size_limit = 0
    recipient_delimiter = +
    inet_interfaces = all
    inet_protocols = all
    html_directory = /usr/share/doc/postfix/html
    virtual_alias_domains =
    virtual_alias_maps = hash:/var/lib/mailman/data/virtual-mailman, proxy:mysql:/etc/postfix/, proxy:mysql:/etc/postfix/
    virtual_mailbox_domains = proxy:mysql:/etc/postfix/
    virtual_mailbox_maps = proxy:mysql:/etc/postfix/
    virtual_mailbox_base = /var/vmail
    virtual_uid_maps = mysql:/etc/postfix/
    virtual_gid_maps = mysql:/etc/postfix/
    sender_bcc_maps = proxy:mysql:/etc/postfix/
    smtpd_sasl_auth_enable = yes
    broken_sasl_auth_clients = yes
    smtpd_sasl_authenticated_header = yes
    smtpd_restriction_classes = greylisting
    greylisting = check_policy_service inet:

    smtpd_tls_security_level = may
    transport_maps = hash:/var/lib/mailman/data/transport-mailman, proxy:mysql:/etc/postfix/
    relay_domains = mysql:/etc/postfix/
    relay_recipient_maps = mysql:/etc/postfix/
    smtpd_sender_login_maps = proxy:mysql:/etc/postfix/
    proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $sender_bcc_maps $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps

    smtpd_helo_required = yes
    smtpd_helo_restrictions = permit_mynetworks,
    check_helo_access regexp:/etc/postfix/helo_access,
    reject_invalid_hostname, reject_non_fqdn_hostname,
    check_helo_access regexp:/etc/postfix/blacklist_helo

    smtpd_sender_restrictions = check_sender_access regexp:/etc/postfix/,
    permit_mynetworks, permit_sasl_authenticated,
    check_sender_access mysql:/etc/postfix/,
    check_sender_access regexp:/etc/postfix/

    ##smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, check_client_access mysql:/etc/postfix/, reject_rbl_client, reject_rbl_client

    smtpd_client_restrictions = permit_mynetworks,
    check_client_access mysql:/etc/postfix/,

    smtpd_recipient_restrictions = permit_mynetworks,
    check_recipient_access mysql:/etc/postfix/,
    check_recipient_access mysql:/etc/postfix/,

    anvil_rate_time_unit = 1h just added these 2 lines
    smtpd_client_recipient_rate_limit = 30

    #smtpd_client_message_rate_limit = 100
    smtpd_client_message_rate_limit = 30

    maildrop_destination_concurrency_limit = 1
    maildrop_destination_recipient_limit = 1
    virtual_transport = dovecot
    header_checks = regexp:/etc/postfix/header_checks
    mime_header_checks = regexp:/etc/postfix/mime_header_checks
    nested_header_checks = regexp:/etc/postfix/nested_header_checks
    body_checks = regexp:/etc/postfix/body_checks
    owner_request_special = no
    smtp_tls_security_level = may
    smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
    smtpd_tls_protocols = !SSLv2,!SSLv3
    smtp_tls_protocols = !SSLv2,!SSLv3
    smtpd_tls_exclude_ciphers = RC4, aNULL
    smtp_tls_exclude_ciphers = RC4, aNULL
    dovecot_destination_recipient_limit = 1
    smtpd_sasl_type = dovecot
    smtpd_sasl_path = private/auth
    content_filter = amavis:[]:10024
    receive_override_options = no_address_mappings

    message_size_limit = 0
    compatibility_level = 2

    smtpd_tls_mandatory_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CDC3-SHA, KRB5-DE5, CBC3-SHA
    smtpd_tls_dh1024_param_file = /etc/ssl/private/dhparams.pem
  15. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    You need working SPF, DKIM, and DMARC records set up that allow your server to send mail for your domain.

Share This Page