Can anyone understand or read Microsoft anti-spam email headers?
Asked Answered
S

2

6

I am setting up a small online business and have used wix.com to create a website.

I created some email triggers using the websites automations which send the emails on behalf of my email domain using ascendbywix.com.

The customer receives the email saying it is from my business email.

For all my gmail customers and yahoo customers, the email goes to their main inbox, however for hotmail/outlook customers it goes to they spam folder.

I have set up SPF/DKIM/DMARC records in my DNS host settings which I believe to be correct.

When I check the email header in hotmail, there are antispam messages I do not understand seen below.

Can anyone understand the email header output? or see anything which they believe would be the reason it is going to spam?

Received: from AM7EUR06HT029.eop-eur06.prod.protection.outlook.com
(2603:10a6:3:64::34) by HE1PR08MB2652.eurprd08.prod.outlook.com with HTTPS
via HE1PR0701CA0090.EURPRD07.PROD.OUTLOOK.COM; Thu, 4 Feb 2021 14:48:25 +0000
Received: from AM7EUR06FT016.eop-eur06.prod.protection.outlook.com
(2a01:111:e400:fc36::4a) by
AM7EUR06HT029.eop-eur06.prod.protection.outlook.com (2a01:111:e400:fc36::477)
with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3784.11; Thu, 4 Feb
2021 14:48:24 +0000
Authentication-Results: spf=pass (sender IP is 147.253.213.104)
smtp.mailfrom=flyingenvelope.com; hotmail.com; dkim=pass (signature was
verified) header.d=marinovacreative.com;hotmail.com; dmarc=pass action=none
header.from=marinovacreative.com;compauth=pass reason=100
Received-SPF: Pass (protection.outlook.com: domain of flyingenvelope.com
designates 147.253.213.104 as permitted sender)
receiver=protection.outlook.com; client-ip=147.253.213.104;
helo=mta-213-104.sparkpostmail.com;
Received: from mta-213-104.sparkpostmail.com (147.253.213.104) by
AM7EUR06FT016.mail.protection.outlook.com (10.233.255.104) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.3784.11 via Frontend Transport; Thu, 4 Feb 2021 14:48:24 +0000
X-IncomingTopHeaderMarker:
OriginalChecksum:31E79B1180793E43B997CB6D7EF1B1B52634389544AD89D8DAD7AB82D7D74DE8;UpperCasedChecksum:3C98413FB694439F968C81E9D2B39B604AC8E41D9420E2878411460931DAAC96;SizeAsReceived:2542;Count:15
X-MSFBL: fEFEtwcsscncA3dachCEwwgWXQVhgeNbrzCZYObNFZo=|eyJtZXNzYWdlX2lkIjo
iNjAxYjM3MDkxYzYwMTE3YTYzNDUiLCJzdWJhY2NvdW50X2lkIjoiNTA5ODQ0Iiw
iY3VzdG9tZXJfaWQiOiIxNzc1MSIsInIiOiJjYnJ5YW50ODdAaG90bWFpbC5jb20
iLCJ0ZW5hbnRfaWQiOiJzcGMifQ==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=marinovacreative.com; s=sel1; t=1612450103;
[email protected];
bh=b2tPAi0D6qfPEomU+dskh6Y0JGYrVSdbEPn59mXBlbY=;
h=To:Message-ID:Date:Content-Type:Subject:From;
b=NmEOTaXU6lAOYk/IBJm3AQibTi/wDFwTOkwar6TxjRBPuapbsfI2SRX03t4fFlbHb
XrVM1KV44KuwtThHSbjOP+uQiit6SsnKaIChpPzif+ROQhk8cA+rrgoBt0wq0MPMqC
SX0TX4+yrUg7f+OJIthnb+jRWj6ZW+Dnwa8YDx/w=
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=flyingenvelope.com;
s=s0816; t=1612450103; [email protected];
bh=/f8yRZ6rR+GBhYC/znZWBMKO7p34rHHyKFVtc5YC5Ko=;
h=To:Message-ID:Date:Content-Type:Subject:From;
b=imerWKji+M3lzLINQSRUCZwFpvPkj5mai4Uryv+oe1tEtuP9xAFfQmTpqZeVQAaPQ
TTzhKxXBivunjjExRKgJYd7zuJOq1oXb5sFt8l7qh4W3fETafyR9GewBNHE4lOecg1
FgtmtbOsLUtKI18BL9R3XR4ASoQ5Ifl9M95bYANc=
To: "Christian Bryant" <[email protected]>
Message-ID: <[email protected]>
Date: Thu, 04 Feb 2021 14:48:23 +0000
Content-Type: multipart/alternative; boundary="_----3VJ5fVkHUATxveyzQ3c1/A===_E4/54-41297-7390C106"
Reply-To: [email protected]
Subject: Hi [email protected], Thanks for subscribing
List-Unsubscribe: <http://www.wix.com/my-account/contacts/unsubscribe?metaSiteId=4b16144b-e169-4171-9a46-6c18e4c5fd78&unsubscribeToken=abcefd4d5885911e7f4ea863ecce180388e169a39e4c714f1a99cb3376c2b706079a9828d30cc44ea24ddfb74302228ca2f1dd4724782f04bc77e6d64bddd2fe1c3316b7f7f52cbd4efa06f3a397c2d6445fe65559299dd1ed48d4aea7087f260ca68bbe9c65b9b4270fca4e649ed5aab4c0db65534f30d051ea50fb007265c4f6d018f43cc91fef3dbb075a41aa895846244f9ff6ff61d6c0767199793d58bd3bb4f10fca03a152f467c4d54a7c69e41be6a071ffdf09c055130f27705c87e8f600f4f603a84241a92525768f22f4a9408a1720a4aa2f96af6cca1a50e1b45c34738a6bd0585bb733e38784b6bc2a1e1f6fb8ee1b485a58f49431d782dfb47374b0798a8ae5e91226d913d75a8cc1ebd827a7576d316e2fe8b0a5019930ec9b41e8c3f6ab40538468cb23542e8104e50d36be2cb7f67a37bab589ca38152cf303c72d9665beb836b971162db9e4966e32443ca4808a575209093ec5392f4dc9df1aee9a6ace2926379566c81e2650d7>
From: "Marinova Creative" <[email protected]>
x-abuse-id: 4b16144b-e169-4171-9a46-6c18e4c5fd78
Precedence: Bulk
Feedback-ID: 4b16144b-e169-4171-9a46-6c18e4c5fd78:7d6215dd-232d-4717-b832-03ecfcc678e9:wixshoutout
X-IncomingHeaderCount: 15
Return-Path: [email protected]
X-MS-Exchange-Organization-ExpirationStartTime: 04 Feb 2021 14:48:24.8733
(UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id:
227b975f-9433-4880-30b3-08d8c91bece6
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-MS-PublicTrafficType: Email
X-MS-Exchange-Organization-AuthSource:
AM7EUR06FT016.eop-eur06.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-UserLastLogonTime: 2/4/2021 2:44:48 PM
X-MS-Office365-Filtering-Correlation-Id: 227b975f-9433-4880-30b3-08d8c91bece6
X-MS-TrafficTypeDiagnostic: AM7EUR06HT029:
X-MS-Exchange-EOPDirect: true
X-Sender-IP: 147.253.213.104
X-SID-PRA: [email protected]
X-SID-Result: PASS
X-MS-Exchange-Organization-PCL: 2
X-MS-Exchange-Organization-SCL: 0
X-Microsoft-Antispam: BCL:2;
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Feb 2021 14:48:24.2637
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 227b975f-9433-4880-30b3-08d8c91bece6
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-AuthSource:
AM7EUR06FT016.eop-eur06.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:
00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM7EUR06HT029
X-MS-Exchange-Transport-EndToEndLatency: 00:00:01.1211273
X-MS-Exchange-Processed-By-BccFoldering: 15.20.3805.024
X-Microsoft-Antispam-Mailbox-Delivery:
abwl:0;wl:0;pcwl:0;kl:0;iwl:0;dwl:0;dkl:0;rwl:0;ucf:0;jmr:0;ex:0;auth:1;dest:J;OFR:SpamFilterAuthJ;ENG:(5062000282)(90000117)(91040095)(9000001)(9015001)(9050020)(9060021)(9100273)(5061607266)(5061608174)(4900115)(98391011)(4920090)(6394003)(4950131)(4990090)(9140004);RF:JunkEmail;
X-Message-Info:
qoGN4b5S4yqNFxkPKm3EVQuKR9OsRjZyTthWWLx7sBMj1tH5R4lH6bGmJFB22p2xfSNNCtql0WJwQuOcW0KqlZhVmLsPlLNvSC+DQIXl+SnNIm2GPLt8roydd+mk4wFjxFCWMIFLLO8kGZXye8wEZUSOOVSVVxODjb2NyMI0n7hfzmPJj7STSTf2zjt8ylta82feYR3uUDTm82bgU0b2HA==
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0xO0Q9MjtHRD0xO1NDTD02
X-Microsoft-Antispam-Message-Info:
=?utf-8?B?ZDVoMWxKMUdoNjFrWWtxRUNvME85eFBaT0tQUWlzaDhDOFNKcS80V3NSVWJV?=
=?utf-8?B?NjRjRUxVYktXVzRVQXlkUmM4TGdKYi9Cb2VMUW41WHYwVlRzdm56SXpDSlky?=
=?utf-8?B?Z0x1YVl1ajVkZ2djNUxmS1B6RDZScFdxMm9VbEZUa0QyUXNWb3EwcGYzR0pE?=
=?utf-8?B?V2tTN0QzaFJJTzhMeTRadldzNEFQL0Uxa2czOCtyRmY1VVI4WFVUUlFnMURJ?=
=?utf-8?B?SUtqOGNCQ2prZ2hEZzViOE1CT1o4VEZEd0UrRUh5MVFWeU5yMkxSempwZVRx?=
=?utf-8?B?NDhDNi9aM1E1L0pwWXpKVytJVjFST1dpT3FnbmxZTTV4UWRuOTdvUDRpWUFn?=
=?utf-8?B?UitxS29FcHpEWGlBNW5WWVZtTEVzdE95bDdNZlpzRTh6Tk5ycUVSUHFpRzZi?=
=?utf-8?B?TVlVV2FROVQ2aksvWlhTV0V0amR0SGxPeUNtMjYrVytkQnpMYXUyY2xPNlVT?=
=?utf-8?B?T3VOYktoVFBZSkw2Sk1pRGZmdlhNLzRRWjIxZVlxMEpqcmRTOHpqc0hmK1Vh?=
=?utf-8?B?emRidVVxamw4d1hpYXFnUTJueWNmSlFMU2YwRm9MbW41L0dYZVlneUJHRGp3?=
=?utf-8?B?S2F2ZHhFcjMzWHUwYW9GSVVzSG1SZVFOQjRKOFJubnpKUlE1Kyt1MUxJa2Jj?=
=?utf-8?B?WnFFMWE5MmdUUUdaTWRiTDZDQXhoWmRJMVBNWHJEekdWVVdyV1BiclBpRkYy?=
=?utf-8?B?dll5VTRsV2VOVEJsQzBtRFlRWDBFMzdCZHNVOW9tTXlOZk9IMEdSY08zbCtx?=
=?utf-8?B?dmZTeGZrb0ZsVm1pNUFOY2p1UmFyRThkUFhmQUlYUGswVWdvcmV0UU0vbDg3?=
=?utf-8?B?MVk4dVhyanN1emVFa3pUSER5NXFFR1R6ZWg2NXFBeWNCOUE4U3JRNFlWVlYy?=
=?utf-8?B?aVhlZjFZTFBNUWNFbTdZR09RMHhoay9NWW9xR0JxdVZSdTRtN3N5R0ZUaC9P?=
=?utf-8?B?MTNoNWZSU1psTUExcHFoYjFhOWxhbVJQb3lRS3dCOG9Ua1dNdTF6R1AvK1gy?=
=?utf-8?B?elk0MHFzUC9iUTJWd1o2OGZqMi83bGVSdGtNT01YdUtNRGV1OFJTbU1sS0dG?=
=?utf-8?B?LzNKUmJkSlROOEdybjRGWW9wa3VyMncvZ3JQUzJ3Z3pwQ1ZzS0kyVTV1TTBO?=
=?utf-8?B?ZWhLMU9qVGhEVkxvWDhRb3BUcU9nWFhsRS96K1ZZYkNKbkxUTVFTT25hdWRM?=
=?utf-8?B?WVppTlh5dkp5c25Db25ORDR2ak9hbVZjdXgvVldOVkUyWGF4bEc2bnJQb3kr?=
=?utf-8?B?VURnSzhRdWJOaFhBR0s3MFJvUXRxQzdtbGRXUWF2VHRKdWhYMWRiMTBnNTRp?=
=?utf-8?B?MWUzRUJaRXdTRTk5Y24wOXN0UGpFdUlWd0ZRSnBHUVRJTEV4S0M4djJLcEdo?=
=?utf-8?B?OWR5VlhaekNpdXVkVitGemxjSFZKN2luaUMrUVlkZFhGeGFHVHZiZklOa3hW?=
=?utf-8?B?aXdwRjhpemRIR2NXMExsN2ZWNnlCNjNWRkVlM1Fna2lsVFpFdUlWdjE0UzRB?=
=?utf-8?B?M1dxMXU3aUE4V3NIMXR3TG5RNS9vZmlES2VrUDdsQ2IyN0duMTNMQlBNWVJl?=
=?utf-8?B?R0dyaW5MYVY0STljY0FhMlNWNWJwcnhycEs2aWkvNzJnOCsxMWVkL3kzbm1h?=
=?utf-8?B?d0dXY2F1cFl1L1E1TzJkK3dFSlhYRzRjeTlNbWoxb1M4aEZDWTk4VEtkd25k?=
=?utf-8?B?eVZSeTBFZG0vcjY4Vm41K1J1OWtFN3Bic0NzenY0KzBEajByZTRqWEtZeVhm?=
=?utf-8?B?eDJ0QnlQY0JIVGduMFo1c1dXbW1nRXVSd2FEUFJiUkpQdE9SNTA2V0RrSlNN?=
=?utf-8?B?enBoU2ZzdE9kbFpjTUFUWk1IS1o5QTVhdGh4dVJqT001ZkdwdlNzYnVrQXh3?=
=?utf-8?B?eExKVi9xYXowREM0V3k2QzA5TGk1MG9rb0c5WVU4UlJwUTNFeUlkZ2NhQ3Vx?=
=?utf-8?B?bHBqS0tna2J2bE4wL2d1bnJUWEtobmRnM0d1USsvQ3BNbmNkYURIeWtmYVNw?=
=?utf-8?Q?lTQ+dgBsl+NuyESlmtpkyfRKY0QX84=3D?=
MIME-Version: 1.0
Shipwright answered 8/2, 2021 at 12:27 Comment(0)
S
5

Not sure if this works yet (going to test now) but this script aims to make sense of Microsoft's headers as well as a handful of other mailbox providers.

Stolon answered 14/6, 2023 at 18:29 Comment(0)
H
4

The X-Microsoft-Antispam: BCL:2; is partly documented here: https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/bulk-complaint-level-values?view=o365-worldwide

Most mailbox providers don't tell you too much about how their mail filtering works, for obvious reasons.

Your MAIL FROM is the provider's default. You may be able to customise the "bounce domain" which can improve reputation, by "aligning" the envelope FROM (=Return-Path, Bounce Domain, RFC5321 FROM), and "Header" FROM (RFC5322). https://www.sparkpost.com/docs/tech-resources/custom-bounce-domain/

For meanings of the various FROM addresses etc: https://www.sparkpost.com/blog/dmarc-howto/

The address 147.253.213.104 is your "delivery" IP address. You can check the reputation of this on various free tools, including

https://talosintelligence.com/reputation_center/lookup?search=147.253.213.104

and

https://mxtoolbox.com/blacklists.aspx

Hoad answered 21/9, 2021 at 15:17 Comment(0)

© 2022 - 2024 — McMap. All rights reserved.