my e-mail appears as spam | troubleshooting - mail server | part 14#17

of 21 | My E-mail appears as spam | Troubleshooting - Mail server | Part 14#17

Written by Eyal Doron | o365info.com

MY E-MAIL APPEARS AS SPAM |

TROUBLESHOOTING – MAIL SERVER |

PART 14#17

In the current article and the next article: My E-mail

appears as spam | Troubleshooting – Mail server | Part

15#17, we will review the troubleshooting process of the

scenario – “our mail server appears as blacklisted” in

Office 365 and Exchange Online environment

Another variation of this scenario could be: a scenario, in

which we want to understand, if the problem in which

our organization E-mail is identified as spam\junk mail

relates to our mail server or to other possible issues.

http://o365info.com/my-e-mail-appears-as-spam-troubleshooting-mail-server-part-14-17

https://il.linkedin.com/in/eyaldoron1

http://o365info.com/






The troubleshooting path logic

Versus a scenario in which we use on-Premises mail

infrastructure, in case that our mail infrastructure is hosted at

Office 365 (Exchange Online), the troubleshooting logic and

steps that we will need to implement are different.

The “major component” in our troubleshooting path, includes

the following parts:

1. Get information from the E-mail message

The basis for our scenario is the information that appears in

the E-mail message. The “E-mail message” could be:






An NDR message that was sent to one of our organization users,

which inform him that “his mail server” (our organization

Exchange Online server) is blacklisted.

A scenario, in which external recipient reports that – our E-mail

saved in his junk mail folder, and he sends us the E-mail

message header which include our mail server IP address.

To be able to start the troubleshooting process, we will need

to “extract” the IP address that appear in the NDR message

(the IP address of the Exchange Online server who appears as

blacklisted).

2. Get information about your Exchange Online

infrastructure

In an Exchange Online environment, we will need to get

information about the Exchange Online that represent our

domain: the Exchange Online hostname + IP address that is

“mapped” to our Exchange Online hostname.

3. Fetch the information about the Exchange Online IP

address

We will need to get the IP address of the “Office 365 mail

server” that sent out the E-mail message “on behalf” of the

Office 365 users to the destination recipient.

4. Verify if the “formal “Exchange Online IP address appear

as blacklisted.

This is the “cross-section” part, in which we want to verify if the

IP address that appear in the NDR message is related to our






“formal Exchange Online server” or, to anther passable

scenario – Exchange Online- High Risk Delivery Pool.

Infer the necessary conclusions – based on the information

from the former step, we can decide what are the “operations”

that we will need to implement.

Get the information from the E-mail message

that was identified as spam\NDR

In the following phase, we will need to “fetch” from the E-mail

message the required information about the mail server host

name or the IP address that was blacklisted.

We will need to ask our organization user who gets the NDR

message or the external recipient who informs us that our E-

mail saved in his junk mail folder, to send us a copy of the E-

mail message.






Forwarding a copy of the NDR message or the

message that saved to the junk mail folder.

In a scenario in which we need to examine E-mail messages,

the best practice is to ask for a copy of the original E-mail

message.

The way for providing a “complete copy” of the E-mail message

is by forwarding a copy of the E-mail message.

Outlook and OWA mail client include the option of “forwarding

an E-mail message copy” but, not all the mail client support

this option.

For example: as far as I know, there is no option to send a

copy of the original E-mail message when using the Gmail mail

client (the option of “forwarding” E-mail doesn’t send the






“complete E-mail message that included the original mail

headers).

In the following section, we will demonstrate how to forward

or copy of the “original E-mail message” by using Outlook and

OWA mail client.

1. Sending E-mail as attachment using Outlook

Outlook mail client includes the option that describes as

forward E-mail as an attachment.

1. Select the E-mail item

2. In the HOME menu, click on the more option and then click on

the forward as attachment

In the following screenshot, we can see the result – the E-mail

that was sent includes a copy of the original E-mail message.

Later, we can access the “original E-mail message” and

analyses the information that’s included in the E-mail message

header.






2. Sending (forwarding) E-mail as attachment using OWA

1. Log into Office Web App (OWA).

2. Click on the option New.

3. Click the open separate window icon, located at the top right

corner of the message window. This will open this message as

its own window within your browser.






4. Locate the “new E-mail window” side by side with the OWA

window.

5. Drag and drop the email from your mail folder in the window of

the new E-mail message

In the following screenshot, we can see the E-mail message

appears as an attachment in the “new E-mail message”

Getting the required information from the E-

mail header

In a scenario in which we need to “extract” the Exchange

Online server IP address from an E-mail message that was

sent to an external receipt, we will need to access the

information is “hidden”, in the E-mail message part

named: mail header.






Getting the E-mail header when using Outlook mail client

1. Choose the specific E-mail message

2. Chose the File






3. In the window that appears, click on the Properties

4. In the section named: Internet headers, you can see the content

of the mail header.






5. Copy the information from the window and send the

information for further analysis.

Getting the E-mail header when using OWA mail client

1. Choose the specific E-mail message

2. Choose the “more option” icon (the three dots)






3. Choose the option: View message details

4. In the pop out windows that appear, we can see the content of

the mail header.








Getting the E-mail header when using Gmail mail client

The Gmail E-mail web client, doesn’t include an option for

forwarding E-mail message as an attachment.

The only option that we can use is asking for the user to send

us a copy of the E-mail header (the E-mail message that was

saved in his junk mail folder).

To be able to view the E-mail header when using Gmail mail

client, use the following procedure:

1. Open the message in your Gmail inbox.






2. Click the down-arrow in the top-right corner of the message.

3. Click the “Show original” link toward the bottom of the option’s

box. The message will open in a separate window with the full

message headers at the top.

4. In the windows that appear, we can see the content of the mail

header.








Additional reading

How to view the full message headers of an email

Internal \ outbound spam in Office 365

environment | Article series index

A quick reference for the article series




https://support.google.com/groups/answer/75960?hl=en



My E-mail appears as a spam | Article

series index | Part 0#17

The article index of the complete

article series

Introduction to the concept of internal \ outbound spam in general

and in Office 365 and Exchange Online environment

My E-mail appears as a spam –

Introduction | Office 365 | Part 1#17

The psychological profile of the

phenomenon: “My E-mail appears as

a spam!”, possible factors for causing

our E-mail to appear a “spam mail”,

the definition of internal \ outbound

spam.

Internal spam in Office 365 –

Introduction | Part 2#17

Review in general the term: “internal \

outbound spam”, miss conceptions

that relate to this term, the risks that

are involved in this scenario,

outbound spam E-mail policy and

more.

Internal spam in Office 365 –

Introduction | Part 3#17

What are the possible reasons that

could cause to our mail to appear as

spam\junk mail, who or what are this

“elements”, that can decide that our




http://o365info.com/my-email-appears-as-a-spam-article-series-index-part-0-17/My%20E-mail%20appears%20as%20a%20spam%20%7C%20Article%20series%20index%20%20%7C%20Part%200#17

http://o365info.com/my-email-appears-as-a-spam-article-series-index-part-0-17/My%20E-mail%20appears%20as%20a%20spam%20%7C%20Article%20series%20index%20%20%7C%20Part%200#17

http://o365info.com/my-e-mail-appears-as-a-spam-introduction-office-365-part-1-17

http://o365info.com/my-e-mail-appears-as-a-spam-introduction-office-365-part-1-17

http://o365info.com/internal-spam-in-office-365-introduction-part-2-17






mail is a spam mail?, what are the

possible “reactions” of the destination

mail infrastructure that identify our E-

mail as spam\junk mail?.

Commercial E-mail – Using the right

tools | Office 365 | Part 4#17

What is commercial E-mail?

Commercial E-mail as part of the

business process. Why do I think that

Office 365\ Exchange Online is

unsuitable for the purpose of

commercial E-mail?

Introduction if the major causes for a scenario in which your

organization E-mail appears as spam

My E-mail appears as spam | The 7

major reasons | Part 5#17

Review three major reasons, that

could lead to a scenario, in which E-

mail that is sent from our

organization identified as spam mail:

1. E-mail content, 2. Violation of the

SMTP standards, 3. Bulk\Mass mail

My E-mail appears as spam | The 7

major reasons | Part 6#17

Review three major reasons, that

could lead to a scenario, in which E-

mail that is sent from our

organization identified as spam mail:




http://o365info.com/commercial-e-mail-using-the-right-tools-office-365-part-4-17

http://o365info.com/commercial-e-mail-using-the-right-tools-office-365-part-4-17

http://o365info.com/my-e-mail-appears-as-spam-the-7-major-reasons-part-5-17






4. False positive, 5. User Desktop

malware, 6. “Problematic” Website

Introduction if the subject of SPF record in general and in Office

365 environment

What is SPF record good for? | Part

7#17

The purpose of the SPF record and the

relation to for our mail infrastructure.

How does the SPF record enable us to

prevent a scenario in which hostile

elements could send E-mail on our

behalf.

Implementing SPF record | Part 8#17

The “technical side” of the SPF record:

the structure of SPF record, the way

that we create SPF record, what is the

required syntax for the SPF record in

an Office 365 environment + mix mail

environment, how to verify the

existence of SPF record and so on.

Introduction if the subject of Exchange Online - High Risk Delivery

Pool

High Risk Delivery Pool and Exchange

Online | Part 9#17

How Office 365 (Exchange Online) is

handling a scenario of internal \

outbound spam by using the help of




http://o365info.com/what-is-spf-record-good-for-part-7-17

http://o365info.com/what-is-spf-record-good-for-part-7-17

http://o365info.com/implementing-spf-record-part-8-17

http://o365info.com/high-risk-delivery-pool-and-exchange-online-part-9-17




the Exchange Online- High Risk

Delivery Pool.

High Risk Delivery Pool and Exchange

Online | Part 10#17

The second article about the subject

of Exchange Online- High Risk

Delivery Pool.

The troubleshooting path of internal \ outbound spam scenario

My E-mail appears as spam –

Troubleshooting path | Part 11#17

Troubleshooting scenario of internal \

outbound spam in Office 365 and

Exchange Online environment.

Verifying if our domain name is

blacklisted, verifying if the problem is

related to E-mail content, verifying if

the problem is related to specific

organization user E-mail address,

moving the troubleshooting process

to the “other side.

My E-mail appears as spam |

Troubleshooting – Domain name and

E-mail content | Part 12#17

Verify if our domain name appears as

blacklisted, verify if the problem

relates to a specific E-mail message

content, registering blacklist

monitoring services, activating the






http://o365info.com/my-e-mail-appears-as-spam-troubleshooting-path-part-11-17

http://o365info.com/my-e-mail-appears-as-spam-troubleshooting-path-part-11-17

http://o365info.com/my-e-mail-appears-as-spam-troubleshooting-domain-name-and-e-mail-content-part-12-17





option of Exchange Online outbound

spam.


Troubleshooting – Mail server | Part

13#17

What is the meaning of: “our mail

server”?, Mail server IP, host name

and Exchange Online. One of our

users got an NDR which informs him,

that his mail server is blacklisted!,

How do we know that my mail server

is blacklisted?



14#17

The troubleshooting path logic. Get

the information from the E-mail

message that was identified as

spam\NDR. Forwarding a copy of the

NDR message or the message that

saved to the junk mail



15#17

Step B – Get information about your

Exchange Online infrastructure, Step

C – fetch the information about the

Exchange Online IP address, Step D –

verify if the “formal “Exchange Online

IP address a















De-list your organization from a

blacklist | My E-mail appears as spam

| Part 16#17

Review the charters of a scenario in

which your organization appears as

blacklisted. The steps and the

operations that need to be

implemented for de-list your

organization from a blacklist.

Summery and recap of the troubleshooting and best practices in a

scenario of internal \ outbound spam

Dealing and avoiding internal spam |

Best practices | Part 17#17

Provide a short checklist for all the

steps and the operation that relates

to a scenario of – internal \ outbound

spam.




http://o365info.com/de-list-your-organization-from-a-blacklist-my-e-mail-appears-as-spam-part-16-17



http://o365info.com/dealing-and-avoiding-internal-spam-best-practices-part-17-17

http://o365info.com/dealing-and-avoiding-internal-spam-best-practices-part-17-17

my e-mail appears as spam | troubleshooting - mail server | part 14#17

Documents