This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Mail going to spam folder in

Mail going to spam folder in

I am trying to troubleshoot an issue with mail that I am sending through a third party (ESP) to myself, and for over a month now the messages have been delivered to the junk folder.  I want to determine if this is an issue with content or perhaps with the sending domain or IP reputation.  The messages aren't being bounced or blocked.

The messages are consistently going to the junk folder now, and even when a contact forwards the same message to me (that they successfully received elsewhere) their forwarded messages go to the junk folder.  I'd also like to know if this is a problem for my mailbox or if it may be impacting other users who we send the same messages to.

Below are the headers for two such messages, retrieved from the junk folder.  Can someone from Cox examine the headers to determine what might be going on?  I don't believe I have a rule in place for the sending domain set to be blocked or junked, nor do I have them set to be allowed.  The two message headers: 

Message 1 - junk folder placement:

Return-Path: <[REMOVED]>

Received: from eastrmimpi210 ([]) by

          (InterMail vM. 201-2260-151-145-20131218) with ESMTP

          id <>

          for <[REMOVED]>; Wed, 26 Aug 2015 14:33:04 -0400

Received: from [REMOVED] by eastrmimpi210 with cox

                id 9WZ11r00B0fxNjC01WZ2To; Wed, 26 Aug 2015 14:33:03 -0400

X-Spam-Optin: quarantine

Message-ID: <9WZ11r00B0fxNjC01WZ2To>

X-CT-Score: NA

X-Authority-Analysis: v=2.0 cv=eZPjic4H c=1 sm=1 b=1 p=2kgPxcPQX4wA:10

a=OgR1bFBF52G5VLou61Qdlg==:17 a=jqJx3APsAAAA:8 a=LDByVImiAAAA:8

a=kviXuzpPAAAA:8 a=jPJDawAOAc8A:10 a=uRRa74qj2VoA:10

a=lyYuGu4CHa5PaZGX25icmyaRxzw=:19 a=Yx3IPQ1jo9L7taPXwAoA:9 a=QEXdDO2ut3YA:10

a=WhyLCfzSn8QA:10 a=Y9ZmdtH27PMA:10 a=ZSZAJmUR2EIA:10 a=UTW3GctDQawA:10

a=PR7BF1aH1wEA:10 a=8NxcaRFQ8m0A:10 a=qTpy2nhRcN4A:10 a=YnjVFmDOeLoA:10

a=JHyW0B_OV8oA:10 a=M4QScfzLx2AA:10 a=KYXIKXl0XnsA:10

a=w198VKY8_hbgblWb4fUA:9 a=2Ahxn7RlsFsA:10 a=OgR1bFBF52G5VLou61Qdlg==:117

X-CM-Score: 96.00

Received: from [REMOVED] id hro35u16jb4h for <[REMOVED]>; Wed, 26 Aug 2015 14:33:01 -0400 (envelope-from <[REMOVED]>)

X-Receiver: <[REMOVED]>

X-Sender: <[REMOVED]>

Date: Wed, 26 Aug 2015 18:33:01 +0000

From: <[REMOVED]>

Reply-To: <[REMOVED]>

Subject: =?UTF-8?B?KiogSW5mb3JteiBUZXN0LTIgKiogUkkgTWVkaWNhbCBKb3VybmFs4oCTQXVn?==?UTF-8?B?dXN0IElzc3Vl?=


Message-ID: <[REMOVED]>

List-Unsubscribe: <http://[REMOVED].net/[REMOVED]/default.asp?action=u&email=[REMOVED]>




MIME-Version: 1.0

Content-Type: multipart/alternative;



Message two, a forward of the message above sent to me from another provider, also placed in the junk folder: 

Return-Path: <[REMOVED]>

Received: from eastrmimpi110 ([]) by

          (InterMail vM. 201-2260-151-145-20131218) with ESMTP

          id <>

          for <[REMOVED]>; Tue, 25 Aug 2015 11:18:58 -0400

Received: from ([])

                by eastrmimpi110 with cox

                id 93Fv1r02b3h9KGZ013JuwG; Tue, 25 Aug 2015 11:18:54 -0400

X-Spam-Optin: quarantine

Message-ID: <93Fv1r02b3h9KGZ013JuwG>

X-CT-Score: NA

X-Authority-Analysis: v=2.0 cv=cuRFZSEi c=1 sm=1 p=2kgPxcPQX4wA:10

a=jqJx3APsAAAA:8 a=pGLkceISAAAA:8 a=jPJDawAOAc8A:10 a=uRRa74qj2VoA:10

a=LDByVImiAAAA:8 a=Yba-5btluGXBt1vgvQEA:9 a=QEXdDO2ut3YA:10 a=WhyLCfzSn8QA:10

a=Y9ZmdtH27PMA:10 a=ziwGhm86LekA:10 a=M4QScfzLx2AA:10 a=2Ahxn7RlsFsA:10

a=HfggiU_nJIziXa3iytcA:9 a=UiCQ7L4-1S4A:10 a=hTZeC7Yk6K0A:10

a=_W_S_7VecoQA:10 a=frz4AuCg-hUA:10 a=d5Tk2X25c3oA:10 a=NWVoK91CQyQA:10


X-CM-Score: 96.00

Received: by with SMTP id wr7so144800267obb.2

        for <[REMOVED]>; Tue, 25 Aug 2015 08:18:55 -0700 (PDT)

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20130820;










X-Gm-Message-State: ALoCoQmGgkdJZmyNy8vPTOrUbAyjizNHV26Oz3x7t/T81w1NkqYYRF4gSrdgdw1OX/Az9ZomWbH3

X-Received: by with SMTP id p10mr28256410oei.62.1440515934836;

Tue, 25 Aug 2015 08:18:54 -0700 (PDT)

From:  <[REMOVED]>

References: <[REMOVED]>

In-Reply-To: <[REMOVED]>

MIME-Version: 1.0

X-Mailer: Microsoft Outlook 14.0

Thread-Index: AQGaIpo9KhG6sBGOw2oGNuCV+ZfGFp6KTN3g

Date: Tue, 25 Aug 2015 11:16:45 -0400

Message-ID: <b85f27beac4c6856b680>

Subject: =?UTF-8?Q?RE=3A_=2A=2A=2D1_=2A=2A_Journal=E2=80=93August?=



Content-Type: multipart/alternative; boundary="089e0115eef896fdc0051e244039"



One thing I noticed in both messages was the "X-CT-Score: NA" and "X-CM-Score: 96.00", where messages that are NOT placed in the junk folder have "X-CT-Score: 0.00" and "X-CM-Score: 0.00", like so:


X-CT-Class: Clean

X-CT-Score: 0.00

X-CT-RefID: str=0001.0A020202.55DF6A14.0288:SCFSTAT18704550,ss=1,re=-4.000,fgs=0

X-CT-Spam: 0

X-Authority-Analysis: v=2.0 cv=bsyS8jmi c=1 sm=1 a=jqJx3APsAAAA:8

a=pGLkceISAAAA:8 a=uRRa74qj2VoA:10 a=3rIOuboa6WO4aOeUn_AA:9 a=QEXdDO2ut3YA:10

a=dCqkORpdOv8A:10 a=dF6-1Dv-l8Iueur8euIA:9 a=UiCQ7L4-1S4A:10

a=hTZeC7Yk6K0A:10 a=_W_S_7VecoQA:10 a=frz4AuCg-hUA:10

a=8KaXlSnK7icamR8iFF8A:9 a=IKIoO-ieCDEA:10 a=W0k1p8L2Fg/Q12D2FaSoVw==:117

X-CM-Score: 0.00


What do the X-CT and X-CM scores mean?  This seems to be a consistent difference between delivered and junked messages.  I don't need to know the secret sauce behind the scoring, but I am hoping to know what is the basic cause for scores to go one way or another, or to be "NA" as seen in the junked message above.

I am configured to use classic webmail, though I am interacting with my mail not through the web UI, instead using Apple mail on my Mac.  I have reported messages from the sender as false positives in the past, and have gone to the webmail only when I need to retrieve messages that wind up in the junk folder there.

If I could get some assistance figuring out why these messages are always going to the junk folder I would appreciate it.  I don't want to just add an allow rule to push the messages through, as that simply masks the issue.  It may not even be effective, as I believe those rules work AFTER the's spam filter has made its own judgement and the messages may remain in the junk folder.  I also want to figure out if this is an issue specific to my mailbox or if it is impacting other recipients of the same mail as we send to many members of the organization who addresses for their email.

If there is any additional information I can provide, please let me know.  If the conversation must be taken offline to avoid exposing too much information, that would also be okay.  I can involve someone from the ESP in the conversation as needed.

  • Just scanned through your message, and it looks like it's being detected as spam by X-Spam-Optin and being put into quarantine. Can you just disable the spam option in webmail? Settings > SpamBlocker Settings >  Tag Junk email with -- Spam --.

  • I don’t think that is an appropriate solution, as it will continue to mask the issue.  The question is, what can be done to determine why it is being marked as spam?  Changes settings to allow it through doesn’t help determine what caused it to go there in the first place.

    “X-Spam-Optin” looks like the setting for how to handle detected spam (delete/quarantine/allow it through), not the actual reason it was considered spam in the first place.  Previously it was set to delete messages flagged as spam, so quarantine at least lets them sit in the junk folder for retrieval.  I’d like to figure out if this is a content issue or something else that is causing these messages to be marked as spam.


    If you're the sender of the emails in question you may wish to visit for resources on managing spam and email reputation.