bitcointalk emails being marked as spam by Cyren / Commtouch

[DaveF]

Sometime yesterday afternoon my mail server started tagging emails from the forum as spam.
Did a little digging and it is the Cyren / Commtouch.
And it's not just a little tag, it's the 100% this is spam tag.
Anybody else having this issue? Since it's my own managed server it's not a big deal but it can be annoying.
(I redacted / changed my email address if a mod / admin needs it to check something PM me.)

-Dave

[2019.02.24] 22:10:17 [58361] Delivery started for apache@omail.bitcointalk.org at 10:10:17 PM
[2019.02.24] 22:10:23 [58361] Spam check results: [_SPF: None], [BARRACUDA: passed], [CBL-ABUSE SEAT: passed], [FIVE-TEN: passed], [HOSTKARMA - BLACKLIST: passed], [HOSTKARMA - BROWNLIST: passed], [HOSTKARMA - WHITELIST: passed], [MAILSPIKE: passed], [NJABL - SPAM: passed], [SORBS - ABUSE: passed], [SORBS - DYNAMIC IP: passed], [SORBS - PROXY: passed], [SORBS - SOCKS: passed], [SPAMCOP: passed], [SPAMHAUS - PBL: passed], [SPAMHAUS - PBL2: passed], [SPAMHAUS - SBL: passed], [SPAMHAUS - XBL: passed], [SPAMHAUS - XBL2: passed], [SPAMHAUS CSS: passed], [TRUNCATE.GBUDB.NET: passed], [UCEPROTECT LEVEL 1: passed], [UCEPROTECT LEVEL 2: passed], [UCEPROTECT LEVEL 3: passed], [_REVERSEDNSLOOKUP: passed], [_BAYESIANFILTERING: passed], [_COMMTOUCH: 30,Confirmed], [_INTERNALSPAMASSASSIN: 0:1], [_DK: None], [_DKIM: None], [_CUSTOMRULES: ]
[2019.02.24] 22:10:26 [58361] Starting local delivery to DaveF@DaveFMailServer.com
[2019.02.24] 22:10:26 [58361] Delivery for apache@omail.bitcointalk.org to DaveF@DaveFMailServer.com has completed (Deleted) Filter: Spam (Weight: 31), Action (Domain Level): Delete
[2019.02.24] 22:10:26 [58361] End delivery to DaveF@DaveFMailServer.com
[2019.02.24] 22:10:26 [58361] Delivery finished for apache@omail.bitcointalk.org at 10:10:26 PM   [id:60558361]

[leonair]

How do you often open the mail from the forum from time to time? because if you didn't open at least once the email providers spam filtering will detect it as a spam over time.

[Pmalek]

It is not really a big issue, I have noticed that the emails from bitcointalk sometimes go to the inbox and at other times to my SPAM folder. Not really sure why they do that but it doesn't bother me that much.

[elda34b]

Did a little digging and it is the Cyren / Commtouch.
And it's not just a little tag, it's the 100% this is spam tag.
Anybody else having this issue? Since it's my own managed server it's not a big deal but it can be annoying.

Maybe because Bitcointalk email signatures/IP address is not listed/registered on Cyren database. Cyren use this database to filter spam, anything not in the database is considered as spam.

Read more:
- https://community.sophos.com/products/unified-threat-management/f/mail-protection-smtp-pop3-antispam-and-antivirus/100082/spam-confirmed---problems-with-cyren-database-or-bad-pattern
- https://portal.smartertools.com/kb/a2881/cyren-spam-reporting-errors.aspx
- https://www.cyren.com/fp-reasons-explained

[DaveF]

How do you often open the mail from the forum from time to time? because if you didn't open at least once the email providers spam filtering will detect it as a spam over time.

No, my mail server does not care. Something, just triggered it was wondering if anyone else saw it too.

Did a little digging and it is the Cyren / Commtouch.
And it's not just a little tag, it's the 100% this is spam tag.
Anybody else having this issue? Since it's my own managed server it's not a big deal but it can be annoying.

Maybe because Bitcointalk email signatures/IP address is not listed/registered on Cyren database. Cyren use this database to filter spam, anything not in the database is considered as spam.

Read more:
- https://community.sophos.com/products/unified-threat-management/f/mail-protection-smtp-pop3-antispam-and-antivirus/100082/spam-confirmed---problems-with-cyren-database-or-bad-pattern
- https://portal.smartertools.com/kb/a2881/cyren-spam-reporting-errors.aspx
- https://www.cyren.com/fp-reasons-explained

I have seen Cyren, tag a lot of stuff as suspect and bulk that should not have been. But, this is the 1st time I have seen a "confirmed" spam tag on a legit mail.

Could also be that since it's hosted on AWS that a nearby IP or 2 got tagged and this one was lumped in with the rest. Or Cyren burped.

I white listed the IP for now.  It's 52.45.214.107 if anybody cares.
Actually, thinking about it someone should probably list all the sending IPs from the board. This way people who want to can white list all of them instead of one at a time. That is if there is more then one.

-Dave