Email from PHP scripts going to spam

[Julien Knoell]

Hello,

I have a problem where email from any PHP scripts are (it seems) consistently going into spam folders in clientside email software even though the headers say they are passing SPF and the server is a permitted sender. X-Antivirus and X-AntiAbuse headers are added and none are complaining.

I have checked DNS and the server IP's aren't blacklisted.

The only thing I can think is that is causing a problem is that the server (sub domain) name is completely different from the domain the email is coming from. But I would think this is normal on multi-domain hosted servers such as mine.

Header:

Show/Hide: Header

Delivered-To: [email protected]
Received: by 2002:a5d:4d10:0:0:0:0:0 with SMTP id z16csp1656164wrt;
Sun, 5 May 2019 15:27:59 -0700 (PDT)
X-Google-Smtp-Source: APXvYqyQSE/HwGRYYwo//K5hJ2Ah86LaTU+xfF37wcKWUVXcHn/IL/bnZU0p0V4MmT19IpEKocn8
X-Received: by 2002:a1c:3cc2:: with SMTP id j185mr14593518wma.26.1557095279152;
Sun, 05 May 2019 15:27:59 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1557095279; cv=none;
d=google.com; s=arc-20160816;
b=W91JB8F0tbqDNdoX/Ufx//aVWycVsmVDaPAjDh2W7kjaqlyH3R+id0jsSZ6FZAfAB8
/068nikfvoxsR8MUzG8qFjw1e/Y0xmdIL9r5aV0hgBx2NQMVYOXhxlGiVpm2i5UZdENM
R7VmBpU+sVenxlm7jCSVT5DmykICe2cBYLSyWQDUHv+TjXdqdpylXF7ifAnkDh2lCjaX
mzAd+NG5ntTqZ8wT73p+9Swo/GyuOewmX8quhNUQxok+bVCFVP/xCruDiypV4VAgmg/3
bS9bZxg4d96S/M+ESyyDyDhIR2l0ffCtSOB1bGWOkHfg7qGFGn2kRKCpba3lr0IhY4hl
xbkw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=content-transfer-encoding:mime-version:message-id:from:date:subject
:to:dkim-signature;
bh=JlXXcvFhSpEo7uvW2UoHCOpOuiOVfQWqokS+KIxxhLM=;
b=UvivBUzLNaQ3v01GL/UMrn/qMJBcckUAbCanG7uV/o6bktmCtlgU6yNAMR8Zi/EQx+
WNjd53NMdu+W3rHDrfv9W2NH+vywYTwCM4ctNU9GPppsJsXDQsss2yGGLMA2l2WopKEh
veVJ2YuUe7C4hnDrSOEJ2kjZykRI61vV4M3akG4YhVMY6SRtxe6I0++WZ//RTQFMCCub
XpJ9Nr2yjFU8s8hy2xtd5AkiunqWMkF+xOlAsINmr2KyIfO5fNSRCW8skPoIBn8WwJWy
IArdmkB/54l0te1vV9OgPfZK1L1TnWoxdJeJMgc5J86ubRtJd1nfrCUDVxO5rQ0Ql+vI
6wvA==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass [email protected] header.s=default header.b=YluU7CMI;
spf=pass (google.com: domain of [email protected] designates 51.158.xx.xxx as permitted sender) [email protected];
dmarc=pass (p=REJECT sp=NONE dis=NONE) header.from=example.net
Return-Path: <[email protected]>
Received: from mail.example.net (mail.example.net. [51.158.xx.xxx])
by mx.google.com with ESMTPS id u16si5673089wmc.86.2019.05.05.15.27.58
for <[email protected]>
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Sun, 05 May 2019 15:27:59 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 51.158.xx.xxx as permitted sender) client-ip=51.158.xx.xxx;
Authentication-Results: mx.google.com;
dkim=pass [email protected] header.s=default header.b=YluU7CMI;
spf=pass (google.com: domain of [email protected] designates 51.158.xx.xxx as permitted sender) [email protected];
dmarc=pass (p=REJECT sp=NONE dis=NONE) header.from=example.net
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=example.net; s=default; h=Content-Transfer-Encoding:Content-Type: MIME-Version:Message-ID:From:Date:Subject:To:Sender:Reply-To:Cc:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=JlXXcvFhSpEo7uvW2UoHCOpOuiOVfQWqokS+KIxxhLM=; b=YluU7CMIvujD1gDDzsP8vDZa8e 5/q5UdqUxXilIP4yBfiQj0L35U9oN+AiQCZDPt0KTzgdbdRxDBeRo5lCmVXK7DDBGmz5ILflYHIN7 9rnkpTWARpXz6sNxYn4Deeoh9FmNhcNv1I1o+GeKk9PPmJ0sVXZCKgZ2QsDEIXQHFZDYueX+rfP2m /7gQlmm+EE8S81bV9nOM8F+CXu352y6+tMDIJh/P5mrqwXeFj8XoDOEEdWksEdxPUr542SKkCdkp+ ZGBUXhmB8rj4kHgh1IsWSmYCOV8Fa8LpT7QL4IFdbZ4m8ezB6zrzlPRuu/z13R5VFa6ozmCtziTF9 N5IeT1rA==;
Received: from network by mail.example.net with local (Exim 4.91) (envelope-from <[email protected]>) id 1hNPbu-0005kn-So for [email protected]; Mon, 06 May 2019 00:27:58 +0200
To: "someusr (example)" <[email protected]>
Subject: someusr, votre avis sur example nous intéresse !
X-PHP-Script: manager.example.net/adminfef4g4ghd5g4f45dx/clientsemails.php for 91.169.34.68
X-PHP-Originating-Script: 1005:class.phpmailer.php
Date: Mon, 6 May 2019 00:27:54 +0200
From: example <[email protected]>
Message-ID: <[email protected]>
X-Mailer: example
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="b1_c2b801c9539d83d7ceb542cad216eaaa"
Content-Transfer-Encoding: 8bit
X-OutGoing-Spam-Status: No, score=0.0
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - mail.example.net
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [1005 992] / [47 12]
X-AntiAbuse: Sender Address Domain - example.net
X-Get-Message-Sender-Via: mail.example.net: authenticated_id: network/from_h
X-Authenticated-Sender: mail.example.net: [email protected]
X-Source:
X-Source-Args: php-fpm: pool manager_example.net
X-Source-Dir: example.net:/public_html/manager/adminfef4g4ghd5g4f45dx

--b1_c2b801c9539d83d7ceb542cad216eaaa
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit

Can anyone point me in the right direction to solve this please, some of my clients are starting to get restless and I don't know how to solve this.

Many thanks for any wisdom you can offer.

 

[cPanelLauren]

Hi @Julien Knoell


Your email is passing all of their checks (dkim, spf, ptr, dmarc). It's unfortunate but it could be just the fact that it's a PHP script getting it flagged but that's not indicated in this. What should be done is to contact Google directly to identify what is causing this email to be flagged, from what I'm seeing you're doing everything correctly as in terms of configuration. They have their postmaster tools which might be helpful: Postmaster Tools – Google

 

[Julien Knoell]

Hi @Julien Knoell


Your email is passing all of their checks (dkim, spf, ptr, dmarc). It's unfortunate but it could be just the fact that it's a PHP script getting it flagged but that's not indicated in this. What should be done is to contact Google directly to identify what is causing this email to be flagged, from what I'm seeing you're doing everything correctly as in terms of configuration. They have their postmaster tools which might be helpful: Postmaster Tools – Google

Hello,
Emails are in spam on all providers (gMail, outlook, yahoo etc..) ..

 

[cPanelLauren]

The suggestion remains the same, if you're employing all resources available to ensure that mail is not sent to spam but it continues to be you're most likely running into an IP reputation issue or something else which they'd be able to answer.