My E-mail appears as spam | Troubleshooting - Mail server | Part 14#17

of 21 | My E-mail appears as spam | Troubleshooting - Mail server | Part 14#17
Written by Eyal Doron | o365info.com
MY E-MAIL APPEARS AS SPAM |
TROUBLESHOOTING – MAIL SERVER |
PART 14#17
In the current article and the next article: My E-mail
appears as spam | Troubleshooting – Mail server | Part
15#17, we will review the troubleshooting process of the
scenario – “our mail server appears as blacklisted” in
Office 365 and Exchange Online environment
Another variation of this scenario could be: a scenario, in
which we want to understand, if the problem in which
our organization E-mail is identified as spamjunk mail
relates to our mail server or to other possible issues.

The troubleshooting path logic
Versus a scenario in which we use on-Premises mail
infrastructure, in case that our mail infrastructure is hosted at
Office 365 (Exchange Online), the troubleshooting logic and
steps that we will need to implement are different.
The “major component” in our troubleshooting path, includes
the following parts:
1. Get information from the E-mail message
The basis for our scenario is the information that appears in
the E-mail message. The “E-mail message” could be:

 An NDR message that was sent to one of our organization users,
which inform him that “his mail server” (our organization
Exchange Online server) is blacklisted.
 A scenario, in which external recipient reports that – our E-mail
saved in his junk mail folder, and he sends us the E-mail
message header which include our mail server IP address.
To be able to start the troubleshooting process, we will need
to “extract” the IP address that appear in the NDR message
(the IP address of the Exchange Online server who appears as
blacklisted).
2. Get information about your Exchange Online
infrastructure
In an Exchange Online environment, we will need to get
information about the Exchange Online that represent our
domain: the Exchange Online hostname + IP address that is
“mapped” to our Exchange Online hostname.
3. Fetch the information about the Exchange Online IP
address
We will need to get the IP address of the “Office 365 mail
server” that sent out the E-mail message “on behalf” of the
Office 365 users to the destination recipient.
4. Verify if the “formal “Exchange Online IP address appear
as blacklisted.
This is the “cross-section” part, in which we want to verify if the
IP address that appear in the NDR message is related to our

“formal Exchange Online server” or, to anther passable
scenario – Exchange Online- High Risk Delivery Pool.
Infer the necessary conclusions – based on the information
from the former step, we can decide what are the “operations”
that we will need to implement.
Get the information from the E-mail message
that was identified as spamNDR
In the following phase, we will need to “fetch” from the E-mail
message the required information about the mail server host
name or the IP address that was blacklisted.
We will need to ask our organization user who gets the NDR
message or the external recipient who informs us that our E-
mail saved in his junk mail folder, to send us a copy of the E-
mail message.

Forwarding a copy of the NDR message or the
message that saved to the junk mail folder.
In a scenario in which we need to examine E-mail messages,
the best practice is to ask for a copy of the original E-mail
message.
The way for providing a “complete copy” of the E-mail message
is by forwarding a copy of the E-mail message.
Outlook and OWA mail client include the option of “forwarding
an E-mail message copy” but, not all the mail client support
this option.
For example: as far as I know, there is no option to send a
copy of the original E-mail message when using the Gmail mail
client (the option of “forwarding” E-mail doesn’t send the

“complete E-mail message that included the original mail
headers).
In the following section, we will demonstrate how to forward
or copy of the “original E-mail message” by using Outlook and
OWA mail client.
1. Sending E-mail as attachment using Outlook
Outlook mail client includes the option that describes as
forward E-mail as an attachment.
1. Select the E-mail item
2. In the HOME menu, click on the more option and then click on
the forward as attachment
In the following screenshot, we can see the result – the E-mail
that was sent includes a copy of the original E-mail message.
Later, we can access the “original E-mail message” and
analyses the information that’s included in the E-mail message
header.

2. Sending (forwarding) E-mail as attachment using OWA
1. Log into Office Web App (OWA).
2. Click on the option New.
3. Click the open separate window icon, located at the top right
corner of the message window. This will open this message as
its own window within your browser.

4. Locate the “new E-mail window” side by side with the OWA
window.
5. Drag and drop the email from your mail folder in the window of
the new E-mail message
In the following screenshot, we can see the E-mail message
appears as an attachment in the “new E-mail message”
Getting the required information from the E-
mail header
In a scenario in which we need to “extract” the Exchange
Online server IP address from an E-mail message that was
sent to an external receipt, we will need to access the
information is “hidden”, in the E-mail message part
named: mail header.

Getting the E-mail header when using Outlook mail client
1. Choose the specific E-mail message
2. Chose the File

3. In the window that appears, click on the Properties
4. In the section named: Internet headers, you can see the content
of the mail header.

5. Copy the information from the window and send the
information for further analysis.
Getting the E-mail header when using OWA mail client
1. Choose the specific E-mail message
2. Choose the “more option” icon (the three dots)

3. Choose the option: View message details
4. In the pop out windows that appear, we can see the content of
the mail header.

Getting the E-mail header when using Gmail mail client
The Gmail E-mail web client, doesn’t include an option for
forwarding E-mail message as an attachment.
The only option that we can use is asking for the user to send
us a copy of the E-mail header (the E-mail message that was
saved in his junk mail folder).
To be able to view the E-mail header when using Gmail mail
client, use the following procedure:
1. Open the message in your Gmail inbox.

2. Click the down-arrow in the top-right corner of the message.
3. Click the “Show original” link toward the bottom of the option’s
box. The message will open in a separate window with the full
message headers at the top.
4. In the windows that appear, we can see the content of the mail
header.

Additional reading
 How to view the full message headers of an email
Internal outbound spam in Office 365
environment | Article series index
A quick reference for the article series

My E-mail appears as a spam | Article
series index | Part 0#17
The article index of the complete
article series
Introduction to the concept of internal outbound spam in general
and in Office 365 and Exchange Online environment
My E-mail appears as a spam –
Introduction | Office 365 | Part 1#17
The psychological profile of the
phenomenon: “My E-mail appears as
a spam!”, possible factors for causing
our E-mail to appear a “spam mail”,
the definition of internal outbound
spam.
Internal spam in Office 365 –
Introduction | Part 2#17
Review in general the term: “internal
outbound spam”, miss conceptions
that relate to this term, the risks that
are involved in this scenario,
outbound spam E-mail policy and
more.
Internal spam in Office 365 –
Introduction | Part 3#17
What are the possible reasons that
could cause to our mail to appear as
spamjunk mail, who or what are this
“elements”, that can decide that our

mail is a spam mail?, what are the
possible “reactions” of the destination
mail infrastructure that identify our E-
mail as spamjunk mail?.
Commercial E-mail – Using the right
tools | Office 365 | Part 4#17
What is commercial E-mail?
Commercial E-mail as part of the
business process. Why do I think that
Office 365 Exchange Online is
unsuitable for the purpose of
commercial E-mail?
Introduction if the major causes for a scenario in which your
organization E-mail appears as spam
My E-mail appears as spam | The 7
major reasons | Part 5#17
Review three major reasons, that
could lead to a scenario, in which E-
mail that is sent from our
organization identified as spam mail:
1. E-mail content, 2. Violation of the
SMTP standards, 3. BulkMass mail
My E-mail appears as spam | The 7
major reasons | Part 6#17
Review three major reasons, that
could lead to a scenario, in which E-
mail that is sent from our
organization identified as spam mail:

4. False positive, 5. User Desktop
malware, 6. “Problematic” Website
Introduction if the subject of SPF record in general and in Office
365 environment
What is SPF record good for? | Part
7#17
The purpose of the SPF record and the
relation to for our mail infrastructure.
How does the SPF record enable us to
prevent a scenario in which hostile
elements could send E-mail on our
behalf.
Implementing SPF record | Part 8#17
The “technical side” of the SPF record:
the structure of SPF record, the way
that we create SPF record, what is the
required syntax for the SPF record in
an Office 365 environment + mix mail
environment, how to verify the
existence of SPF record and so on.
Introduction if the subject of Exchange Online - High Risk Delivery
Pool
High Risk Delivery Pool and Exchange
Online | Part 9#17
How Office 365 (Exchange Online) is
handling a scenario of internal
outbound spam by using the help of

the Exchange Online- High Risk
Delivery Pool.
High Risk Delivery Pool and Exchange
Online | Part 10#17
The second article about the subject
of Exchange Online- High Risk
Delivery Pool.
The troubleshooting path of internal outbound spam scenario
My E-mail appears as spam –
Troubleshooting path | Part 11#17
Troubleshooting scenario of internal
outbound spam in Office 365 and
Exchange Online environment.
Verifying if our domain name is
blacklisted, verifying if the problem is
related to E-mail content, verifying if
the problem is related to specific
organization user E-mail address,
moving the troubleshooting process
to the “other side.
My E-mail appears as spam |
Troubleshooting – Domain name and
E-mail content | Part 12#17
Verify if our domain name appears as
blacklisted, verify if the problem
relates to a specific E-mail message
content, registering blacklist
monitoring services, activating the

option of Exchange Online outbound
spam.
Troubleshooting – Mail server | Part
13#17
What is the meaning of: “our mail
server”?, Mail server IP, host name
and Exchange Online. One of our
users got an NDR which informs him,
that his mail server is blacklisted!,
How do we know that my mail server
is blacklisted?
14#17
The troubleshooting path logic. Get
the information from the E-mail
message that was identified as
spamNDR. Forwarding a copy of the
NDR message or the message that
saved to the junk mail
15#17
Step B – Get information about your
Exchange Online infrastructure, Step
C – fetch the information about the
Exchange Online IP address, Step D –
verify if the “formal “Exchange Online
IP address a

De-list your organization from a
blacklist | My E-mail appears as spam
| Part 16#17
Review the charters of a scenario in
which your organization appears as
blacklisted. The steps and the
operations that need to be
implemented for de-list your
organization from a blacklist.
Summery and recap of the troubleshooting and best practices in a
scenario of internal outbound spam
Dealing and avoiding internal spam |
Best practices | Part 17#17
Provide a short checklist for all the
steps and the operation that relates
to a scenario of – internal outbound
spam.

My E-mail appears as spam | Troubleshooting - Mail server | Part 14#17

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Andere mochten auch

Andere mochten auch (13)

Mehr von Eyal Doron

Mehr von Eyal Doron (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

My E-mail appears as spam | Troubleshooting - Mail server | Part 14#17