Virgin Media Community

[Stirbitch]

I filter out email spam before it arrives to VM, and that works very nicely.

However, VM is still applying spam filtering, despite the fact that I have it turned off, and it has had several false positives recently. I usually do not even use the VM web interface - I just regard it as a POP3 server and have my own email client.

I had a similar problem a few years ago when something was changed and I had to troubleshoot to find out why I wasn't getting email. That is when I found I had to turn filtering off in the web interface. Now that does not work either. I think it is totally unacceptable that VM decides to stop delivering my email to me without at least saying that something is changing.

Please either simple turn off all spam filter for me, or tell me how to do it. And TELL ME before you decide to filter spam again, or better still just DON'T MEDDLE.

Screen shots attached to demonstrate problem. The "spam" arrived last week, and my spam settings have remained unchanged for years. I am now going to release the spam.

Thank you.

[coenoby]

---

@Stirbitch wrote:

......VM is still applying spam filtering, despite the fact that I have it turned off, and it has had several false positives recently.

It looks as if you are seeing the effects of the two step process that VM uses to identify and deal with suspicious emails:

1) Firstly, they employ checks to determine the authenticity of each email message. So, rather than looking at the content of the email they consider whether  it really comes from the sender that it appears to come from and has not been "spoofed".

Essentially, that means checking the domain name of the email address and the server the email came from. If the server is not authorised to send emails for that domain then the email will fail the authenticity check and will be sent to your spam folder even if you turned spam filter off.

2) Only if the email passes that check will the VM spam filter come into operation and decide whether it looks like spam. As you know, if you have the spam filter turned off then emails classes as spam will be flagged as spam but sent to your inbox.

To sum up, It is likely that the 'spam' you are seeing in your spam folder are emails that have failed the authenticity check and been put into your spam folder as being potential spoofed emails.

Those emails could be spoofed emails (in the sense that someone is trying to deceive you) but probably many are genuine but come from email services that are not setup properly and therefore they look suspicious as far as VM are concerned.

The bottom line is that unless you can get VM to change the way they deal with spoofed (or potentially spoofed) emails you are stuck with this behaviour. Just one more reason to switch to a dedicated email service. 😉

Coenoby

[Stirbitch]

Thank you, and I am sure all your points are correct.

I suppose I mainly wanted to express my displeasure about a service for which I pay - and check I wasn't going crazy or had perhaps missed something I could control myself.

All emails caught by the filter (over which I have no control) were legitimate emails from a large well-known UK company, and were allowed through by Google (Gmail), and another email company that filters spam and redirects my email.

[ravenstar68]

Are you able to show the Authentication-results: headers?

Tim

[Stirbitch]

Authentication-Results: ukmail.iss.as9143.net;
 spf=pass (173.228.157.39;bounce2.pobox.com);
 dkim=pass header.d=t.ao.com;
 dkim=pass header.d=emarsys.net;
 dmarc=pass header.from=t.ao.com (p=reject sp=reject dis=pass)
X-Env-Mailfrom: srs0=noux=hm=t.ao.com=suite40@bounce2.pobox.com
X-Env-Rcptto: [DELETED]
X-SourceIP: 173.228.157.39
X-CNFS-Analysis: v=2.4 cv=LKqj/La9 c=1 sm=1 tr=0 ts=6023c83a cx=a_idp_d
 a=OKPgK+JpVEk6IvMOQdoj4A==:117 a=9aXiVuOPNFYvZHv/PUGo8Q==:17
 a=1oJP67jkp3AA:10 a=qa6Q16uM49sA:10 a=ZZnuYtJkoWoA:10 a=HqC3gOm4AAAA:8
 a=6TYGW3ei7aUzKk1ByGQA:9 a=QEXdDO2ut3YA:10 a=IkWmuU3jKZsA:10 a=SSmOFEACAAAA:8
 a=FREo5eJUAAAA:8 a=yS4QscJnC34Fjsj6wAYA:9 a=Vv_skIGRbiest9Rt:21
 a=_W_S_7VecoQA:10 a=hx-H6H4VQgYA:10 a=Pnd5Ay-_aTEeiBSmeL1q:22
 a=oHCdXj4gaj1i4mBe69VQ:22

Authentication-Results: pb-mx20.pobox.com;
    arc=none (no signatures found);
    bimi=none (No BIMI records found);
    dkim=pass (1024-bit rsa key sha256) header.d=emarsys.net
      header.i=@emarsys.net header.b=bt3o0TaT header.a=rsa-sha256
      header.s=key2 x-bits=1024;
    dkim=pass (1024-bit rsa key sha256) header.d=t.ao.com
      header.i=no-reply@t.ao.com header.b=fap5Mcxi header.a=rsa-sha256
      header.s=key2 x-bits=1024;
    dmarc=pass policy.published-domain-policy=reject
      policy.applied-disposition=none policy.evaluated-disposition=none
      (p=reject,has-list-id=yes,d=none,d.eval=none) policy.policy-from=p
      header.from=t.ao.com;
    iprev=pass smtp.remote-ip=185.90.22.135 (suitepmta022135.emsmtp.us);
    spf=pass smtp.mailfrom=suite40@t.ao.com
      smtp.helo=suitepmta022135.emsmtp.us;
    x-aligned-from=domain_pass (Domain match);
    x-me-sender=none;
    x-ptr=pass smtp.helo=suitepmta022135.emsmtp.us
      policy.ptr=suitepmta022135.emsmtp.us;
    x-return-mx=pass header.domain=t.ao.com policy.org_domain=ao.com
      policy.is_org=no
      (MX Records found: return1.emarsys.net,return0.emarsys.net);
    x-return-mx=pass smtp.domain=t.ao.com policy.org_domain=ao.com
      policy.is_org=no
      (MX Records found: return1.emarsys.net,return0.emarsys.net);
    x-tls=pass smtp.version=TLSv1.2 smtp.cipher=ECDHE-RSA-AES256-GCM-SHA384
      smtp.bits=256/256;
    x-vs=transactional:purchases score=10 state=14

 Thanks Tim.

There are two of them, in a single email, shown above.

Note that the email was sent by AO to my pobox email address. Pobox does spam filtering and redirects to my gmail address and my virgin address. Then I pick up emails sent to the virgin address using Thunderbird. The above headers were from Thunderbird, where they arrived after I moved them from the virgin spam folder to the virgin inbox.

Normally everything redirected by pobox arrives in both gmail and Thunderbird - this is the first time I have noticed anything missing for years.

[MOD EDIT: Personal and private information has been removed from this post. Please do not post personal or private information in your public posts. Please review the Forum Guidelines]

[Emily_G]

Thanks for the post Stirbitch and welcome to our community.

We've sent the information you've provided to the internet security team to get some feedback on why this may be. 

We'll keep you updated.

Thanks, Emily.