Hey Community!
Today I have sent myself two mail messages with the same content from my personal mail account (ProtonMail with a custom domain and activated functions SPF, DKIM & DMARC) to my @outlook.de address. The configuration of SPF & DMARC looks like this:
SPF:
v=spf1 include:_spf.protonmail.ch mx ~all
DMARC:
v=DMARC1; p=quarantine; rua=mailto:xxx@xxx.xxx; pct=100; aspf=s; adkim=s
The first one landed in the junk folder. The second (around 4 minutes later) in the inbox. I'm now trying to find out why this is so but have some difficulty in correctly interpreting some of the header data when investigating it. At least I have noticed some things that are likely to be relevant informations. I used the comparison feature of Notepad++ for this:
- All mail authentication techniques (SPF, DKIM & DMARC) were transmitted and recognized correctly.
- The mail message classified as junk by Outlook on the web is missing the entries "X-MS-Exchange-ATPSafeLinks-Stat" and "X-MS-Exchange-ATPSafeLinks-BitVector".
- Right after the entry "X-Microsoft-Antispam-Mailbox-Delivery" the expression "OFR:SpamFilterAuthJ" exists in the junk mail header but missing in the other mail.
- Both messages were sent as "text only" mails - however, the entries in the header are different.
Left: Header data of the non-filtered mail / Right: Header data of the mail classified as junk
1.
2.
3.
4.
My first impression: Especially the first two points looking suspicious. Why were the entries "X-MS-Exchange-ATPSafeLinks-Stat" and "X-MS-Exchange-ATPSafeLinks-BitVector" deleted or not transferred?
I am thankful for every feedback.
Greetings from germany,
fommio