webproworld emails come in as phishing now

Orion · #1 (**permalink**) 09-25-2007, 03:53 PM

Hello,

It appears that for the last few weeks now every wpw newsletter I receive comes in flagged as possible phishing in my google apps inbox.

This requires me un-phishing the email before I can actually click on any posts or links etc.

I'm not 100% sure what it is that is qualifying it as such, to my knowledge it's something to do with requesting logins and the URLs in the site not matching the domain the mail was sent from.

Wanted to give a heads up as this may be something that would be easy to identify and fix on your end, it's a bit frustrating on mine, took me almost a week to figure out why I couldn't click on any links in your newsletters, and was too busy at the time to bother really digging at the time lol...

Thanks for a great forum, btw!

dux · #2 (**permalink**) 09-26-2007, 05:43 PM

Orion,

You beat me to it! I have just come here to make the same statement!

I get my newsletter sent to my gmail account and now none of the links in the newsletter work. At the top of the newsletter, Google includes this message:

"Warning: This message may not be from whom it claims to be. Beware of following any links in it or of providing the sender with any personal information."

I have been getting the newsletter for a long time now and find this 'censorship' infuriating. I wouldn't mind so much if I could see somewhere within gmail's settings to allow me to trust the links within the newsletter. Anyone know if this is possible?

I wonder how this has affected traffic to WPW?

Orion · #3 (**permalink**) 09-26-2007, 05:59 PM

Hey dux,
on the right corner where you have the REPLY button click the drop down arrow choose report NOT phishing, confirm in the popover and then you can click the links again..

just a pain in the butt... =o)

dux · #4 (**permalink**) 09-27-2007, 03:12 PM

Thanks Orion!

I now have links in my WPW newsletters again!

Orion · #5 (**permalink**) 09-27-2007, 04:29 PM

Still to someone here that deals with setting up the newsletters at WPW.. it would be nice for them to actually correct the problem that causes this to happen.

...please...

**mike** · #6 (**permalink**) 09-28-2007, 02:55 AM

Beyond our control I'm afraid... we're working on it....

Orion · #7 (**permalink**) 09-28-2007, 03:10 AM

But you should put it into ientrynetwork.net as a trouble ticket, as this is something that results as a combination of how they send out your newsletters and how your links are handled in those newsletters...
This can be resolved with DNS entries on your end webproworld.com, and specific mail accounts set up for sending the mailings.
I know what I run several mail lists for clients through aweber, and we don't have this issue.

A common solution (these days) is to have your mailings only link to a newsletter hosted on your website however that's not always as convenient for your subscribers.

Is there an option to have the newsletters come as txt only not in HTML format? I would like to see if that might (temporarily) prevent them from being labelled as spam.

Appreciate all WPW does...

**mike** · #8 (**permalink**) 10-01-2007, 12:14 PM

'They' is us. We send our own newsletters. There isn't anything to be done on our end. text/HTML doesn't matter, it's based on mailserver.

Orion · #9 (**permalink**) 10-01-2007, 03:42 PM

The ONLY reason they are being flagged as phishing is that the email address comes from a different domain name than the links in the email go to.. that's it...
If you are sending your own newsletters and not through a service, then it's VERY easy to create and map the email address to the correct domain!

**mike** · #10 (**permalink**) 10-03-2007, 02:10 PM

I wish it were that simple.

**lanlocked** · #11 (**permalink**) 10-08-2007, 04:24 PM

Hello all;

Jay Fougere, IT Manager for iEntry here.

There are several issues at stake here. We cannot change the 'from' and 'return' domain because of the way we handle bounces etc. ientrynetwork.net has a separate mx record from all of our other domains because bounces are sent back to our mailing system directly. Any specific RFC addresses, such as support@ and abuse@ are forwarded from the mail system to our regular office email servers.

Regardless, many mail servers send mail with different 'return' and 'from' domains than the actual server domain name. This is perfectly legitimate. Google themselves do this as a matter of fact. For employees on the road, we have set up ientryinc.com which is hosted by gmail a.k.a. google. Any email sent from one of these accounts has a return address of 'someuser@ientryinc.com' however if you look at the header information the email originates on a google.com server (See below, slightly edited to remove IPs and email addresses):

Return-Path: <XXXXXXXXXXXX@ientryinc.com>
X-Original-To: XXXXXXXXXXXX@ientry.com
Delivered-To: XXXXXXXXXXXX@ientry.com
Received: from mx1.ientry.com (mx1.ientry.com [x.x.x.x])
by smtp.ientry.com (Postfix) with ESMTP id C6F311A32F1
for <XXXXXXXXXXXX@ientry.com>; Mon, 8 Oct 2007 15:16:30 -0400 (EDT)
Received: from localhost (unknown [127.0.0.1])
by mx1.ientry.com (Postfix) with ESMTP id 966A5E680AB
for <XXXXXXXXXXXX@ientry.com>; Mon, 8 Oct 2007 19:16:13 +0000 (UTC)
X-Virus-Scanned: amavisd-new at ientry.com
X-Spam-Flag: NO
X-Spam-Score: 0.602
Received: from mx1.ientry.com ([127.0.0.1])
by localhost (newmail.ientry.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id n3HuwFGEaTpX; Mon, 8 Oct 2007 15:16:06 -0400 (EDT)
Received: from wr-out-0506.google.com (wr-out-0506.google.com [64.233.184.227])
by mx1.ientry.com (Postfix) with ESMTP id F06AFE680B2
for <XXXXXXXXXXXX@ientry.com>; Mon, 8 Oct 2007 15:15:37 -0400 (EDT)
Received: by wr-out-0506.google.com with SMTP id 70so641845wra
for <XXXXXXXXXXXX@ientry.com>; Mon, 08 Oct 2007 12:15:54 -0700 (PDT)
Received: by 10.90.101.19 with SMTP id y19mr4141132agb.1191870954584;
Mon, 08 Oct 2007 12:15:54 -0700 (PDT)
Received: by 10.90.56.5 with HTTP; Mon, 8 Oct 2007 12:15:54 -0700 (PDT)
Message-ID: <4cafa2390710081215p742a6afcocfdca7298f6b5f87@mail .gmail.com>
Date: Mon, 8 Oct 2007 15:15:54 -0400
From: "Jay Fougere" <XXXXXXXXXXXX@ientryinc.com>
To: "Jay Fougere" <XXXXXXXXXXXX@ientry.com>

As you can see, the 'from' and 'return' addresses are from 'ientryinc.com' addresses while the servers are all google.com servers.

Lastly, we have published SPF records that are in fact correct for the IP addresses and domain names involved.

This is something that is happening on Googles end and we are trying to resolve the issue.

Orion · #12 (**permalink**) 10-08-2007, 05:29 PM

hmmm, curious...

we use 3rd party sites for our newsletter, mostly aweber.com emails come out from them links are all to our sites in the HTML newsletters and never a problem.

not sure on how they have it set up though, there was no requirements for dns or anything on our end. it was all done on aweber's end.

I hope there's some way to correct it as I know it's frustrating for many of us...

The idea to offer a text only newsletter with a link to the full newsletter on the site could be a temporary work around so that the emails aren't all blocked.

Orion · #13 (**permalink**) 10-12-2007, 05:55 PM

Hi again,

I did a bit of look around and the only obvious difference that I can see between your DNS records and those of sites that don't show as phishing is that sites like internet.com and the like use softfail on all for their spf records and you use fail for all...

Not sure if that could have anything to do with it but anything is possible. I'll also ask some friends at google about how the phishing filter gets triggered etc. See if we can't find a solution for you on this.

spiderbait · #14 (**permalink**) 10-14-2007, 12:35 PM

Wouldn't it be possible to solve this by having links in the newsletter point to ientrynetwork.net/topic (et cetera) and then be automatically redirected by the server to the correct address on WPW?

I seems to me that this would solve the problem of logins and links pointing to domains other than the sending domain.

Just a thought.

Orion · #15 (**permalink**) 10-15-2007, 12:11 AM

neat thought !

**mike** · #16 (**permalink**) 10-17-2007, 10:18 AM

Quote:

Originally Posted by spiderbait

Wouldn't it be possible to solve this by having links in the newsletter point to ientrynetwork.net/topic (et cetera) and then be automatically redirected by the server to the correct address on WPW?

I seems to me that this would solve the problem of logins and links pointing to domains other than the sending domain.

Just a thought.

Nice idea, but unfortunately no... that wouldn't have helped in this instance.

The good news is, the Google folks have finally taken care of it for us. So, this should be a resolved issue. As I said earlier, there wasn't anything we were doing on our end improperly or incorrectly - we were just (incorrectly) tripping some trigger in their mailsorting algo and they have since found and fixed it for us.