Unsolicited mail error sending to Gmail - Error 550 5.7.1

Good morning,
I have a NethServer version 7.9.2009 as mail server (v. 2.32.2).
My server work without any problem from 3 years
Startin from 2 week I cannot send to GMail addresses. When I try to send at address@gmail.com I receive the follow error:

#################################
smtp; 550-5.7.1 Gmail has detected
that this message is likely 550-5.7.1 unsolicited mail. To reduce the
amount of spam sent to Gmail, this 550-5.7.1 message has been blocked. For
more information, go to 550 5.7.1
#################################

I have a correct configuration of SPF, DKIM, DMARC, PTR, MX, etc. etc.
I’ve checked ALL with mxtoolbox.com and ALL seem correect.
My IP isn’t in any blacklist.
I’ve also checked whit GApp tools and no problem detected.

Please can help me?

Many thanks

Hi, welcome to the joys and fancy experiences of being a mail admin server. :slight_smile:
Aside from joking, you can ask to Google if they can explain you why the answer is the one you getting. I know, it’s quite unlikely to receive proper answer from any person into that department…

Anyway.
You’re not sharing any of your infos (domain, for example) and without any other info, is hard to give focused suggestions.

Consider to use other tools than mxtoolbox like

or

for have multiple sources of info and different approach of analysis.

Also consider that DNS propagation might take some hours, including cache expiration for infos. If you changed SPF, DKIM, DMARC, PTR and MX saturday… could still take few more hours to complete propagation.

This website could help you to check even more info.

Last but not least: i used several of this site/tools, but I’m not in the condition to guarantee any efficacy nor privacy respect.

Good morning Michael and thanks!
Yes, my domain is eurostampisrl.com and the IP of my mail server is 85.115.197.29.
Yes I’ve already tested ALL: mstoolbox, spamhouse, GlokApps, SPF/DKIM/DMARC tester, mail-tester.com and all is OK.
I’ve rechecked all configuration of mail server (I’ve also disable IPv6) and DNS with no issue.
In the last week I’ve also changed mail server IP (85.115.197.28 → 29) for bypass a possible IP blacklist (all blacklist check for IP and domain are negative).
Seem all ok but I can’t send mail to gmail account.
P.S.: I’ve also DMARK but I’m not a bulk sender

Thak for any suggestion

Hi @Renzo_Bulzinetti ,

I also had a similar problem. Emails were sent as if they were from my account. Hundreds.
Check the send logs to identify the account from which the emails are sent.
First of all, I changed the password on the email account.
After this, the transmission of fake emails stopped.
However, I managed to send emails to Gmail only after approx. 1 or 2 months, even if, like you, I have all the correct settings for SPF, DKIM, DMARC, PTR, MX, …
The unlocking was done automatically by Gmail.

Gabriel

@GG_jr thanks for sharing your experience :slight_smile:

@Renzo_Bulzinetti is used any Google account as SMTP relay from this installation?

Google has strong guidelines

We require that you set up these email authentication methods for your domain:

  • All senders: SPF or DKIM
  • Bulk senders: SPF, DKIM, and DMARC

Good practices:

  • setting a TLSA-Record
  • SPF record: "v=spf1 a mx ~all"
  • EHLO and HELO matches
  • _DMARC-Record: "v=DMARC1;p=reject;pct=100;rua=mailto:abuse@domain.tld;ruf=mailto:abuse@domain.tld;fo=0:d:s;aspf=r;adkim=r;"

My preferred check:
https://dane.sys4.de

You get a detailed analysis if you send a mail to check-auth@verifier.port25.com
If all the tests are passed, Google accepts the mails.

Sincerely, Marko

2 Likes

I forgot this: Verify your domain with a TXT record - Google Workspace Admin Help

Ok, maybe I’ve found the problem: the case is the same of Gabriel.
I’ve found 3045 mail sent from test@eurostampisrl.com beetwin 2 and 23 July!
I’ve blocked the account and analize and filtered IP connection originating from and installed Threat Shield to block IP (I’ve not yet added the list and if you want I can share my IP blacklist).
@pike : no, I’m not using any gmail accont for relay
@capote: thanks Marko: I will check all and also modify my DMARC record as suggested.

Now I have to wait …
Thanks to all

1 Like

Yikes! That’s an excellent reason for Google for saying to your mailserver “tch tch tch”…

May I suggest a “password roundup change”? And also install (if not already there) Fail2Ban.