loomio.org email marked as spam

[fauno]

X-Spamd-Result: default: False [10.60 / 15.00]
 RAMBLER_URIBL(4.50)[stanford.edu.uribl.rambler.ru]
 PHISHING(4.00)[attending.io->loomio.org, stanford.edu->loomio.org]
 R_BAD_CTE_7BIT(3.00)[]
 R_DKIM_ALLOW(-0.20)[loomio.org]
 BAYES_HAM(-0.40)[10.17%]
 DMARC_NA(0.00)[loomio.org]
 URIBL_BLOCKED(0.00)[imgur.com.multi.uribl.com, stanford.edu.multi.uribl.com, attending.io.multi.uribl.com, loomio.org.multi.uribl.com]
 MIME_GOOD(-0.10)[multipart/alternative, text/plain]
 R_SPF_ALLOW(-0.20)[+a:smtp.loomio.org]

numbers in parenthesis are scores, positive ones lead to email being marked as spam.

• the phishing score was given because non-loomio urls are printed as they are but linked through a loomio's ahoy address (i'm guessing is for tracking clicks), which is a phishing technique.

• the bad content transfer encoding is set at 7 bit and i'm guessing the contents are not. here's a discussion about cte: https://stackoverflow.com/a/28531705

• the rambler uribl score depends on the links printed, but the previous two scores are enough (7 points!) for rspamd to greylist and then mark them as spam.

i guess if you can fix the encoding you could get away with the phishy urls? :P

[gdpelican]

Have you still been having troubles with this, @fauno ? We've switched over to Amazon SES on our end, which I believe has helped with our spamminess.

[fauno]

a few still got classified as spam, but way less than before :) thunderbird also tells me email notifications can be scam, probably because of ahoy's hidden urls

…

-- }(:=

[gdpelican]

Cool, I'm going to close this for now, we'll see how we go going forward.

We're discovering more and more that as much as we say that everyone's on slack and facebook... really EVERYONE is on email, so it's really important we keep on top of this stuff. Thanks for raising.