Barracuda tagging email with ‘date grossly in the future.’

barracudaexchange-2003spamspam-filter

I have a Barracuda 300. Granted it's running on some old firmware and the Energize updates are quite outdated. I'd like to update them, but, not my financial decision to do so.

Starting around the first of the year, our Barracuda began tagging a rather large amount of emails (that were normally allowed into our network) as SPAM because of a high target score due to it perceiving that the date of said email was 'grossly in the future.'

Here is a copy of the Source of the email taken from the Barracuda.

X-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.2.29990
Rule breakdown below
pts rule name description

3.38 FH_DATE_PAST_20XX The date is grossly in the future.

Keep in mind, that updating the firmware and applying the Energizer updates at this time is just not feasible. Not that I am guarnateed that that would solve the problem, but, it needs to be taken out of the equation as a possible answer.

I am not that familiar with the inner workings of the Barracuda line of products, does anyone have any idea(s) as to why the Barracuda is thinking that an email sent yesterday at 8:21PM was tagged as a date 'grossly in the future.'

Since the barracudas are so new to me, I'm happy to provide any other information that help suss out what's going on.

Thanks.

UPDATE: Outlook Full Header from a tagged message

X-ASG-Debug-ID: 1325823247-07a81a820001-d0RUwY

Received: from mail-iy0-f176.google.com (mail-iy0-f176.google.com [209.85.210.176]) by >mail.firstwave.aero with ESMTP id IhB0n11vCN63DDRC for ; Thu, 05 >Jan 2012 22:14:07 -0600 (CST)

X-Barracuda-Envelope-From: me@me.com

Received: by iapp10 with SMTP id p10so2613260iap.21 for ; Thu, 05 Jan 2012 >20:14:07 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=gamma;
h=from:to:subject:date:message-id:mime-version:content-type:x-mailer
:thread-index:content-language;
bh=J9QYd5h7+/IRzvhASN6GQUNYK13b2JGzZnFkRPfE66o=;
b=m+Nob2ezR5LLx7bpFzjzIlOwrWURTYpVfcVPWS1IoqHSF3729M9ZPWqImMU+eZP9wK
dVeWbiFiv+Pa/9qjrqiqJdoIKeqlVdY2kJQDzijQY81TS0sIQf7Ll+xANRNZ8HdRTXZD
kLjviq5cgijZrQAIxEEF0GXjl2cG4boBUbO5I=X-Barracuda-BBL-IP: nil

Received: by 10.50.156.130 with SMTP id we2mr5673047igb.10.1325823247091;
Thu, 05 Jan 2012 20:14:07 -0800 (PST)
Received: from Joker (deleted IP)
by mx.google.com with ESMTPS id l35sm209064912ibj.0.2012.01.05.20.14.05
(version=TLSv1/SSLv3 cipher=OTHER);
Thu, 05 Jan 2012 20:14:06 -0800 (PST)

From: me

To: me@me.com

X-ASG-Orig-Subj:

Subject: [Barracuda SPAM]

Date: Thu, 5 Jan 2012 22:14:06 -0600

Message-ID: <000001cccc29$a31db3e0$e9591ba0$@com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="—-=_NextPart_000_0001_01CCCBF7.588343E0"

X-Mailer: Microsoft Office Outlook 12.0

Thread-Index: AczMKaF4b0TpPhsDRDOgSYGxa8UwLw==

Content-Language: en-us

X-Barracuda-Connect: mail-iy0-f176.google.com[209.85.210.176]

X-Barracuda-Start-Time: 1325823247

X-Barracuda-URL: deleted

X-Virus-Scanned: by bsmtpd at me.com

X-Barracuda-Spam-Score: 4.68

X-Barracuda-Spam-Status: Yes, SCORE=4.68 using global scores of TAG_LEVEL=3.5

QUARANTINE_LEVEL=1000.0 KILL_LEVEL=5.0 tests=FH_DATE_PAST_20XX, HTML_MESSAGE, >MIME_HTML_MOSTLY, MISSING_SUBJECT, MISSING_SUBJECT_2

X-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.2.29990

Rule breakdown below

pts rule name description

3.38 FH_DATE_PAST_20XX The date is grossly in the future.

0.00 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

0.00 HTML_MESSAGE BODY: HTML included in message

0.01 MISSING_SUBJECT Missing Subject: header

1.28 MISSING_SUBJECT_2 Missing Subject: header

X-Priority: 5 (Lowest)

X-MSMail-Priority: Low

Importance: Low

X-Barracuda-Spam-Flag: YES

Return-Path: me@me.com

X-OriginalArrivalTime: 06 Jan 2012 04:14:08.0496 (UTC) FILETIME=[A2DC1700:01CCCC29]

>

Bit of a formatted mess, but, all there.

Best Answer

I'm seeing the same situation. Yes, it's due to the god-awful old firmware. I have one Barracuda unit out there that I cannot update because of a lapsed warranty and Barracuda's terrible renewal policy. I'm working to possibly root into the box and disable the offending SpamAssasin rule or manually update firmware...

Edit: I'm seeing reports of customers whose Barracuda units lapsed in December 2011 and have the same issue. That means that Barracuda didn't fix this long-standing bug until very recently.

This is a 2012 bug and is covered in the Barracuda Support Forums and a knowledge base posting.

Related Solutions

All the emails to Yahoo!, Hotmail and AOL are going to Spam, though I’ve implemented every validation method (works for Gmail though)

In looking at your failures, I have noticed several problems.

The first is that the originating ip for your emails (208.115.108.162) is listed on Five Ten's blacklist (http://www.five-ten-sg.com). Yahoo, Hotmail, and AOL all use their own internal blacklists, and to my knowledge don't rely on third party blacklists (such as Five Ten). That being said, it's a good indicator that something is afoot. You can delist yourself at five ten here: http://www.five-ten-sg.com/blackhole.php?ip=208.115.108.162&Search=Search. Delistings usually take around 12 to 24 hours. While this won't necessarily FIX your Yahoo, Hotmail, AOL problem... you should delist pronto.

The biggest problem is the lack of MX record for gemini.shiftapp.com. The emails are "FROM" james@gemini.shiftapp.com. It is a very common anti-spam tactic to lookup the MX record of the sending domain on incoming email. When AOL etc lookup the MX record for gemini.shiftapp.com, and they see none... they will likely classify as spam on the spot. At the very least, an MX will allow the recipients of these emails to reply.

Reverse DNS: You have a valid PTR record for that IP. AOL etc just simply look to see that PTR records exist... they don't really care what the PTR record returns so you are "good to go" as they say.

I didn't find any SPF records for gemini.shiftapp.com or shiftapp.com. That's ok because SPF never really caught on. Kinda like 8 track or Laser Discs... they look good on paper, but never gained critical mass.

My bet is the lack of MX records. One other thing to consider: make sure your email server is not an open relay (allowing unauthenticated users to send mail to other users not hosted on your server). Also, might be wise to do an audit of all email going through your system... if one of your users is (knowningly or UNknowingly) sending spam through your server, you'll be skating uphill!

Hope this helps, and best of luck! -Chris

Emails are going to spam

The following is based off of the IP I see in your logs as the mail sending IP of 67.55.9.182.

You have a PTR entry, which is good.

;; ANSWER SECTION:
182.9.55.67.in-addr.arpa. 14400 IN      PTR     dsl-67-55-9-182.acanac.net.

However your forward and reverse should match ideally. The reverse entry leads me to believe that you are running this off of a DSL ISP connection. That is enough to get your mail marked as spam in some systems. They do not like seeing mail coming from "home" or "consumer" connections.

Your IP is also listed in several blacklists:

67.55.9.182 is listed in dnsbl-3.uceprotect.net 
67.55.9.182 is listed in bl.spamcannibal.org

This will also result in your mail being sent to the spam bin.

Resolve the above issues and you will likely see your mail being accepted as ham. Hope that helps and let me know if you have any questions.

>

Best Answer

Related Solutions

All the emails to Yahoo!, Hotmail and AOL are going to Spam, though I’ve implemented every validation method (works for Gmail though)

Emails are going to spam

Related Topic