Emails being sent by Shopsite are getting flagged as SPAM

[Rgkopchak]

Hello, I've recently run into an issue where our emails that are being sent by shopsite after an order is completed are increasingly being flagged as SPAM. After working extensively with our hosting provider, we learned the following. I was hoping you might have some insight on whether we've got something set incorrectly, or if there are any other steps we might take to combat this issue.

I know we have investigated the domain itself for DNS issues sending email but what appears to the be issue here is that your application is using sendmail to send the messages.

I took a look and in the file "/cgi-bin/ss/store/SHOPSITESTORENAME.aa" it lists "sendmail_loc: /usr/lib/sendmail".

When you send email using sendmail directly from the server not via SMTP using an email account on the domain the message will come from the hostname of the server "MYSERVER.net" which actually does have it's own SPF and DKIM but if your application is not signing the messages then having the DKIM DNS record in place does not help.

The issue with sendmail is that due to the ever increasing scanning being done to combat SPAM many major mail providers will now flag message as SPAM if they do not pass, rDNS, SPF and DKIM checks.

A solution would be to have your application either use SMTP to send by logging in as an actual email account on the server or possible having the application sign the messages using the private DKIM key for "MYSERVER.net".

[loren_d_c]

ShopSite can send via an SMTP server, but doesn't currently support any of the various kinds of SMTP authentication (login), so your host would have to have an internal SMTP server to use for this purpose that doesn't require authentication and/or an SMTP server that can be configured to allow relay of a non-authenticated email from your specific webserver's IP address (or localhost, if the SMTP server is running on the same machine as the webserver).

To configure an SMTP server instead of the sendmail binary in ShopSite you would just comment out the sendmail_loc line in the "/cgi-bin/ss/store/SHOPSITESTORENAME.aa" file and add a new line in the following format:

smtp_host: [ip_or_hostname_of_smtp_server]:[optional_port_number_if_other_than_usual_port_25]

Note that if the SMTP server is on the same server as your website, then you would want to make sure to use 'localhost' or the IP '127.0.0.1' to make sure it goes through the local IP address, since it should be easier to configure the SMTP server to allow email coming through that IP to relay without authentication.

-Loren

[Rgkopchak]

Thanks Loren, I will reach out to our hosting provider about these changes.

[Rgkopchak]

Here is what I got back from them. I'm no expert in servers sending email... please let me know if you think there might be an alternative option:

Actually that would we be worse as it would appear to come from an open SMTP relay and still not have the appropriate DKIM signing needed for many mail providers to consider the messages as not SPAM.

I never really had to say much more than "use SMTP to send from the domain" in the past as customers generally can implement that with PHP using something like PHPMailer or even "PEAR mail" which are ways PHP can send email via SMTP with authentication.

But I did go the extra mile for you and look into other options to possibly "make it work" with sendmail but the actual sendmail MTA is not used or compatible with cPanel which runs the Exim MTA (SMTP server). It does provide a command line interface because many applications assume a binary named sendmail exists so Exim supplies /usr/sbin/sendmail which is not the same thing as having the sendmail MTA.

I even went so far as to see what would happen it were installed and got to this:

"Error: exim conflicts with sendmail-8.14.7-5.el7.x86_64"

...so trying to install and use the actual sendmail MTA is not a viable option in this case.

As it is the 2 methods you have available for sending from the server directly are essentially depreciated and as you have seen will get your IP blacklisted with the messages being considered SPAM by most filters especially the ones in use by major mail providers due to the many measures in place to combat SPAM.

Maybe suggest to the vendor they update their code to include this functionality which is very common in modern PHP applications as it would surely be beneficial to them as well.