Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

jimmy.puckett's avatar

Email format triggering barracuda default rules to classify email as SPAM

We have a barracuda SPAM filter and the way that you are sending/formatting the emails you are triggering 2 default rules with a big enough score that they are classifying most of the forum email as SPAM...

    1.63 HTML_IMAGE_ONLY_12     BODY: HTML: images with 800-1200 bytes of words
    ...
    1.50 MSGID_FROM_MTA_HEADER_2 Message-Id was added by a relay

The way that it works is that it adds up all of the scores & if the sum is over a threshold, then it is SPAM. You are at 3.13 with just these 2 rules, and the threshold is 2.

The first one is about the ratio of text to images, so adding more text would lower that score

The second one is a little harder, but you do not have an SPF record for laracast.com, so you should add an SPF record & be sure to add mandrill's host.

0 likes
7 replies
JeffreyWay's avatar

Hmm - That's odd; I already have an SPF record for Laracasts.

jimmy.puckett's avatar

@JefferyWay, I could be doing something wrong, but I do not see a SPF on laracast...

~ :) dig +short laracast.com TXT
~ :) dig +short github.com TXT
"v=spf1 ip4:192.30.252.0/22 include:_spf.google.com include:esp.github.com include:cmail1.com include:mail.zendesk.com include:auth.madmimi.com ~all"
~ :) 

As you can see, I get no answer for the TXT record for laracast.com, but I do get the record for github.com.

dantreacy's avatar

They always say it's rude to point out typos :) but the first one is kinda important..

laracastS.com :)

1 like
jimmy.puckett's avatar

@tenyardtech. Thanks so much! You are right, I'm and idiot...

~ :) dig +short laracasts.com TXT
"v=spf1 include:spf.mandrillapp.com ~all"
~ :) 

Still, there is a problem with the emails triggering default rules in a barracuda, and the messages are getting classified as SPAM.

jimmy.puckett's avatar

Aside from me missing typing the domain in the dig, this is still a valid issue...

This morning quarantined messages

Here is the breakdown of the scoring from the barracuda...

X-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.3.8513
 Rule breakdown below
  pts rule name description
 ---- ---------------------- --------------------------------------------------
 1.63 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words
 ...
 1.50 MSGID_FROM_MTA_HEADER_2 Message-Id was added by a relay

Please let me know if you need anything else from me to diagnose the issue. This has got to me an issue with corporate accounts as Barracuda is a major vendor in that space.

jimmy.puckett's avatar

@JefferyWay, I know that I messed up looking up the SPF record when I posted this request originally, but I am seeing the issue, as I would think that anyone behind a SPAM filter would. Here is the report from the latest email that I did not get from the site...

X-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.3.10180
 Rule breakdown below
  pts rule name description
 ---- ---------------------- --------------------------------------------------
 ...
 1.28 HTML_IMAGE_ONLY_24_2 HTML: images with 2000-2400 bytes of words
...
 1.50 MSGID_FROM_MTA_HEADER_2 Message-Id was added by a relay
 ...

If you get a chance, it would be great if there is some boilerplate text that could be added to the body of these emails with how to unsubscribe, why you got the message, etc that would increase the text.

Thanks.

bashy's avatar

That's some crazy spam filter. Why not add it to allowed/white list? No problems here.

Please or to participate in this conversation.