Skip to main content

Help Mail appeared to be spam or forged

A friend is trying to send e-mails to my mailbox.org address, but I never receive them. This is the error message she receives:

Remote host said: 550 : Recipient address rejected: Mail appeared to be SPAM or forged. Ask your Mail/DNS-Administrator to correct HELO and DNS MX settings or to get rmoved from DNSBLs;

The issue lies with the configuration of the mail server trying to deliver to us. We check the mail server’s DNS name via its IP address. If this doesn’t match the name that the mail server uses to identify itself to us (HELO), we reject the e-mail. The reason for this is that this type of behavior (mismatched DNS and HELO names) is often displayed by servers that send spam.

According to RFC 2821, HELO is intended to identify the client, which means it ‘should’ correspond to the reverse lookup name (name = IP -> IP = name); in this case, that would have been mail.mustermann.de. In situations where the client cannot issue a meaningful HELO due to dynamic IPs, RFC 2821 recommends stating the IP address in the HELO.

Instead, the client in question is probably simply stating the sender domain rather than its own host name. While this isn’t prohibited as such, it definitely isn’t best-practice, and it doesn’t at all comply with the SHOULD guidelines stipulated by RFC 2821.