One particular users emails on custom Google Apps domain keep going to junk - other users don't?

Question

I use Google Apps email for email hosting of a few email accounts across one domain.

Recently I've been told that one particular account email has ended up in al lot of 3rd parties junk mailboxes, this same email account's emails also seem to be going to junk even when sending to other users on the same domain.

I can tell from the other accounts that I manage, that their is no junk mail filtering in the email client, so it must be happening on the Google Apps servers. What is strange also is that some of the accounts on the same domain and some of the 3rd party accounts that have reported emails from this user going to junk are emails that this user has been communicating with for 2 year+ without issues.

Any idea why this would be and what can be done to correct it ?

As an email client we use Mac mail on OSX 10.13.x

Answer 1

Two useful tools for analyzing email deliverability problems are:

• MXToolbox Email Deliverability - a general email verification tool
• DNSlytics email-test - DNS test tool

In this post, the MXToolbox site returned the status of "SORBS SPAM". This means that the IP address of the sender is black-listed on the Spam and Open Relay Blocking System (SORBS).

SORBS automatic Escalated listings mechanism is hotly contested by its victims (example).
Wikipedia SORBS False positives recommends:

Due to the automation of spamtraps SORBS regularly lists the addresses of legitimate mail servers. Therefore, SORBS should not be configured as a single blocking test in a spam filter, but in combination with other spam indicators.

So it seems that some of the email recipients do unfortunately use SORBS as a single blocking test and do not try to corroborate it with other mechanisms.

The affected client could try to get in touch with SORBS support, link available from their webpage, and ask to be removed from the black-list. However, as this is an international volunteer organization, it has no real accountability.

Perhaps the simplest solution would be for the client to change his IP address, after verifying that no spam or other attacks do originate from his computer(s).

Changing the IP address is done by:

• If the ISP maintains a rotating pool of IPv4 addresses, disconnecting from the ISP for the night should be enough (as by turning off the ISP's router/modem).

• If the IP address is fixed, the ISP should be asked for a change. In some cases this might also involve the replacement of the modem.