Blocking Spam domains not working

[jamiewood]

Me too.

[graeme57]

I agree. An example of how to do this would be much appreciated please.

[Oddbodkin]

No idea what any of this means but this is an example:

Return-Path: <msprvs1=19011BbRl4_h-=bounces-2245@s.clicplan.com>
Received: from sa-prd-rgin-004.btmx-prd.synchronoss.net ([10.2.38.12])
by sa-prd-fep-006.mx.internal with ESMTP
id <20220112161948.IAEV27678.sa-prd-fep-006.mx.internal@sa-prd-rgin-004.btmx-prd.synchronoss.net>
for <(my email address removed)>;
Wed, 12 Jan 2022 16:19:48 +0000
Authentication-Results: btinternet.com;
dmarc=pass header.from=s.clicplan.com;
dkim=pass header.i=@s.clicplan.com;
spf=none smtp.helo=mta-95-248.sparkpostmail.com;
spf=pass smtp.mailfrom=s.clicplan.com;
bimi=skipped
X-OWM-SPF-MAILFROM: Pass
X-OWM-SPF: 0
Received-SPF: none (sa-prd-rgin-004.btmx-prd.synchronoss.net: domain
mta-95-248.sparkpostmail.com does not designate permitted sender hosts)
identity=helo; receiver=sa-prd-rgin-004.btmx-prd.synchronoss.net;
client-ip=192.174.95.248; helo=mta-95-248.sparkpostmail.com;
Received-SPF: pass (sa-prd-rgin-004.btmx-prd.synchronoss.net: domain
s.clicplan.com designates 192.174.95.248 as permitted sender)
identity=mailfrom; receiver=sa-prd-rgin-004.btmx-prd.synchronoss.net;
client-ip=192.174.95.248; envelope-from=msprvs1=19011BbRl4_h-=bounces-2245@s.clicplan.com;
helo=mta-95-248.sparkpostmail.com;
X-Originating-IP: [192.174.95.248]
X-OWM-Source-IP: 192.174.95.248 (US)
X-OWM-Env-Sender: msprvs1=19011BbRl4_h-=bounces-2245@s.clicplan.com
X-SNCR-Rigid: 61B6DA0209503A61
X-OWM-DMARC: spf 0 dkim 0
X-OWM-DKIM: 1
X-VadeSecure-score: verdict=clean score=17/331, class=commercial-misc
X-SNCR-VADESECURE: CLEAN

[licquorice]

These emails are being sent by sparkpost on behalf of clicplan, both of which are legitimate companies. They are spam in as much as they are unwanted, but are legitimate marketing mails as far as I can tell.

Until very recently, I have not received any spam, but am also receiving these mails and ones from 'couponandgo' and 'oferting'.

Interestingly, I have a number of test btinternet email accounts that I don't receive the spam from which leads me to believe the addresses that are receiving the spam have been leaked.

[gg30340]

The domain showing is s.clicplan.com not clicplan.com. Try blocking the domain s.clicplan.com

[licquorice]

It is also s.couponandgo.com and s.oferting.com.

It might also be worth blocking sparkpostmail.com

[graeme57]

There's no doubt that sometimes I (we) do something unwittingly or inadvertently that leads to a problem. I bought something from the etsy website of small suppliers which meant I was suddenly getting  unwanted newsletter and bogus offer e-mails from them; pretending to be Tesco/Aldi etc. I also stupidly thought I was clicking on a Marks and Spencers Sale item when it turned out to be clicplan.  In both these examples, I took the risk of clicking the Unsubscribe button , which I know isn't always a good idea; but it seems to have stopped the e-mails from clicplan and etsy.  But somehow it did lead to me getting oferting and americanprince e-mails who I've never dealt with.  I'm beginning to think that not over-reacting to these e-mails results and just marking them as Spam and putting in Junk folder does begin to gradually lessen them; but that might be wishful thinking.....

[Oddbodkin]

@licquorice 

No, they are NOT legitimate emails, as they are both incessant, unreadable & link to sites not connected to the alleged sender.

WHY would a legitimate mailing company use spurious email addresses to avoid being blocked by spam filters?

[Oddbodkin]

@licquoriceIf you block sparkpost, you'll block something like half of all legitimate, commercial emails on the planet, so hardly a viable option.

[licquorice]

If you read what I wrote, I said clicplan and sparkpost are legitimate companies, which they are. The headers indicate that the mails are being sent by sparkpost on behalf of clicplan.

The sender's IP address belongs to sparkpost