I've never seen a problem with SFDC before but this one is consistently happening to a specific sender trying to get email to one of my clients.  They are sending legitimate emails from their blackberry and the SFDC filter is blocking them every time.  It seems that the sophistication of the SFDC filter really ought to keep this from happening... but in reading it through it sounds like if this user has keywords or something in their signature that are getting blocked and then the hash is matching because he's sending through different blackberry servers... maybe that could be triggering it?

I'm not sure what I'm asking exactly, but just wondering if you've encountered issues with legit email coming from blackberry before. 

In addition, the "sender" of the email is always a really long string like this:

SRS0=imIkUf=5T=domain.com=username@srs.bis.na.blackberry.com

And its always different, so my client is unable to auto-whitelist this user.  I have had to turn off SFDC until I can understand better how to whitelist this user.

I won't be able to do that.  I had to just switch of SFDC for this domain.  The user sending email was more than upset and I can't really go back to them at this time.  Oh well.  If something else comes up that I can send you, I will try and do it.  Was mainly hoping you had seen this issue before.

hookjd,

All the 5 email samples you forwarded us are "delivery receipts" sent to indicate that a message has been delivered. All their content is very similar, and since the SFDC filter is based on a common "hash" of similar messages, all these messages are being stopped at the same time.

They all look like:

Your message was delivered to the recipient.Original-Message-ID:1654183298
Final-Recipient:user@some_domain.com
Action:Delivered


Unfortunately this hash is very similar to one for a specific spam that is currently being sent, so it is being incorrectly blocked. The message however also appears to be barely surpassing a threshold we use to *not* block small emails, as the smaller the email the more likely it is to make mistakes in comparing similar contents. Please allow us a couple of days to better analyze this specific type of emails to see if there's anything we can do to prevent them from being stopped in the future.

If you'd like to send us more samples I'll be glad to double-check for you. All the ones you sent are indeed all 5 delivery receipts. I'm forwarding them to you via email in an .eml format, so you may use Outlook Express or Thunderbird to view them in a more user-friendly format for you to verify.
What triggers the SFDC filter in this case is the content of the email ("Your message was delivered to the recipient.").

We're trying to determine if the MIME boundary and the content type "delivery-status":

--part145653-boundary-1504910472-1556113981
Content-Type: message/delivery-status

Original-Message-ID:1654183298


are playing a part in this as well. We should find out more within a few hours.

We've made some slight changes to the SFDC database to remove entries that are older than 3 days even in cases where emails with similar signatures are still being received, in the hope that this will remove some false positives.

mike,