It looks like only this one user has this "517 Syntax error." When I tetheral the connection, it looks like the *browser* is sending it in the POST, right? (10.111.1.47 is the Courier server)...
You misread this packet. The "517 Syntax error." appears in the Referer: header.
This is a POST submitting a message that was just rejected.
The â517 Syntax error.â was previously captured as the error message from sendit.sh, when the submitted message got rejected. The original message was submitted by a POST, it got fed to sendit.sh. The message got rejected with this error message. sqwebmail captures that error message, then issues an HTTP redirect to a screen that redisplays the unsent message. The error message, verbatim, is included as a parameter in the redirect URL. When the unsent message is redisplayed the error message is fished out and shown on the screen with it.
Then you tried to submit the message again, via another POST. The previous URL, that came back from sqwebmail, was the redirected GET that included the previous error message. Which got stuck into the Referer: header.
pgp00000.pgp
Description: PGP signature
