If the message is sent with SMTP, it will have headers. However, if someone just forwarded you the message, the headers would be lost. Have that person drag the message envelope icon into the body of a new message; that will preserve the headers.
Ed Crowley MCSE+Internet MVP Freelance E-Mail Philosopher Protecting the world from PSTs and Bricked Backups!T -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mayo, Bill Sent: Thursday, September 22, 2005 6:38 AM To: Exchange Discussions Subject: RE: Track source of internal message I did not personally receive a message (only got forwards), which I used to find the messages in Message Tracker. Message tracker showed no outside information, so I *assumed* that meant it came from the inside. I have managed to get the message header from one and it shows that it came from an outside source (cable modem type address). I will admit to being confused why message tracker doesn't show this, but feel pretty dumb for not checking the message header before emailing the list. I did have one user tell me they got an identical message through an account they have with a different agency, so it looks like this must be just a new virus hitting. I have setup a rule to trap the messages at our perimeter and have already had some trapped there. Thanks to all for the quick help! Bill Mayo -----original message----- Look at the headers of the received messages and/or the SMTP protocol logs. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with.
