I've been trying to follow along; maybe this isn't the same thing I was referring to.
Help me out here: when mail from outside (like this one) hits your org, what path does it follow? ----- Original Message ----- From: "Ken Cornetet" <[EMAIL PROTECTED]> To: "Exchange Discussions" <[EMAIL PROTECTED]> Sent: Tuesday, November 19, 2002 9:19 AM Subject: RE: Weird SMTP header problem > But it happens with external mail as well. > > Our test systems have never shown this symptom. > > Our production E2K system never started doing this until last week (we can't > think of anything that's changed on any of the Exchange servers). It's been > running for a couple of months now. > > Like I've said earlier, this behavior stopped after rebooting the E2K > mailbox server, but now it's back! > > > -----Original Message----- > From: Daniel Chenault [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, November 19, 2002 9:28 AM > To: Exchange Discussions > Subject: RE: Weird SMTP header problem > > > I recall reporting this and escalating it when I still worked there. Was > told it's by design when SMTP mail is transferred within an organization. > > -----Original Message----- > From: Ken Cornetet [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, November 19, 2002 8:20 AM > To: Exchange Discussions > Subject: RE: Weird SMTP header problem > > > To summarize my problem, my E2K mailbox server is stripping SMTP "Received:" > headers, and "making up" it's own. Last week when this happened, a reboot > cleared up the problem, but it came back (not been able to reboot again, > yet). > > Ed, is this proof enough? > > I've managed to distill the problem down to a simple set of steps. > > 1. Send email from my PC to the MSX 5.5 IMS server using blat. Here's the > output: > Failed to open registry key for Blat profile , using default. Failed to open > registry key for Blat Sending x.kix to [EMAIL PROTECTED] Login name is > [EMAIL PROTECTED] <<<getline<<< 220 nts126.kimball.com ESMTP Server > (Microsoft Exchange Internet Mail Service 5.5.2652.78) ready > >>>putline>>> EHLO 051kcornet > <<<getline<<< 250-nts126.kimball.com Hello [051KCORNET] 250-XEXCH50 250-HELP > 250-ETRN 250-DSN 250-SIZE 0 250-AUTH LOGIN 250 AUTH=LOGIN > >>>putline>>> MAIL From:<[EMAIL PROTECTED]> > <<<getline<<< 250 OK - mail from <[EMAIL PROTECTED]> > >>>putline>>> RCPT To: <[EMAIL PROTECTED]> > <<<getline<<< 250 OK - Recipient <[EMAIL PROTECTED]> > >>>putline>>> DATA > <<<getline<<< 354 Send data. End with CRLF.CRLF > <<<getline<<< 250 OK > >>>putline>>> QUIT > <<<getline<<< 221 closing connection > > 2. Here's NTS126's log entries from above message > > c=us;a= ;p=kii;l=NTS1260211191352XC17P83W 1012 2002.11.19 13:52:20 > /o=KII/ou=Jasper001/cn=Configuration/cn=Connections/cn=Internet Mail > Connector (NTS126) > /o=KII/ou=Jasper001/cn=Configuration/cn=Connections/cn=Internet Mail > Connector (NTS126) XC17P83W [EMAIL PROTECTED] 0 1555 > 0 0 1 > c=us;a= ;p=kii;l=NTS1260211191352XC17P83W 1013 2002.11.19 13:52:20 > /o=KII/ou=Jasper001/cn=Configuration/cn=Connections/cn=Internet Mail > Connector (NTS126) > /o=KII/ou=Jasper001/cn=Configuration/cn=Servers/cn=NTS126/cn=Microsoft > Private MDB <[EMAIL PROTECTED]> > [EMAIL PROTECTED] 0 1555 0 0 1 > C=us;A= ;P=kii;L=NTS1260211191352XC17P83W 0 2002.11.19 13:52:21 > /O=KII/OU=JASPER001/CN=CONFIGURATION/CN=CONNECTIONS/CN=INTERNET MAIL > CONNECTOR (NTS126) C=US;A= > ;P=KII;O=Jasper001;DDA:SMTP=fubar(a)kimball.com; 0 2159 0 > 0 1 > C=us;A= ;P=kii;L=NTS1260211191352XC17P83W 7 2002.11.19 13:52:21 > /O=KII/OU=JASPER001/CN=CONFIGURATION/CN=SERVERS/CN=NTS390/CN=MICROSOFT MTA > C=US;A= ;P=KII;O=Jasper001;DDA:SMTP=fubar(a)kimball.com; 0 2159 > 0 0 1 > > The most pertinent part of the logs is the event IDs: 1012 - SMTP received, > 1013 - SMTP transferred inbound, 0 - Message transferred in, and 7 - message > transferred out. Notice there is no 1010 or 1011 (outbound SMTP) > > Next, here's the tracking.log entries from the E2K mailbox server > > 11/19/2002 13:52:26 GMT - - - NTS390 - > /O=KII/OU=JASPER001/CN=RECIPIENTS/CN=Kcornet 1027 > [EMAIL PROTECTED] 0 0 > 1354 1 2002-11-19 13:52:26 GMT 0 - c=us;a= > ;p=kii;l=NTS1260211191352XC17P83W Contents of file: x.kix > [EMAIL PROTECTED] - > 11/19/2002 13:52:26 GMT - - - NTS390 - > /O=KII/OU=JASPER001/CN=RECIPIENTS/CN=Kcornet 1019 > [EMAIL PROTECTED] 0 0 > 1354 1 2002-11-19 13:52:26 GMT 0 - - Contents of > file: x.kix [EMAIL PROTECTED] - > 11/19/2002 13:52:26 GMT - - - NTS390 - > /O=KII/OU=JASPER001/CN=RECIPIENTS/CN=Kcornet 1025 > [EMAIL PROTECTED] 0 0 > 1354 1 2002-11-19 13:52:26 GMT 0 - - Contents of > file: x.kix [EMAIL PROTECTED] - > 11/19/2002 13:52:26 GMT - - - NTS390 - > /O=KII/OU=JASPER001/CN=RECIPIENTS/CN=Kcornet 1024 > [EMAIL PROTECTED] 0 0 > 1354 1 2002-11-19 13:52:26 GMT 0 - - Contents of > file: x.kix [EMAIL PROTECTED] - > 11/19/2002 13:52:26 GMT - - - NTS390 - > [EMAIL PROTECTED] 1023 > [EMAIL PROTECTED] 0 0 > 1354 1 2002-11-19 13:52:26 GMT 0 - - Contents of > file: x.kix [EMAIL PROTECTED] - > 11/19/2002 13:52:26 GMT - - - NTS390 - > [EMAIL PROTECTED] 1028 > [EMAIL PROTECTED] 0 0 > 1354 1 2002-11-19 13:52:26 GMT 0 - - Contents of > file: x.kix [EMAIL PROTECTED] - > > Lastly, here's what I see from outlook 2002: > > Microsoft Mail Internet Headers Version 2.0 > Received: by nts390.kii.kimball.com > id <[EMAIL PROTECTED]>; Tue, 19 Nov 2002 > 08:51:56 -0500 > content-class: urn:content-classes:message > Subject: Contents of file: x.kix > Date: Tue, 19 Nov 2002 08:51:56 -0500 > MIME-Version: 1.0 > Content-Type: application/ms-tnef; > name="winmail.dat" > Content-Transfer-Encoding: binary > X-MS-Has-Attach: > Thread-Topic: Contents of file: x.kix > Thread-Index: AcKP0tNV5UfLpPvBEdaoJgCQJ4dN9Q== > X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 > From: <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > > > -----Original Message----- > From: Ed Crowley [mailto:[EMAIL PROTECTED]] > Sent: Monday, November 18, 2002 4:48 PM > To: Exchange Discussions > Subject: RE: Weird SMTP header problem > > > The only proof I would accept is a dump of the headers between each of the > servers in your series of a message that's mysteroiously being stripped. > > Ed Crowley MCSE+Internet MVP kcCC+I > Tech Consultant > hp Services > Protecting the world from PSTs and Bricked Backups! > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]] On Behalf Of Ken Cornetet > Sent: Monday, November 18, 2002 11:51 AM > To: Exchange Discussions > Subject: RE: Weird SMTP header problem > > > Then I'm not sure what you mean. > > The only way SMTP gets into Kimball is via the checkpoint firewall, and it > is configured to send only to nts126 (the MSX5.5 IMS server). There are no > other hosts involved. > > The checkpoint participates only at the packet level, it does no native SMTP > conversation. It neither strips, nor adds headers. > > It can't be Cleanmail because their servers wouldn't know if the email was > destined for an E2K mailbox or a MSX5.5 mailbox. > > -----Original Message----- > From: Ed Crowley [mailto:[EMAIL PROTECTED]] > Sent: Monday, November 18, 2002 2:27 PM > To: Exchange Discussions > Subject: RE: Weird SMTP header problem > > > That doesn't prove it to me. > > Ed Crowley MCSE+Internet MVP kcCC+I > Tech Consultant > hp Services > Protecting the world from PSTs and Bricked Backups! > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]] On Behalf Of Ken Cornetet > Sent: Monday, November 18, 2002 11:20 AM > To: Exchange Discussions > Subject: RE: Weird SMTP header problem > > > No. > > 1. People who's mailboxes are still on MSX 5.5 servers do not see the > problem. > > 2. A reboot of the E2K mailbox server clears the problem up (at least for a > while). > > -----Original Message----- > From: Ed Crowley [mailto:[EMAIL PROTECTED]] > Sent: Monday, November 18, 2002 12:25 PM > To: Exchange Discussions > Subject: RE: Weird SMTP header problem > > > I suspect this is a feature of one of your hosts outside Exchange. > > Ed Crowley MCSE+Internet MVP kcCC+I > Tech Consultant > hp Services > Protecting the world from PSTs and Bricked Backups! > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]] On Behalf Of Ken Cornetet > Sent: Monday, November 18, 2002 7:24 AM > To: Exchange Discussions > Subject: Weird SMTP header problem > > > Our E2K mailbox servers have recently developed a bad habit... > > Many people here (myself included) create Outlook rules to move their > Internet email into a separate folder based on the SMTP headers. A couple of > days ago this stopped working. An quick examination of an incoming Internet > email's headers showed that most all of the header information was gone, and > what was there is strange. > > Our email flow is this: > > 1. Internet to Cleanmail (floyd.cinergycom.net) (for virus scrubbing) 2. > Cleanmail to our checkpoint firewall (kimbintinc-cp.kimball.com) 3. > Checkpoint to nts126 (a NT4/MSX5.5 IMS connector) 4. nts126 to nts390 (E2K > mailbox) via MTA > > Normally, Internet email "Received:" headers look like this (edited for > brevity): > > Received: from kimbintinc-cp.kimball.com (igate.kimball.com > [167.178.249.18]) by nts126.kimball.com ... > Received: (6577 bytes) by floyd.cinergycom.net > Received: by cleanmail.com ... > Received: from csc222.csc.dg.com(xn82.emc.com[168.159.1.82]) (6103 > bytes) by floyd.cinergycom.net > > Notice that nts390 is NOT listed in the headers, since nts126 (an MSX5.5 IMS > server) sends email to nts390 (E2K mailbox server) via MTA, not SMTP. > > However, recently, This is what I see when looking at headers: > > Microsoft Mail Internet Headers Version 2.0 > Received: by nts390.kii.kimball.com > id <[EMAIL PROTECTED]>; Mon, 18 Nov 2002 > 09:03:08 -0500 > > There are several things wrong with this picture: > > 1. All of the preceding (timewise) "Received:" headers are gone. > 2. Internet mail cannot be going directly to nts390, it must be going > through nts126 > 3. The one "Received:" header does not show who the message was received > from. > > A reboot of the E2K mailbox server fixes the problem for a while, then it > mysteriously comes back. > > Any ideas? > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
