That does indeed match the description of the escalation I mentioned earlier. Except for the all-of-a-sudden-without-warning bit. The reboot especially throws a fly in the ointment. This is one for PSS.
-----Original Message----- From: Ken Cornetet [mailto:[EMAIL PROTECTED]] Sent: Wednesday, November 20, 2002 8:50 AM To: Exchange Discussions Subject: RE: Weird SMTP header problem Briefly: We are in the process of migrating from MSX5.5 to E2K. All user mailboxes are on E2K servers, but we are still using our 5.5 IMS server for Internet email. For a couple of months, all was well. Internet mail made it to Outlook with all "Received" headers intact. Starting last week, however, Internet email started showing up in Outlook with all the "Received" headers stripped, and a bogus "Received" header inserted by the E2K mailbox server. A reboot of the E2K mailbox servers (both are showing the same symptom!) last week fixed the problem, but then it came back. Our email flow is: 1. kimball.com MX record points to servers at Cleanmail. 2. Cleanmail inserts it's SMTP headers and forwards to the IP address of our CheckPoint firewall. 3. The CheckPoint does packet forwarding (it does not get involved in the SMTP conversation) to our MSX 5.5 IMS server. 4. The 5.5 IMS server then sends to the E2K mailbox servers via MTA I have created a simplified scenario to prove to myself (and Ed ...) that the problem is within the Exchange system. I can use Blat to send an email to the 5.5 IMS server (with debug on to verify that I really am talking to the IMS server) and see the same behavior (no "Received" header by the IMS server). I have verified via the tracking logs that my Blat message went to the 5.5 IMS server via SMTP, and then to the E2K mailbox server via MTA. Now adding more to this bizarre problem, I just changed a unix box to smart-host to our E2K mailbox server, and used the unix box as a relay from blat, and all the headers showed up! The "fix" appears to just hurry up and retire our 5.5 IMS server! I don't like not knowing why we are having this problem, however... -----Original Message----- From: Daniel Chenault [mailto:[EMAIL PROTECTED]] Sent: Tuesday, November 19, 2002 7:04 PM To: Exchange Discussions Subject: Re: Weird SMTP header problem I've been trying to follow along; maybe this isn't the same thing I was referring to. Help me out here: when mail from outside (like this one) hits your org, what path does it follow? ----- Original Message ----- From: "Ken Cornetet" <[EMAIL PROTECTED]> To: "Exchange Discussions" <[EMAIL PROTECTED]> Sent: Tuesday, November 19, 2002 9:19 AM Subject: RE: Weird SMTP header problem > But it happens with external mail as well. > > Our test systems have never shown this symptom. > > Our production E2K system never started doing this until last week (we can't > think of anything that's changed on any of the Exchange servers). It's been > running for a couple of months now. > > Like I've said earlier, this behavior stopped after rebooting the E2K > mailbox server, but now it's back! > > > -----Original Message----- > From: Daniel Chenault [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, November 19, 2002 9:28 AM > To: Exchange Discussions > Subject: RE: Weird SMTP header problem > > > I recall reporting this and escalating it when I still worked there. > Was told it's by design when SMTP mail is transferred within an > organization. > > -----Original Message----- > From: Ken Cornetet [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, November 19, 2002 8:20 AM > To: Exchange Discussions > Subject: RE: Weird SMTP header problem > > > To summarize my problem, my E2K mailbox server is stripping SMTP "Received:" > headers, and "making up" it's own. Last week when this happened, a > reboot cleared up the problem, but it came back (not been able to > reboot again, yet). > > Ed, is this proof enough? > > I've managed to distill the problem down to a simple set of steps. > > 1. Send email from my PC to the MSX 5.5 IMS server using blat. Here's > the > output: > Failed to open registry key for Blat profile , using default. Failed to open > registry key for Blat Sending x.kix to [EMAIL PROTECTED] Login name > is [EMAIL PROTECTED] <<<getline<<< 220 nts126.kimball.com ESMTP Server > (Microsoft Exchange Internet Mail Service 5.5.2652.78) ready > >>>putline>>> EHLO 051kcornet > <<<getline<<< 250-nts126.kimball.com Hello [051KCORNET] 250-XEXCH50 250-HELP > 250-ETRN 250-DSN 250-SIZE 0 250-AUTH LOGIN 250 AUTH=LOGIN > >>>putline>>> MAIL From:<[EMAIL PROTECTED]> > <<<getline<<< 250 OK - mail from <[EMAIL PROTECTED]> > >>>putline>>> RCPT To: <[EMAIL PROTECTED]> > <<<getline<<< 250 OK - Recipient <[EMAIL PROTECTED]> > >>>putline>>> DATA > <<<getline<<< 354 Send data. End with CRLF.CRLF <<<getline<<< 250 OK > >>>putline>>> QUIT > <<<getline<<< 221 closing connection > > 2. Here's NTS126's log entries from above message > > c=us;a= ;p=kii;l=NTS1260211191352XC17P83W 1012 2002.11.19 13:52:20 > /o=KII/ou=Jasper001/cn=Configuration/cn=Connections/cn=Internet Mail > Connector (NTS126) > /o=KII/ou=Jasper001/cn=Configuration/cn=Connections/cn=Internet Mail > Connector (NTS126) XC17P83W [EMAIL PROTECTED] 0 1555 0 0 1 > c=us;a= ;p=kii;l=NTS1260211191352XC17P83W 1013 2002.11.19 13:52:20 > /o=KII/ou=Jasper001/cn=Configuration/cn=Connections/cn=Internet Mail > Connector (NTS126) > /o=KII/ou=Jasper001/cn=Configuration/cn=Servers/cn=NTS126/cn=Microsoft > Private MDB <[EMAIL PROTECTED]> > [EMAIL PROTECTED] 0 1555 0 0 1 > C=us;A= ;P=kii;L=NTS1260211191352XC17P83W 0 2002.11.19 13:52:21 > /O=KII/OU=JASPER001/CN=CONFIGURATION/CN=CONNECTIONS/CN=INTERNET MAIL > CONNECTOR (NTS126) C=US;A= > ;P=KII;O=Jasper001;DDA:SMTP=fubar(a)kimball.com; 0 2159 0 > 0 1 > C=us;A= ;P=kii;L=NTS1260211191352XC17P83W 7 2002.11.19 13:52:21 > /O=KII/OU=JASPER001/CN=CONFIGURATION/CN=SERVERS/CN=NTS390/CN=MICROSOFT MTA > C=US;A= ;P=KII;O=Jasper001;DDA:SMTP=fubar(a)kimball.com; 0 2159 > 0 0 1 > > The most pertinent part of the logs is the event IDs: 1012 - SMTP received, > 1013 - SMTP transferred inbound, 0 - Message transferred in, and 7 - message > transferred out. Notice there is no 1010 or 1011 (outbound SMTP) > > Next, here's the tracking.log entries from the E2K mailbox server > > 11/19/2002 13:52:26 GMT - - - NTS390 - > /O=KII/OU=JASPER001/CN=RECIPIENTS/CN=Kcornet 1027 > [EMAIL PROTECTED] 0 0 1354 1 > 2002-11-19 13:52:26 GMT 0 - c=us;a= ;p=kii;l=NTS1260211191352XC17P83W > Contents of file: x.kix [EMAIL PROTECTED] - > 11/19/2002 13:52:26 GMT - - - NTS390 - > /O=KII/OU=JASPER001/CN=RECIPIENTS/CN=Kcornet 1019 > [EMAIL PROTECTED] 0 0 > 1354 1 2002-11-19 13:52:26 GMT 0 - - Contents of > file: x.kix [EMAIL PROTECTED] - > 11/19/2002 13:52:26 GMT - - - NTS390 - > /O=KII/OU=JASPER001/CN=RECIPIENTS/CN=Kcornet 1025 > [EMAIL PROTECTED] 0 0 > 1354 1 2002-11-19 13:52:26 GMT 0 - - Contents of > file: x.kix [EMAIL PROTECTED] - > 11/19/2002 13:52:26 GMT - - - NTS390 - > /O=KII/OU=JASPER001/CN=RECIPIENTS/CN=Kcornet 1024 > [EMAIL PROTECTED] 0 0 > 1354 1 2002-11-19 13:52:26 GMT 0 - - Contents of > file: x.kix [EMAIL PROTECTED] - > 11/19/2002 13:52:26 GMT - - - NTS390 - > [EMAIL PROTECTED] 1023 > [EMAIL PROTECTED] 0 0 > 1354 1 2002-11-19 13:52:26 GMT 0 - - Contents of > file: x.kix [EMAIL PROTECTED] - > 11/19/2002 13:52:26 GMT - - - NTS390 - > [EMAIL PROTECTED] 1028 > [EMAIL PROTECTED] 0 0 > 1354 1 2002-11-19 13:52:26 GMT 0 - - Contents of > file: x.kix [EMAIL PROTECTED] - > > Lastly, here's what I see from outlook 2002: > > Microsoft Mail Internet Headers Version 2.0 > Received: by nts390.kii.kimball.com > id <[EMAIL PROTECTED]>; Tue, 19 Nov 2002 > 08:51:56 -0500 > content-class: urn:content-classes:message > Subject: Contents of file: x.kix > Date: Tue, 19 Nov 2002 08:51:56 -0500 > MIME-Version: 1.0 > Content-Type: application/ms-tnef; > name="winmail.dat" > Content-Transfer-Encoding: binary > X-MS-Has-Attach: > Thread-Topic: Contents of file: x.kix > Thread-Index: AcKP0tNV5UfLpPvBEdaoJgCQJ4dN9Q== > X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 > From: <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > > > -----Original Message----- > From: Ed Crowley [mailto:[EMAIL PROTECTED]] > Sent: Monday, November 18, 2002 4:48 PM > To: Exchange Discussions > Subject: RE: Weird SMTP header problem > > > The only proof I would accept is a dump of the headers between each of > the servers in your series of a message that's mysteroiously being > stripped. > > Ed Crowley MCSE+Internet MVP kcCC+I > Tech Consultant > hp Services > Protecting the world from PSTs and Bricked Backups! > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]] On Behalf Of Ken Cornetet > Sent: Monday, November 18, 2002 11:51 AM > To: Exchange Discussions > Subject: RE: Weird SMTP header problem > > > Then I'm not sure what you mean. > > The only way SMTP gets into Kimball is via the checkpoint firewall, > and it is configured to send only to nts126 (the MSX5.5 IMS server). > There are no other hosts involved. > > The checkpoint participates only at the packet level, it does no > native SMTP > conversation. It neither strips, nor adds headers. > > It can't be Cleanmail because their servers wouldn't know if the email > was destined for an E2K mailbox or a MSX5.5 mailbox. > > -----Original Message----- > From: Ed Crowley [mailto:[EMAIL PROTECTED]] > Sent: Monday, November 18, 2002 2:27 PM > To: Exchange Discussions > Subject: RE: Weird SMTP header problem > > > That doesn't prove it to me. > > Ed Crowley MCSE+Internet MVP kcCC+I > Tech Consultant > hp Services > Protecting the world from PSTs and Bricked Backups! > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]] On Behalf Of Ken Cornetet > Sent: Monday, November 18, 2002 11:20 AM > To: Exchange Discussions > Subject: RE: Weird SMTP header problem > > > No. > > 1. People who's mailboxes are still on MSX 5.5 servers do not see the > problem. > > 2. A reboot of the E2K mailbox server clears the problem up (at least > for a > while). > > -----Original Message----- > From: Ed Crowley [mailto:[EMAIL PROTECTED]] > Sent: Monday, November 18, 2002 12:25 PM > To: Exchange Discussions > Subject: RE: Weird SMTP header problem > > > I suspect this is a feature of one of your hosts outside Exchange. > > Ed Crowley MCSE+Internet MVP kcCC+I > Tech Consultant > hp Services > Protecting the world from PSTs and Bricked Backups! > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]] On Behalf Of Ken Cornetet > Sent: Monday, November 18, 2002 7:24 AM > To: Exchange Discussions > Subject: Weird SMTP header problem > > > Our E2K mailbox servers have recently developed a bad habit... > > Many people here (myself included) create Outlook rules to move their > Internet email into a separate folder based on the SMTP headers. A > couple of > days ago this stopped working. An quick examination of an incoming Internet > email's headers showed that most all of the header information was > gone, and > what was there is strange. > > Our email flow is this: > > 1. Internet to Cleanmail (floyd.cinergycom.net) (for virus scrubbing) > 2. Cleanmail to our checkpoint firewall (kimbintinc-cp.kimball.com) 3. > Checkpoint to nts126 (a NT4/MSX5.5 IMS connector) 4. nts126 to nts390 > (E2K > mailbox) via MTA > > Normally, Internet email "Received:" headers look like this (edited > for > brevity): > > Received: from kimbintinc-cp.kimball.com (igate.kimball.com > [167.178.249.18]) by nts126.kimball.com ... > Received: (6577 bytes) by floyd.cinergycom.net > Received: by cleanmail.com ... > Received: from csc222.csc.dg.com(xn82.emc.com[168.159.1.82]) (6103 > bytes) by floyd.cinergycom.net > > Notice that nts390 is NOT listed in the headers, since nts126 (an > MSX5.5 IMS > server) sends email to nts390 (E2K mailbox server) via MTA, not SMTP. > > However, recently, This is what I see when looking at headers: > > Microsoft Mail Internet Headers Version 2.0 > Received: by nts390.kii.kimball.com > id <[EMAIL PROTECTED]>; Mon, 18 Nov 2002 > 09:03:08 -0500 > > There are several things wrong with this picture: > > 1. All of the preceding (timewise) "Received:" headers are gone. 2. > Internet mail cannot be going directly to nts390, it must be going > through nts126 3. The one "Received:" header does not show who the > message was received from. > > A reboot of the E2K mailbox server fixes the problem for a while, then > it mysteriously comes back. > > Any ideas? > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
