Greetings, Our OSU State University uses Microsoft exchange servers as our main email system. Many users' email accounts are forwarding accounts, which forward emails of [email protected]<mailto:[email protected]> (i. e. [email protected]<mailto:[email protected]>) to other email systems such as gmail, yahoo, Hotmail, Buckeyemail, etc. Before these outbound emails are leaving from Ohio state university, they are scanned by our Security DLP (Data Loss Protection) servers on which MTA Postfix is running.
Here we have a question about postfix. When the message passes by Postfix, can Postfix automatically add line "Resent-From: <OSU email address>" in the header? For example: From: [email protected]<mailto:[email protected]> To: [email protected]<mailto:[email protected]> (which is forwarded to [email protected]<mailto:[email protected]>) The message is sent from [email protected]<mailto:[email protected]> to [email protected]<mailto:[email protected]>. The Microsoft exchange HUB server receives the message, checks AD (Active Directory) server and see this account [email protected] is forwarding account to [email protected]<mailto:[email protected]>, the HUB server delivers the message for [email protected]<mailto:[email protected]> to Security DLP (Data Loss Protection) server. After scanning, DLP (Data Loss Protection) server delivers this outbound email to next hop. On DLP server, Postfix is running. Can it automatically identify the address [email protected] in "To:" field and add the line "Resent-From: <[email protected]>" in the header before the message is handed over to next hop? If yes, further ask: Can Postfix identify the "from address or envelope-from address" is non-OSU.EDU address or non-OHIO-STATE.EDU address (i. e. [email protected]), then take action to pick up "to address" (i.e. [email protected]<mailto:[email protected]>), add the line "Resent-From: to address" (i. e. Resent-From: [email protected]<mailto:[email protected]>) into header of message? Here is the header of test message for the reference: Received: from BN1PR01MB135.prod.exchangelabs.com (10.242.217.24) by BY2PR01MB139.prod.exchangelabs.com (10.242.233.152) with Microsoft SMTP Server (TLS) id 15.0.990.7 via Mailbox Transport; Thu, 24 Jul 2014 13:56:34 +0000 Received: from BL2PR01CA0022.prod.exchangelabs.com (10.141.66.22) by BN1PR01MB135.prod.exchangelabs.com (10.242.217.24) with Microsoft SMTP Server (TLS) id 15.0.990.7; Thu, 24 Jul 2014 13:56:33 +0000 Received: from BN1BFFO11FD029.protection.gbl (2a01:111:f400:7c10::1:190) by BL2PR01CA0022.outlook.office365.com (2a01:111:e400:c1b::22) with Microsoft SMTP Server (TLS) id 15.0.995.14 via Frontend Transport; Thu, 24 Jul 2014 13:56:33 +0000 Received: from na01-by2-obe.outbound.protection.outlook.com (207.46.163.243) by BN1BFFO11FD029.mail.protection.outlook.com (10.58.144.92) with Microsoft SMTP Server (TLS) id 15.0.980.11 via Frontend Transport; Thu, 24 Jul 2014 13:56:32 +0000 Received: from BN1AFFO11FD022.protection.gbl (10.58.52.33) by BN1AFFO11HUB033.protection.gbl (10.58.52.144) with Microsoft SMTP Server (TLS) id 15.0.980.11; Thu, 24 Jul 2014 13:56:30 +0000 Received: from cio-tnc-pf04.osuad.osu.edu (164.107.81.218) by BN1AFFO11FD022.mail.protection.outlook.com (10.58.52.82) with Microsoft SMTP Server (TLS) id 15.0.980.11 via Frontend Transport; Thu, 24 Jul 2014 13:56:30 +0000 Received: from CIO-KRC-HT01.osuad.osu.edu (cio-krc-ht01.osuad.osu.edu [164.107.81.37]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by cio-tnc-pf04.osuad.osu.edu (Postfix) with ESMTPS id BD29938005A for <[email protected]>; Thu, 24 Jul 2014 09:56:29 -0400 (EDT) Resent-From: <[email protected]> <mailto:[email protected]%3e%20> (which is the line we want Postfix to add) Received: from na01-by2-obe.outbound.protection.outlook.com (207.46.163.243) by CIO-KRC-HT01.osuad.osu.edu (164.107.81.37) with Microsoft SMTP Server (TLS) id 14.3.174.1; Thu, 24 Jul 2014 09:56:27 -0400 Received: from BN1AFFO11FD018.protection.gbl (10.58.52.30) by BN1AFFO11HUB016.protection.gbl (10.58.52.126) with Microsoft SMTP Server (TLS) id 15.0.980.11; Thu, 24 Jul 2014 13:56:26 +0000 Received: from vps4520.inmotionhosting.com (70.39.249.76) by BN1AFFO11FD018.mail.protection.outlook.com (10.58.52.78) with Microsoft SMTP Server (TLS) id 15.0.980.11 via Frontend Transport; Thu, 24 Jul 2014 13:56:25 +0000 Received: from [127.0.0.1] (port=34753 helo=webmail.endeavorwebdesign.com) by vps4520.inmotionhosting.com with esmtpa (Exim 4.80.1) (envelope-from <[email protected]>) id 1XAJVR-0008Gs-8b for [email protected]; Thu, 24 Jul 2014 09:56:25 -0400 MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: 7bit Date: Thu, 24 Jul 2014 09:56:25 -0400 From: <[email protected]> To: <[email protected]> Subject: Test 4 EWD Message-ID: <[email protected]> X-Sender: [email protected] User-Agent: Roundcube Webmail/0.9.3 X-OutGoing-Spam-Status: No, score=-0.8 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - vps4520.inmotionhosting.com X-AntiAbuse: Original Domain - osu.edu X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - endeavorwebdesign.com X-Get-Message-Sender-Via: vps4520.inmotionhosting.com: authenticated_id: [email protected] X-Source: X-Source-Args: X-Source-Dir: X-EOPAttributedMessage: 2 X-Forefront-Antispam-Report-Untrusted: CIP:70.39.249.76;CTRY:US;IPV:NLI;EFV:NLI;SFV:NSPM;SFS:(6009001)(438002)(199002)(189002)(80022001)(2171001)(46102001)(64706001)(86152002)(6806004)(551214005)(54356999)(36756003)(83072002)(555874004)(229853001)(44976005)(558084003)(74662001)(77982001)(107046002)(83506001)(93046001)(23676002)(92566001)(102836001)(83322001)(45086001)(31966008)(47776003)(4396001)(104016003)(71366001)(79102001)(81342001)(2351001)(50466002)(85852003)(20776003)(74502001)(83832001)(110136001)(95666004)(106466001)(107886001)(81542001)(33646002)(86362001)(21056001)(50986999)(99396002)(76482001)(85306003)(87836001)(113156001)(108616002)(24736002)(558944008)(19559445001)(15288005002);DIR:INB;SFP:;SCL:1;SRVR:BN1AFFO11HUB016;H:vps4520.inmotionhosting.com;FPR:;MLV:ovr;PTR:vps4520.inmotionhosting.com;A:1;MX:1;LANG:; X-Microsoft-Antispam: BCL:0;PCL:0;RULEID: Received-SPF: Fail (: domain of endeavorwebdesign.com does not designate 207.46.163.243 as permitted sender) receiver=; client-ip=207.46.163.243; helo=na01-by2-obe.outbound.protection.outlook.com; Authentication-Results: spf=fail (sender IP is 207.46.163.243) [email protected]; Return-Path: [email protected] X-Forefront-Antispam-Report-Untrusted: CIP:164.107.81.218;CTRY:US;IPV:NLI;IPV:NLI;EFV:NLI;SFV:NSPM;SFS:(6009001)(199002)(189002)(50986999)(54356999)(79102001)(81342001)(77982001)(31966008)(107046002)(107886001)(21056001)(109096001)(81542001)(2351001)(33646002)(23676002)(551214005)(558084003)(71366001)(64706001)(106466001)(46102001)(104016003)(74662001)(86362001)(50466002)(44976005)(83072002)(93346002)(4396001)(76482001)(83832001)(86152002)(80022001)(95666004)(6806004)(229853001)(105606002)(555874004)(20776003)(83322001)(45086001)(87936001)(74502001)(85852003)(85306003)(93046001)(83506001)(2171001)(110136001)(102836001)(92566001)(99396002)(36756003)(47776003)(113156001)(108616002)(24736002)(558944008)(15288005002)(19559445001);DIR:OUT;SFP:;SCL:1;SRVR:BN1AFFO11HUB033;H:cio-tnc-pf04.osuad.osu.edu;FPR:;MLV:ovr;PTR:cio-tnc-pf04.osuad.osu.edu;A:1;MX:1;LANG:; X-Microsoft-Antispam: BCL:0;PCL:0;RULEID: X-Forefront-PRVS: 028256169F X-MS-Exchange-Organization-MessageDirectionality: Incoming X-Forefront-Antispam-Report: CIP:207.46.163.243;CTRY:US;IPV:NLI;IPV:NLI;EFV:NLI;SFV:SPM;SFS:(6009001)(489007)(199002)(189002)(50986999)(36756003)(83832001)(31966008)(99396002)(77982001)(22756004)(33646002)(83072002)(83506001)(102836001)(44976005)(23676002)(54356999)(81342001)(104016003)(71366001)(4396001)(80022001)(20776003)(76482001)(86362001)(47776003)(21056001)(229853001)(64706001)(2171001)(87836001)(50466002)(74662001)(110136001)(79102001)(85306003)(95666004)(2351001)(74502001)(105606002)(107886001)(81542001)(551214005)(92566001)(85852003)(85426001)(107046002)(93046001)(46102001)(86152002)(93346002)(555874004)(6806004)(558084003)(106466001)(83322001)(45086001)(113156001)(108616002);DIR:INB;SFP:;SCL:5;SRVR:BN1PR01MB135;H:na01-by2-obe.outbound.protection.outlook.com;FPR:;MLV:ovr;PTR:mail-by2lp0243.outbound.protection.outlook.com;A:1;MX:1;LANG:; X-MS-Exchange-Organization-Network-Message-Id: b12da29d-aa7b-4146-c1e5-08d1755e3623 X-Microsoft-Antispam: BCL:0;PCL:0;RULEID: X-MS-Exchange-Organization-AVStamp-Service: 1.0 X-MS-Exchange-Organization-SCL: 5 X-FOSE-spam: This message appears to be spam. X-MS-Exchange-Organization-AuthSource: BN1BFFO11FD029.protection.gbl X-MS-Exchange-Organization-AuthAs: Anonymous Thanks to all in advance! Carl Xie OCIO/Infrastructure/Enterprise Messaging Group Ohio State University 614-688-4787
