The device is behind a firewall/SLB. I can't make the source IP transparent at this time. My only other option would be to stand it up directly on the public network.
On Mar 11, 2014, at 1:23 PM, Eric Shubert <[email protected]> wrote: > On 03/11/2014 09:57 AM, Scot Needy wrote: >> NOTE: All sender domains and IP’s have been replaced with a unique name. >> >> >> CHKUSER accepted sender: from<[email protected]::> remote >> <na01-by2-obe.outbound.protection.outlook.com:unknown:10.189.254.17> rcpt <> >> : sender accepted >> spamdyke[8804]: DENIED_OTHER from:[email protected] >> to:[email protected] origin_ip: 10.189.254.17 origin_rdns: >> (unknown) auth: (unknown) encryption: TLS reason: >> 550_See_http://spf.pobox.com/why.html?sender=Joe-Customer%40mydomain.com&ip=10.189.254.17&receiver=mail-01.mydomain.com_(#5.7.1) >> >> CHKUSER accepted sender: from<[email protected]::> remote >> <na01-bn1-obe.outbound.protection.outlook.com:unknown:10.189.254.17> rcpt <> >> : sender accepted >> spamdyke[16794]: DENIED_OTHER from:[email protected] >> to:[email protected] origin_ip: 10.189.254.17 origin_rdns: >> (unknown) auth: (unknown) encryption: TLS reason: >> 550_See_http://spf.pobox.com/why.html?sender=Joe-Customer%40mydomain.com&ip=10.189.254.17&receiver=mail-01.mydomain.com_(#5.7.1) >> >> CHKUSER accepted sender: from<[email protected]::> remote >> <na01-bn1-obe.outbound.protection.outlook.com:unknown:10.189.254.17> rcpt <> >> : sender accepted >> spamdyke[31470]: DENIED_OTHER from:[email protected] >> to:[email protected] origin_ip: 10.189.254.17 origin_rdns: >> (unknown) auth: (unknown) encryption: TLS reason: >> 550_See_http://spf.pobox.com/why.html?sender=Joe-Customer%40mydomain.com&ip=10.189.254.17&receiver=mail-01.mydomain.com_(#5.7.1) >> >> > > Looks to me as though there may be a firewall-type device on your perimeter > which is doing more than simply NAT. The origin_ip is typically the address > of the sending host, which would be public. This holds true even when QMT is > behind a NAT'ing firewall (I typically do this). > > Is outlook.com the only domain you have messages coming from which show this > 10. address? > > Is there some sort of VPN going on here? > > What device is sitting on the immediate outside of QMT? > > -- > -Eric 'shubes' > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected]
