Hi everyone,
Got an interesting issue with one of the hosted exchange platforms that we currently manage. We have a spamfilter (SpamTitan) that filters the messages, then forwards them on to the Exchange mailboxes, and I'm seeing a particular message from a specific sender being sent through the filter, whitelisted, and then sent on to Exchange.
In Exchange message tracking, I can see the message being RECEIVE SMTP delivered, but the message is not found in the user's OWA/mailbox anywhere.
The only thing that's different is the sender is coming from a postmaster@internal.local address from the 3rd party engine that's sending the emails to our hosted exchange system.
The messages are Delivery Failure Notices with bouncebacks (the user actually wants them to know who's Invoices sent out are bouncing etc)
Under our Exchange 2013 content filter config I've allowed this postmaster@internal.local address to bypassed senders, but still the message is not delivered even though all our message tracking says it is.
Here is a copy of the SpamTitan message log:
SpamTitan ID: wnt42jLvqRVg
Message Received: September 1, 2015, 10:52:51
Envelope From Address: MAILER-DAEMON
From Address: postmaster@internal.local
Recipient: destination@mailbox.com
Subject: Delivery Status Notification (Failure)
Client Address: [external smtp server]
Country of Origin: AU
Message Size: 268953
Content Classification: Whitelisted
Virus Infected: No
Score: 0
Quarantined: No
Message ID: ZS2TRqf690000003a@internal.local
SMTP Response: 250 2.6.0 [InternalId=75020193760376, Hostname=our.hosted.exchange.fqdn] Queued mail for delivery
Delivery Status: Sent
Blacklisted Sender: N
Whitelisted Sender: Y
Mail flow direction: Inbound
Encryption: None
And here is a copy of the Exchange message tracking delivery:
RunspaceId : 9a660b50-f4fb-4f3a-84a3-e2ef42cbfbe0
Timestamp : 1/09/2015 10:52:59 AM
ClientIp : exchange.IP
ClientHostname : our.hosted.exchange.fqdn
ServerIp : exchange.IP
ServerHostname : exchange
SourceContext : 08D10381D3F1D083;2015-09-01T02:52:50.305Z;0
ConnectorId : PER-EX1\Default PER-EX1
Source : SMTP
EventId : RECEIVE
InternalMessageId : 75020193760376
MessageId : ZS2TRqf690000003a@internal.local
Recipients : {destination@mailbox.com}
RecipientStatus : {}
TotalBytes : 270928
RecipientCount : 1
RelatedRecipientAddress :
Reference :
MessageSubject : Delivery Status Notification (Failure)
Sender : postmaster@internal.local
ReturnPath : <>
Directionality : Incoming
TenantId :
OriginalClientIp : 127.0.0.1
MessageInfo : 0cA:
MessageLatency :
MessageLatencyType : None
EventData : {[FirstForestHop, our.hosted.exchange.fqdn], [ProxiedClientIPAddress, exchange.IP], [ProxiedClientHostname, antispam.fqdn], [ProxyHop1, our.hosted.exchange.fqdn(exchange.IP)], [DeliveryPriority, Normal]}
I've checked junk mail, spam filter, mailbox folder rules, but cannot find these messages anywhere.
I have also added this email address - postmaster@internal.local to the BypassedSenders on our Exchange 2013 Content filter config. No change.
Anyone got any suggestions?
Cheers