email Bounce "From: derived from envelope by postmaster@mail-9.uk.tiscali.com"

This is an odd one, and I just don't know where to look for answers...

We have an SBS 2003 server, patched with all the usual POP3 connector
patches, and it all seems to be working fine...

Every once in a while, a client who sends in to us gets a bounce message...

From: derived from envelope by

I've no idea where the message is coming from..., as he will send emails in
quite happily for several weeks then he gets one of these..?, and it
fails...

He just resends it and it works fine...

He is the only customer we have this problems with.., but I don't know if
it's a problem with us, or something SBS is doing...

Any help would be much appreciated...

ColinA wrote:
> This is an odd one, and I just don't know where to look for answers...
>
> We have an SBS 2003 server, patched with all the usual POP3 connector
> patches, and it all seems to be working fine...
>
> Every once in a while, a client who sends in to us gets a bounce message...
>
> From: derived from envelope by
>
> I've no idea where the message is coming from..., as he will send emails
> in quite happily for several weeks then he gets one of these..?, and it
> fails...
>
> He just resends it and it works fine...
>
> He is the only customer we have this problems with.., but I don't know
> if it's a problem with us, or something SBS is doing...
>
> Any help would be much appreciated...
>
>
>
Any chance the original email was sent as part of a BCC group, and then
re-sent normally? That would account for it, as BCC and mailing list
email doesn't put in a proper To: header.

Domain-wide POP3 reception requires the POP3 server to use the SMTP
envelope to find the recipient if there's no To: header, and the SBS
POP3 connector can't use the extra header (Envelope-To: or similar) that
is usually added to the email in that case.

If that isn't the case, it may be difficult to troubleshoot. You'll need
a complete copy of a failed message, including all its headers, which
should have been returned to the sender as part of the NDR. Since I have
no idea what the problem is, I can't tell you what to look for, but
compare those headers with the re-sent version which did get through.

You can see them by right-clicking on the message in the Outlook list
and looking at the Message Options. You can copy and paste into Notepad
from here, which is worth doing as it's easy to miss headers as you
scroll through the tiny window. Outlook Express and Windows Mail allow
saving the complete message to a text (.eml) file, but I haven't yet
found a way of doing this from Outlook/Exchange.

One of the (various) drawbacks of the POP3 connector is that you don't
have access to the SMTP receiving logs, which usually offer clues to
problems of this kind.

--
Joe

But the other question is, is this message being generated by Tiscali...?

It only happens with this user....

There is one bit in the header on the failed message that is odd

Message-ID:
< ydomain.local>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.4325
X-Spam-Flag: YES
X-Antivirus: AVG for E-mail 8.5.421 [270.14.13/2432]

It the bit that says X-Spam-Flag: YES...?

This user is setup on the "whitelist" on our domain control panel..., so all
emails from him should get thro...

All we have on the server is basic AVG and the same goes for the clients...

Why is it somehow getting a Spam flag put on it....?

Regards

"ColinA" <> wrote in message
news:...
> But the other question is, is this message being generated by Tiscali...?
>
> It only happens with this user....
>
> There is one bit in the header on the failed message that is odd
>
> Message-ID:
> < ydomain.local>
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.4325
> X-Spam-Flag: YES
> X-Antivirus: AVG for E-mail 8.5.421 [270.14.13/2432]
>
> It the bit that says X-Spam-Flag: YES...?
>
> This user is setup on the "whitelist" on our domain control panel..., so
> all emails from him should get thro...
>
> All we have on the server is basic AVG and the same goes for the
> clients...
>
> Why is it somehow getting a Spam flag put on it....?
>
> Regards


Funny, seems you're not the only one with this from Tascali.
http://wongablog.co.uk/2004/04/06/email-disconnections/

Does your AVG scan the Exchange store or inbound/outbound SMTP traffic?

Keep in mind, with non-Exchange based AV, you must exclude the Exchange
folder and all subfolders.

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Please reply back to the newsgroup or forum for collaboration benefit among
responding engineers, and to help others benefit from your resolution.

Ace Fekay, MCT, MCITP EA, MCTS Windows 2008 & Exchange 2007, MCSE & MCSA
2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer

For urgent issues, please contact Microsoft PSS directly. Please check
http://support.microsoft.com for regional support phone numbers.

ColinA wrote:
> But the other question is, is this message being generated by Tiscali...?
>
This message?

"From: derived from envelope by "

Yes, you are being told the mail server name, should you wish to enquire
about a problem. The implication is that the postmaster email address is
being monitored and can be used to ask questions. This behaviour is
required by SMTP RFCs, but most large organisations ignore that fact.

The message has nothing to do with any classification as spam, it's just
telling you something about routing. It may mean no more than that the
bounce message has an empty From: header, which is entirely normal in
order to prevent loops where error messages are bounced back and forth
forever.

> It only happens with this user....
>
> There is one bit in the header on the failed message that is odd
>
> Message-ID:
> < ydomain.local>
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.4325
> X-Spam-Flag: YES
> X-Antivirus: AVG for E-mail 8.5.421 [270.14.13/2432]
>
> It the bit that says X-Spam-Flag: YES...?
>
> This user is setup on the "whitelist" on our domain control panel..., so
> all emails from him should get thro...
>
> All we have on the server is basic AVG and the same goes for the clients...
>
> Why is it somehow getting a Spam flag put on it....?
>

I suspect you'll need another AVG user to answer that.

Headers are required to be added at the top of the message, so you can
see the order in which things happen. If the headers you quote are
actually present in that exact sequence, then it would definitely appear
to be AVG adding the spam flag, just before a message ID is assigned.

Note that the X-MimeOLE header is typically added by Outlook or Exchange
at the sender's end. Where is this X-Spam-Flag header in relation to the
Received: headers? If it is below them (i.e. added before) then this
spam identification is being made at the sender's end, and it is
coincidental that they are also using AVG. Your AVG is taking its word
for it that the message is spam.

--
Joe

We just have the basic version of AVG Network Addition on the server, so, I
don't think that does specifically scan the Exchange store... Are you saying
I need to exclude that...?

We also have SPAM ASSASIN running on our Domain hosting email config...?, I
don't think that is it, as we had these problems before we enabled it...

The senders Domain is hosted by 1 and 1, but the user who we have problems
with uses Tiscali as his ISP....

Could it be -

a. Tiscali?
b. The senders AV software?
c. The senders email setup in his Domain control panel..?

It's just odd that he will send in 20-30 emails and none of them will have
problems, then "bang" one bounces back to him...

We don't get this with any other sender..., just him...

"ColinA" <> wrote in message
news:...
> We just have the basic version of AVG Network Addition on the server, so,
> I don't think that does specifically scan the Exchange store... Are you
> saying I need to exclude that...?
>
> We also have SPAM ASSASIN running on our Domain hosting email config...?,
> I don't think that is it, as we had these problems before we enabled it...
>
> The senders Domain is hosted by 1 and 1, but the user who we have problems
> with uses Tiscali as his ISP....
>
> Could it be -
>
> a. Tiscali?
> b. The senders AV software?
> c. The senders email setup in his Domain control panel..?
>
> It's just odd that he will send in 20-30 emails and none of them will have
> problems, then "bang" one bounces back to him...
>
> We don't get this with any other sender..., just him...


With any non-Exchange server aware AV, you MUST exclude the program
files\exchsvr folder and subfolders. Otherwise you are inviting trouble.

As for a, b or c, I think it's a, from what I've found searching on Google.
It appears it's happened with them more than once. Spam Assasin was
mentioned, too. Search Google for the following to see what I mean:

"derived from envelope by postmaster@" (without the quotes)

Ace

Thanks Ace, very kind of you to help....

"ColinA" <> wrote in message
news:...
> Thanks Ace, very kind of you to help....


You are welcome. I hope you can resolve this one way or another. If it is
truly them, it may be difficult for a workaround.

Ace