But it happens with external mail as well. Our test systems have never shown this symptom.
Our production E2K system never started doing this until last week (we can't think of anything that's changed on any of the Exchange servers). It's been running for a couple of months now. Like I've said earlier, this behavior stopped after rebooting the E2K mailbox server, but now it's back! -----Original Message----- From: Daniel Chenault [mailto:[EMAIL PROTECTED]] Sent: Tuesday, November 19, 2002 9:28 AM To: Exchange Discussions Subject: RE: Weird SMTP header problem I recall reporting this and escalating it when I still worked there. Was told it's by design when SMTP mail is transferred within an organization. -----Original Message----- From: Ken Cornetet [mailto:[EMAIL PROTECTED]] Sent: Tuesday, November 19, 2002 8:20 AM To: Exchange Discussions Subject: RE: Weird SMTP header problem To summarize my problem, my E2K mailbox server is stripping SMTP "Received:" headers, and "making up" it's own. Last week when this happened, a reboot cleared up the problem, but it came back (not been able to reboot again, yet). Ed, is this proof enough? I've managed to distill the problem down to a simple set of steps. 1. Send email from my PC to the MSX 5.5 IMS server using blat. Here's the output: Failed to open registry key for Blat profile , using default. Failed to open registry key for Blat Sending x.kix to [EMAIL PROTECTED] Login name is [EMAIL PROTECTED] <<<getline<<< 220 nts126.kimball.com ESMTP Server (Microsoft Exchange Internet Mail Service 5.5.2652.78) ready >>>putline>>> EHLO 051kcornet <<<getline<<< 250-nts126.kimball.com Hello [051KCORNET] 250-XEXCH50 250-HELP 250-ETRN 250-DSN 250-SIZE 0 250-AUTH LOGIN 250 AUTH=LOGIN >>>putline>>> MAIL From:<[EMAIL PROTECTED]> <<<getline<<< 250 OK - mail from <[EMAIL PROTECTED]> >>>putline>>> RCPT To: <[EMAIL PROTECTED]> <<<getline<<< 250 OK - Recipient <[EMAIL PROTECTED]> >>>putline>>> DATA <<<getline<<< 354 Send data. End with CRLF.CRLF <<<getline<<< 250 OK >>>putline>>> QUIT <<<getline<<< 221 closing connection 2. Here's NTS126's log entries from above message c=us;a= ;p=kii;l=NTS1260211191352XC17P83W 1012 2002.11.19 13:52:20 /o=KII/ou=Jasper001/cn=Configuration/cn=Connections/cn=Internet Mail Connector (NTS126) /o=KII/ou=Jasper001/cn=Configuration/cn=Connections/cn=Internet Mail Connector (NTS126) XC17P83W [EMAIL PROTECTED] 0 1555 0 0 1 c=us;a= ;p=kii;l=NTS1260211191352XC17P83W 1013 2002.11.19 13:52:20 /o=KII/ou=Jasper001/cn=Configuration/cn=Connections/cn=Internet Mail Connector (NTS126) /o=KII/ou=Jasper001/cn=Configuration/cn=Servers/cn=NTS126/cn=Microsoft Private MDB <[EMAIL PROTECTED]> [EMAIL PROTECTED] 0 1555 0 0 1 C=us;A= ;P=kii;L=NTS1260211191352XC17P83W 0 2002.11.19 13:52:21 /O=KII/OU=JASPER001/CN=CONFIGURATION/CN=CONNECTIONS/CN=INTERNET MAIL CONNECTOR (NTS126) C=US;A= ;P=KII;O=Jasper001;DDA:SMTP=fubar(a)kimball.com; 0 2159 0 0 1 C=us;A= ;P=kii;L=NTS1260211191352XC17P83W 7 2002.11.19 13:52:21 /O=KII/OU=JASPER001/CN=CONFIGURATION/CN=SERVERS/CN=NTS390/CN=MICROSOFT MTA C=US;A= ;P=KII;O=Jasper001;DDA:SMTP=fubar(a)kimball.com; 0 2159 0 0 1 The most pertinent part of the logs is the event IDs: 1012 - SMTP received, 1013 - SMTP transferred inbound, 0 - Message transferred in, and 7 - message transferred out. Notice there is no 1010 or 1011 (outbound SMTP) Next, here's the tracking.log entries from the E2K mailbox server 11/19/2002 13:52:26 GMT - - - NTS390 - /O=KII/OU=JASPER001/CN=RECIPIENTS/CN=Kcornet 1027 [EMAIL PROTECTED] 0 0 1354 1 2002-11-19 13:52:26 GMT 0 - c=us;a= ;p=kii;l=NTS1260211191352XC17P83W Contents of file: x.kix [EMAIL PROTECTED] - 11/19/2002 13:52:26 GMT - - - NTS390 - /O=KII/OU=JASPER001/CN=RECIPIENTS/CN=Kcornet 1019 [EMAIL PROTECTED] 0 0 1354 1 2002-11-19 13:52:26 GMT 0 - - Contents of file: x.kix [EMAIL PROTECTED] - 11/19/2002 13:52:26 GMT - - - NTS390 - /O=KII/OU=JASPER001/CN=RECIPIENTS/CN=Kcornet 1025 [EMAIL PROTECTED] 0 0 1354 1 2002-11-19 13:52:26 GMT 0 - - Contents of file: x.kix [EMAIL PROTECTED] - 11/19/2002 13:52:26 GMT - - - NTS390 - /O=KII/OU=JASPER001/CN=RECIPIENTS/CN=Kcornet 1024 [EMAIL PROTECTED] 0 0 1354 1 2002-11-19 13:52:26 GMT 0 - - Contents of file: x.kix [EMAIL PROTECTED] - 11/19/2002 13:52:26 GMT - - - NTS390 - [EMAIL PROTECTED] 1023 [EMAIL PROTECTED] 0 0 1354 1 2002-11-19 13:52:26 GMT 0 - - Contents of file: x.kix [EMAIL PROTECTED] - 11/19/2002 13:52:26 GMT - - - NTS390 - [EMAIL PROTECTED] 1028 [EMAIL PROTECTED] 0 0 1354 1 2002-11-19 13:52:26 GMT 0 - - Contents of file: x.kix [EMAIL PROTECTED] - Lastly, here's what I see from outlook 2002: Microsoft Mail Internet Headers Version 2.0 Received: by nts390.kii.kimball.com id <[EMAIL PROTECTED]>; Tue, 19 Nov 2002 08:51:56 -0500 content-class: urn:content-classes:message Subject: Contents of file: x.kix Date: Tue, 19 Nov 2002 08:51:56 -0500 MIME-Version: 1.0 Content-Type: application/ms-tnef; name="winmail.dat" Content-Transfer-Encoding: binary X-MS-Has-Attach: Thread-Topic: Contents of file: x.kix Thread-Index: AcKP0tNV5UfLpPvBEdaoJgCQJ4dN9Q== X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 From: <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> -----Original Message----- From: Ed Crowley [mailto:[EMAIL PROTECTED]] Sent: Monday, November 18, 2002 4:48 PM To: Exchange Discussions Subject: RE: Weird SMTP header problem The only proof I would accept is a dump of the headers between each of the servers in your series of a message that's mysteroiously being stripped. Ed Crowley MCSE+Internet MVP kcCC+I Tech Consultant hp Services Protecting the world from PSTs and Bricked Backups! -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Ken Cornetet Sent: Monday, November 18, 2002 11:51 AM To: Exchange Discussions Subject: RE: Weird SMTP header problem Then I'm not sure what you mean. The only way SMTP gets into Kimball is via the checkpoint firewall, and it is configured to send only to nts126 (the MSX5.5 IMS server). There are no other hosts involved. The checkpoint participates only at the packet level, it does no native SMTP conversation. It neither strips, nor adds headers. It can't be Cleanmail because their servers wouldn't know if the email was destined for an E2K mailbox or a MSX5.5 mailbox. -----Original Message----- From: Ed Crowley [mailto:[EMAIL PROTECTED]] Sent: Monday, November 18, 2002 2:27 PM To: Exchange Discussions Subject: RE: Weird SMTP header problem That doesn't prove it to me. Ed Crowley MCSE+Internet MVP kcCC+I Tech Consultant hp Services Protecting the world from PSTs and Bricked Backups! -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Ken Cornetet Sent: Monday, November 18, 2002 11:20 AM To: Exchange Discussions Subject: RE: Weird SMTP header problem No. 1. People who's mailboxes are still on MSX 5.5 servers do not see the problem. 2. A reboot of the E2K mailbox server clears the problem up (at least for a while). -----Original Message----- From: Ed Crowley [mailto:[EMAIL PROTECTED]] Sent: Monday, November 18, 2002 12:25 PM To: Exchange Discussions Subject: RE: Weird SMTP header problem I suspect this is a feature of one of your hosts outside Exchange. Ed Crowley MCSE+Internet MVP kcCC+I Tech Consultant hp Services Protecting the world from PSTs and Bricked Backups! -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Ken Cornetet Sent: Monday, November 18, 2002 7:24 AM To: Exchange Discussions Subject: Weird SMTP header problem Our E2K mailbox servers have recently developed a bad habit... Many people here (myself included) create Outlook rules to move their Internet email into a separate folder based on the SMTP headers. A couple of days ago this stopped working. An quick examination of an incoming Internet email's headers showed that most all of the header information was gone, and what was there is strange. Our email flow is this: 1. Internet to Cleanmail (floyd.cinergycom.net) (for virus scrubbing) 2. Cleanmail to our checkpoint firewall (kimbintinc-cp.kimball.com) 3. Checkpoint to nts126 (a NT4/MSX5.5 IMS connector) 4. nts126 to nts390 (E2K mailbox) via MTA Normally, Internet email "Received:" headers look like this (edited for brevity): Received: from kimbintinc-cp.kimball.com (igate.kimball.com [167.178.249.18]) by nts126.kimball.com ... Received: (6577 bytes) by floyd.cinergycom.net Received: by cleanmail.com ... Received: from csc222.csc.dg.com(xn82.emc.com[168.159.1.82]) (6103 bytes) by floyd.cinergycom.net Notice that nts390 is NOT listed in the headers, since nts126 (an MSX5.5 IMS server) sends email to nts390 (E2K mailbox server) via MTA, not SMTP. However, recently, This is what I see when looking at headers: Microsoft Mail Internet Headers Version 2.0 Received: by nts390.kii.kimball.com id <[EMAIL PROTECTED]>; Mon, 18 Nov 2002 09:03:08 -0500 There are several things wrong with this picture: 1. All of the preceding (timewise) "Received:" headers are gone. 2. Internet mail cannot be going directly to nts390, it must be going through nts126 3. The one "Received:" header does not show who the message was received from. A reboot of the E2K mailbox server fixes the problem for a while, then it mysteriously comes back. Any ideas? _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
