I totally believe that the address is legit. From what I can tell*, it is being accepted by Exchange when the Barracuda attempts to send messages on. It doesn't look like Exchange is rejecting the message because of the recipient's address. I think that's a red herring and something else is happening later on.
A few questions: Does this happen to every single message sent to jd...@example.com? Was the recipient able to receive messages of the type in question in the past, or is this new behavior? Are there other recipients that can successfully receive messages sent to u...@example.com? Can you telnet directly to Exchange from inside your firewall and send a message to jd...@example.com manually? Does this have anything at all to do with your subdomain question a while ago? * I'm no expert, and I haven't played one on TV. On Wed, Feb 22, 2012 at 8:34 PM, Kurt Buff <kurt.b...@gmail.com> wrote: > The user is one of my minions - he's legit. > > I'm not aware of any filtering going on inside of Exchange - and I'm > the one who does most of the Exchange admin. We're not using IMF, > either. > > Kurt > > On Wed, Feb 22, 2012 at 17:24, Richard Stovall <rich...@gmail.com> wrote: > > The RCPT TO command on line 4 is generating a 250, which means it has > been > > accepted as a legitimate recipient, right? It looks like after that is > when > > it is being rejected and the NDR generated. Is there some funny > recipient > > or sender filtering going on on the Exchange server? Something to do > with > > IMF, perhaps? > > > > > > On Wed, Feb 22, 2012 at 7:30 PM, Kurt Buff <kurt.b...@gmail.com> wrote: > >> > >> Exchange 2003 (zxch), fronted by a Barracuda (mailproxy). > >> > >> I've got one user (that I know of) who cannot receive email from the > >> outside - inside works just fine. The email comes through the > >> Barracuda, hits the Exchange box, which generates an NDR. The NDR only > >> specifies the minor ESMTP code (5.7.1), but not the major code > >> (500/550/whatever). > >> > >> I've perused the logs for Exchange, and done the message tracking, and > >> am just not seeing what the failure mode is, exactly. The most common > >> use for 5.7.1 codes is "unable to relay", but the only address > >> attached to this mailbox is correct, and I've checked both the rules > >> on the mailbox and the Exchange settings on the account and the SMTP > >> logs, and there's no forwarding going on. > >> > >> It's a bit of a stumper... > >> > >> Logs and raw mail included below - if someone can look it over > >> andeither see what I'm missing or suggest where else to look, I'd > >> appreciate it. > >> > >> Side note: I looked in the event logs, and noticed a ton of 8206 EXCDO > >> entries with code 0x80004005. I'm just about to apply this hotfix: > >> http://support.microsoft.com/kb/943721. But, while I don't think it's > >> relevant to this issue, I thought I'd mention it just in case. > >> > >> Kurt > >> > >> -------Begin Exchange SMTP log fragment for my test message---------- > >> 192.168.8.5 - mailproxy.example.com [22/Feb/2012:15:32:45 -0800] "EHLO > >> -? mailproxy.example.com SMTP" 250 306 > >> 192.168.8.5 - mailproxy.example.com [22/Feb/2012:15:32:59 -0800] "EHLO > >> -? mailproxy.example.com SMTP" 250 306 > >> 192.168.8.5 - mailproxy.example.com [22/Feb/2012:15:32:59 -0800] "MAIL > >> -? FROM:<kurt.b...@gmail.com> SMTP" 250 44 > >> 192.168.8.5 - mailproxy.example.com [22/Feb/2012:15:32:59 -0800] "RCPT > >> -? TO:<jd...@example.com> SMTP" 250 29 > >> 192.168.8.5 - mailproxy.example.com [22/Feb/2012:15:32:59 -0800] "DATA > >> -? <CADy1Ce7camOaw4XRNyBj-Hk2y4EWcmuUiG9kaSW_i5r=mif...@mail.gmail.com> > >> SMTP" 250 152 > >> 192.168.8.5 - mailproxy.example.com [22/Feb/2012:15:32:59 -0800] "QUIT > >> -?mailproxy.example.com SMTP" 240 64 > >> > >> 192.168.8.5 - OutboundConnectionResponse [22/Feb/2012:15:32:59 -0800] > >> "- -?220 mailproxy.example.com ESMTP > >> (976678806aed1ee9df8b280f06533ea0) SMTP" 0 65 > >> 192.168.8.5 - OutboundConnectionCommand [22/Feb/2012:15:32:59 -0800] > >> "EHLO -?zxch.example.com SMTP" 0 4 > >> 192.168.8.5 - OutboundConnectionResponse [22/Feb/2012:15:32:59 -0800] > >> "- -?250-mailproxy.example.com Hello zxch.example.com [192.168.10.66], > >> pleased to meet you SMTP" 0 83 > >> 192.168.8.5 - OutboundConnectionCommand [22/Feb/2012:15:32:59 -0800] > >> "MAIL -?FROM:<> SIZE=3961 SMTP" 0 4 > >> 192.168.8.5 - OutboundConnectionResponse [22/Feb/2012:15:32:59 -0800] > >> "- -?250 Sender <> OK SMTP" 0 16 > >> 192.168.8.5 - OutboundConnectionCommand [22/Feb/2012:15:32:59 -0800] > >> "RCPT -?TO:<kurt.b...@gmail.com> SMTP" 0 4 > >> 192.168.8.5 - OutboundConnectionResponse [22/Feb/2012:15:32:59 -0800] > >> "- -?250 Recipient <kurt.b...@gmail.com> OK SMTP" 0 38 > >> 192.168.8.5 - OutboundConnectionCommand [22/Feb/2012:15:32:59 -0800] > >> "DATA - SMTP" 0 4 > >> 192.168.8.5 - OutboundConnectionResponse [22/Feb/2012:15:32:59 -0800] > >> "- -?354 Start mail input; end with <CRLF>.<CRLF> SMTP" 0 44 > >> 192.168.8.5 - OutboundConnectionResponse [22/Feb/2012:15:32:59 -0800] > >> "- -?250 Ok: queued as 71FDC53404A SMTP" 0 29 > >> 192.168.8.5 - OutboundConnectionCommand [22/Feb/2012:15:32:59 -0800] > >> "QUIT - SMTP" 0 4 > >> 192.168.8.5 - OutboundConnectionResponse [22/Feb/2012:15:32:59 -0800] > >> "- -?221 mailproxy.example.com Goodbye zxch.example.com, closing > >> connection SMTP" 0 68 > >> -------End Exchange SMTP log fragment for my test message---------- > >> > >> ----------Begin raw NDR message received in gmail---------- > >> Delivered-To: kurt.b...@gmail.com > >> Received: by 10.216.175.209 with SMTP id z59csp11567wel; > >> Wed, 22 Feb 2012 15:33:01 -0800 (PST) > >> Received: by 10.68.211.102 with SMTP id > nb6mr77368172pbc.54.1329953580654; > >> Wed, 22 Feb 2012 15:33:00 -0800 (PST) > >> Return-Path: <> > >> Received: from mailproxy.example.com (mailproxy.example.com. > >> [12.34.56.78]) > >> by mx.google.com with ESMTP id > >> l7si30792447pbd.170.2012.02.22.15.32.59; > >> Wed, 22 Feb 2012 15:33:00 -0800 (PST) > >> Received-SPF: pass (google.com: best guess record for domain of > >> mailproxy.example.com designates 12.34.56.78 as permitted sender) > >> client-ip=12.34.56.78; > >> Authentication-Results: mx.google.com; spf=pass (google.com: best > >> guess record for domain of mailproxy.example.com designates > >> 12.34.56.78 as permitted sender) smtp.mail= > >> X-ASG-Debug-ID: 1329953579-04d34c0eadddfd0001-xLaKaV > >> Received: from zxch.example.com (zxch.example.com [192.168.10.66]) by > >> mailproxy.example.com with ESMTP id jPc6s675L9I6ljE5 for > >> <kurt.b...@gmail.com>; Wed, 22 Feb 2012 15:32:59 -0800 (PST) > >> X-Barracuda-Envelope-From: > >> From: postmas...@example.com > >> To: kurt.b...@gmail.com > >> Date: Wed, 22 Feb 2012 15:32:59 -0800 > >> MIME-Version: 1.0 > >> Content-Type: multipart/report; report-type=delivery-status; > >> boundary="9B095B5ADSN=_01CCE534144FE6190002805Ezxch.example.com" > >> X-DSNContext: 335a7efd - 4523 - 00000001 - 80040546 > >> Message-ID: <zblax3cf300000...@zxch.example.com> > >> Subject: Delivery Status Notification (Failure) > >> X-Barracuda-Connect: zxch.example.com[192.168.10.66] > >> X-Barracuda-Start-Time: 1329953579 > >> X-Barracuda-URL: http://mailproxy.example.com:8000/cgi-mod/mark.cgi > >> X-ASG-Orig-Subj: Delivery Status Notification (Failure) > >> X-Virus-Scanned: by bsmtpd at example.com > >> X-Barracuda-Spam-Score: 0.20 > >> X-Barracuda-Spam-Status: No, SCORE=0.20 using global scores of > >> TAG_LEVEL=1000.0 QUARANTINE_LEVEL=1000.0 KILL_LEVEL=9.0 > >> tests=ANY_BOUNCE_MESSAGE, BOUNCE_MESSAGE, BSF_SC0_SA590, > >> EMPTY_ENV_FROM, NO_REAL_NAME > >> X-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.2.89239 > >> Rule breakdown below > >> pts rule name description > >> ---- ---------------------- > >> -------------------------------------------------- > >> 0.00 EMPTY_ENV_FROM Empty Envelope From Address > >> 0.00 NO_REAL_NAME From: does not include a real name > >> 0.20 BSF_SC0_SA590 Custom Rule SA590 > >> 0.00 BOUNCE_MESSAGE MTA bounce message > >> 0.00 ANY_BOUNCE_MESSAGE Message is some kind of bounce > message > >> > >> This is a MIME-formatted message. > >> Portions of this message may be unreadable without a MIME-capable mail > >> program. > >> > >> --9B095B5ADSN=_01CCE534144FE6190002805Ezxch.example.com > >> Content-Type: text/plain; charset=unicode-1-1-utf-7 > >> > >> This is an automatically generated Delivery Status Notification. > >> > >> Delivery to the following recipients failed. > >> > >> jd...@example.com > >> > >> > >> > >> > >> --9B095B5ADSN=_01CCE534144FE6190002805Ezxch.example.com > >> Content-Type: message/delivery-status > >> > >> Reporting-MTA: dns;zxch.example.com > >> Received-From-MTA: dns;mailproxy.example.com > >> Arrival-Date: Wed, 22 Feb 2012 15:32:59 -0800 > >> > >> Final-Recipient: rfc822;jd...@example.com > >> Action: failed > >> Status: 5.7.1 > >> X-Display-Name: Jeremy Diaz > >> > >> > >> --9B095B5ADSN=_01CCE534144FE6190002805Ezxch.example.com > >> Content-Type: message/rfc822 > >> > >> Received: from mailproxy.example.com ([192.168.8.5]) by > >> zxch.example.com with Microsoft SMTPSVC(6.0.3790.4675); > >> Wed, 22 Feb 2012 15:32:59 -0800 > >> X-ASG-Debug-ID: 1329953578-04d34c0eb3ddfd0001-dWtM1h > >> Received: from mail-wi0-f169.google.com (sidewinder.example.com > >> [192.168.8.13]) by mailproxy.example.com with ESMTP id > >> E7jo5fPdRJtJqBwG for <jd...@example.com>; Wed, 22 Feb 2012 15:32:58 > >> -0800 (PST) > >> X-Barracuda-Envelope-From: kurt.b...@gmail.com > >> Received: by wibhj13 with SMTP id hj13so515655wib.0 > >> for <jd...@example.com>; Wed, 22 Feb 2012 15:32:57 -0800 (PST) > >> Received-SPF: pass (google.com: domain of kurt.b...@gmail.com > >> designates 10.180.102.35 as permitted sender) client-ip=10.180.102.35; > >> Authentication-Results: mr.google.com; spf=pass (google.com: domain of > >> kurt.b...@gmail.com designates 10.180.102.35 as permitted sender) > >> smtp.mail=kurt.b...@gmail.com; dkim=pass header.i=kurt.b...@gmail.com > >> Received: from mr.google.com ([10.180.102.35]) > >> by 10.180.102.35 with SMTP id fl3mr681214wib.22.1329953577674 > >> (num_hops = 1); > >> Wed, 22 Feb 2012 15:32:57 -0800 (PST) > >> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; > >> d=gmail.com; s=gamma; > >> h=mime-version:date:message-id:subject:from:to:content-type; > >> bh=UDw8iDI4Kq/VKe8rqmzSMFuD2WV/WPfez8Kq6CrjWTM=; > >> > >> b=BEDm+fbhXqFaeZYi46wqoJRWJpWW5jSp01ouUoaizgJcdvm0A90iJk2+nV1dkmBD0R > >> > >> BipjCOUhvD/ccZpCTshrLsIScy0Fxo2xBQKfORacviuksl9C8+2YDxfepzvXmC257k1i > >> mpGXro3Sc8f/5w1FIi3RWA8A4rRqYCRMYgY+k= > >> MIME-Version: 1.0 > >> Received: by 10.180.102.35 with SMTP id fl3mr558902wib.22.1329953577636; > >> Wed, > >> 22 Feb 2012 15:32:57 -0800 (PST) > >> Received: by 10.216.175.209 with HTTP; Wed, 22 Feb 2012 15:32:57 -0800 > >> (PST) > >> Date: Wed, 22 Feb 2012 15:32:57 -0800 > >> Message-ID: > >> <CADy1Ce7camOaw4XRNyBj-Hk2y4EWcmuUiG9kaSW_i5r=mif...@mail.gmail.com> > >> Subject: Test from Gmail > >> From: Kurt Buff <kurt.b...@gmail.com> > >> X-ASG-Orig-Subj: Test from Gmail > >> To: jd...@example.com > >> Content-Type: text/plain; charset=UTF-8 > >> X-Barracuda-Connect: sidewinder.example.com[192.168.8.13] > >> X-Barracuda-Start-Time: 1329953578 > >> X-Barracuda-URL: http://mailproxy.example.com:8000/cgi-mod/mark.cgi > >> X-Virus-Scanned: by bsmtpd at example.com > >> X-Barracuda-Spam-Score: 0.00 > >> X-Barracuda-Spam-Status: No, SCORE=0.00 using global scores of > >> TAG_LEVEL=3.5 QUARANTINE_LEVEL=5.0 KILL_LEVEL=9.5 tests= > >> X-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.2.89239 > >> Rule breakdown below > >> pts rule name description > >> ---- ---------------------- > >> -------------------------------------------------- > >> Return-Path: kurt.b...@gmail.com > >> X-OriginalArrivalTime: 22 Feb 2012 23:32:59.0063 (UTC) > >> FILETIME=[4FB8E470:01CCF1BA] > >> > >> Kurt > >> > >> > >> --9B095B5ADSN=_01CCE534144FE6190002805Ezxch.example.com-- > >> ----------End raw NDR message received in gmail---------- > >> > >> --- > >> To manage subscriptions click here: > >> http://lyris.sunbelt-software.com/read/my_forums/ > >> or send an email to listmana...@lyris.sunbeltsoftware.com > >> with the body: unsubscribe exchangelist > > > > > > --- > > To manage subscriptions click here: > > http://lyris.sunbelt-software.com/read/my_forums/ > > or send an email to listmana...@lyris.sunbeltsoftware.com > > with the body: unsubscribe exchangelist > > --- > To manage subscriptions click here: > http://lyris.sunbelt-software.com/read/my_forums/ > or send an email to listmana...@lyris.sunbeltsoftware.com > with the body: unsubscribe exchangelist > > --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
