It is doing some forwarding. The server in question is located at 216.29.45.197 it accepts mail for about 40 domains. It also acts as gateway (it has that awesome declude anti-spam/virus software on it) for a secondary server.
In that case, I would recommend upgrading to the latest version of Declude JunkMail (v1.66 and higher will detect relaying attempts with colons in them, as part of the PERCENT test). That's probably the easiest way to prevent this problem.
I took another look at the relay settings I had relay for address containing these addresses: 216.29.45.0 10.0.0.0 (my dmz) 192.168.168.0 (my lan)
The second server also is set relay for addresses containing: 10.0.0.0 (my dmz) 192.168.168.0 (my lan)
X-ORDB-Envelope-To: @iaccorp.com:[EMAIL PROTECTED]
There is the problem -- the second server allows the primary server to relay, but the primary server can accept E-mail in the format "@iaccorp.com:[EMAIL PROTECTED]" -- which it will forward to the second server (since iE-mail for the iaccorp.com domain gets forwarded to the second server). The second server then sees that the E-mail is destined to [EMAIL PROTECTED], and sends it there (since it is allowed to relay for the primary mailserver).
Upgrading Declude JunkMail to the latest version will automatically block these E-mails.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
