Hi List I already mentioned this issue some time ago, and now I am seeing this more often again.
Sometimes the From: Header and evelope-from from Outlook.com customers do NOT contain their email address but a strange hex string. This is an authentic email from one of our customers. So I wanted to check once more, if anyone else sees this issue and might know the cause. Example: Subject: Festnetz-Telefon Verbindungen X-MS-Traffictypediagnostic: VI1EUR04HT146: X-MS-Has-Attach: X-MS-Exchange-Transport-Forked: True Content-Language: de-CH X-MS-Exchange-Organization-SCL: 0 X-MS-Tnef-Correlator: X-MS-Exchange-Crosstenant-ID: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa From: "XXXX XXXXX" <outlook_3dddb25f0278f...@outlook.com> ^---- Replaced customer Realname by XXXX Thread-Index: AQHWm712p1p8FZTrvUaHFiq8mGCsHA== X-MS-Exchange-Antispam-Messagedata: 2C0ekzREJlcdXHzHAui5qq0ZggocQcvyAOlAo4i6jR1ON0x30mhnn2Wmk/nJLCGWNItGt6RGeYvnqdHhPL8uO78ONUBheCh/nvPIG2SxM86BwwkrWpbT1NZzuqcIrsm7vZg+rq3b9pMoPypOOAmBIg== X-MS-Exchange-Crosstenant-Authas: Anonymous Date: Tue, 6 Oct 2020 09:01:01 +0000 X-Eopattributedmessage: 0 X-MS-Exchange-Crosstenant-Fromentityheader: Internet Received: from EUR04-VI1-obe.outbound.protection.outlook.com (mail-oln040092075071.outbound.protection.outlook.com [40.92.75.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by asterix.imp.ch (Postfix) with ESMTPS id BA549C571C for <supp...@breitband.ch>; Tue, 6 Oct 2020 11:01:09 +0200 (CEST) Received: from VI1EUR04FT036.eop-eur04.prod.protection.outlook.com (2a01:111:e400:7e0e::42) by VI1EUR04HT146.eop-eur04.prod.protection.outlook.com (2a01:111:e400:7e0e::394) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3412.25; Tue, 6 Oct 2020 09:01:01 +0000 Received: from DBAP195MB1033.EURP195.PROD.OUTLOOK.COM (2a01:111:e400:7e0e::47) by VI1EUR04FT036.mail.protection.outlook.com (2a01:111:e400:7e0e::423) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3433.34 via Frontend Transport; Tue, 6 Oct 2020 09:01:01 +0000 Received: from DBAP195MB1033.EURP195.PROD.OUTLOOK.COM ([fe80::84d4:cadc:b5a:a661]) by DBAP195MB1033.EURP195.PROD.OUTLOOK.COM ([fe80::84d4:cadc:b5a:a661%7]) with mapi id 15.20.3433.045; Tue, 6 Oct 2020 09:01:01 +0000 X-MS-Exchange-Crosstenant-RMS-Persistedconsumerorg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-Crosstenant-RMS-Persistedconsumerorg: 00000000-0000-0000-0000-000000000000 Arc-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=sOQZZbCYpxeAe3oZFZJUS3yAg0XSLEdlBGD/lzza4JU=; b=JZEH4EyrK0UmlapGNqNnD+FET+69mmUgnNmi4M9E5ataPi9Z8RwF9f7S/xYeg5rmjOl/0pbCbMKM790p9kKXt+fir5RNitHqb0wbqMPDEDOS632r2uIsadPxUX8FJmsCxsX4G8+5dg8HP071XsWOoAHb9US810Vhr3hlo+0t92yWIGG/JfXI4k8Ys/XQjvP6ciWiYrX1nYsIlF+sljpga+E9FyZiZa7Ze0Si8Vc7+R1tmoKfhkpszy00vgpU8eTVwr0Lqv1xaocxjmrcNk82sKJbwkNEtzdMuuw3x3HsRPIzarEXvWG3gb17cZJlcFDulsBzN6RE8VZKc+Ul19KAoQ== Message-ID: <dbap195mb1033f7d0a48843e0a5a703c8b3...@dbap195mb1033.eurp195.prod.outlook.com> X-Incomingtopheadermarker: OriginalChecksum:987E4C7A0A57C499261D9A59884FEC8A43EC88967D5B62C7E8075E520036F452;UpperCasedChecksum:FDC8CCA546C6CFE18F2654627825320A983BD673DF04B3CDADD5341D4AF1E703;SizeAsReceived:6597;Count:41 Arc-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none Dmarc-Filter: OpenDMARC Filter v1.3.1 asterix.imp.ch BA549C571C MIME-Version: 1.0 X-Originatororg: outlook.com X-Microsoft-Antispam: BCL:0; X-MS-Exchange-Crosstenant-Originalarrivaltime: 06 Oct 2020 09:01:01.4923 (UTC) X-Microsoft-Antispam-Message-Info: 3U4mmURNGzzC1t0Ornis4ZhsnpQ7QL3jRopt313FOtG/FMbMZOlQx4yCHaL6glH9+e0kVYszNR5TrSeDoA1V6Uzh2QUzLyjBzeomXnz8hZt2gRwOFDaW8Ekwl4ptaCtNbOrmCJ3mkw57Jmjry53pxexWP2u12luWy+X+oOGcGvFuUFRfdMy1A7vIKwNyrzCJyjBshOryE7VfftcH1LcZgvzXuD+L9tBhjB4i3czUq62YUk8JFBnH2KHQxfZhhBBJ Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=sOQZZbCYpxeAe3oZFZJUS3yAg0XSLEdlBGD/lzza4JU=; b=Inv2RzGVo7P+jY/B44V48Y4eZxgY5QTHaA+xdLG9Tu7uwn8xj+TE4XaX95oLk52XDh8Mza0HUhjJoRFVeO8mLRvSyIpwgsEsEgoBrfm8Ha1cYbKTkbNQuSAv3K18u9M4KGBSfp5aSovtCJkfem99K4T3GiK56S0A8LkjhtVu7rZ9W8rKY1JLhyyp+S806G+z/HY7VlkVjDJ1ebNoP3VnJww8RB/SIYuKSPoL2FeMxldiCeVCXF/dUQnqFTyPuZyqeCfvbXF6jLrsZn+O92h5OlWIv6IFO0PCzAb1sSsvkdKnijYqwseYjJeKsaw058LWAF6fDQytCcUB7FotzrmzrQ== X-Greylist: Sender IP whitelisted by DNSRBL, not delayed by milter-greylist-4.5.11 (asterix.imp.ch [0.0.0.0]); Tue, 06 Oct 2020 11:01:10 +0200 (CEST) X-MS-Office365-Filtering-Correlation-ID: 16b0e999-96f4-47ef-702e-08d869d65956 X-Original-Envelope-Sender: outlook_3dddb25f0278f...@outlook.com Thread-Topic: Festnetz-Telefon Verbindungen To: "supp...@breitband.ch" <supp...@breitband.ch> A look in our postfix logs confirms, the envelope also was outlook_3dddb25f0278f...@outlook.com When replying of course: ----- Transcript of session follows ----- ... while talking to outlook-com.olc.protection.outlook.com.: >>> DATA <<< 550 5.5.0 Requested action not taken: mailbox unavailable (S2017062302). [SN1NAM04FT023.eop-NAM04.prod.protection.outlook.com] 550 5.1.1 <outlook_3dddb25f0278f...@outlook.com>... User unknown <<< 503 5.5.2 Need rcpt command [SN1NAM04FT023.eop-NAM04.prod.protection.outlook.com] Mit freundlichen Grüssen -Benoît Panizzon- -- I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://www.imp.ch ______________________________________________________ _______________________________________________ mailop mailing list mailop@mailop.org https://list.mailop.org/listinfo/mailop
