locked
@corp.com appears in email address... RRS feed

  • Question

  • Hello everyone,
    just so you know, I'm not an expert in Exchange Server Administration, but I hope that this is the place where experts live and somebody will be able to explain to me - in plain English - the meaning of domain name "corp.com".
    We have software that processes Outlook mailboxes and extracts metadata for mail items. Some of these items have <From> field populated with something like "some_name@corp.com".
    So, we need to know what this "corp.com" stands for as our clients are really concerned about that.
    By the way, when addresses extracted in X.400 format, they would read like this:
    some_name </O=CORP/OU=FIRST ADMINISTRATIVE GROUP/CN=RECIPIENTS/CN=some_name>
     
    We know that organization name is not "corp" and domain is not "@corp.com" So, where this "corp.com" comes from?

    Any help would be greatly appreciated.

    Thank you in advance.
    Thursday, June 23, 2011 6:57 PM

Answers

  • It's their Exchange org name for sure, but could also be their AD domain name and also will be one of their SMTP addresses configured in Exchange. It's possible that even within the same user you can see multiple SMTP addresses, the user could be specifying what SMTP address he wants to send from. Also if they have a complex topology doing SMTP namespace sharing with multiple forests you can see this behavior too as internal SMTPs are used for routing between their forests.
    James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com
    • Marked as answer by Jerome Xiong Monday, July 4, 2011 3:10 AM
    Thursday, June 23, 2011 7:42 PM
  • Ok, with a little more info you've given, then it would be exch org name for the company that you're looking into.  As the PST file comes from your clients, the info your're extracting from the message using your software from the from field belongs to the clients PST, therefore you are extracting their information.

    The different emails you are seeing in the From filed are as mentioned above also, it could be that the clients Exch Org has multiple email addresses and that some users may be sending an email using the sendas permission so it appears different as your seeing, for e.g, person_name>@somedomain.com in one email and <person_name>@corp.com


    Sukh
    • Marked as answer by Jerome Xiong Monday, July 4, 2011 3:12 AM
    Thursday, June 23, 2011 7:53 PM
  • It's not the default, it;s a choice when someone installs Exch. See below on install for exch 2003.

    http://technet.microsoft.com/en-us/library/bb124186(EXCHG.65).aspx

    "Also, do you think we could find info on that in "official" documentation from Microsoft so that we could defend our case before the client?"

    Not sure exactly what your looking for but you have proof, as you have the PST files, all one would have to do is ask the court to ask the 3rd party for an  email or verofy that that email you have is from there's.

     


    Sukh
    • Marked as answer by Jerome Xiong Monday, July 4, 2011 3:11 AM
    Thursday, June 23, 2011 8:03 PM

All replies

  • This would be your Exch Organisation name

     

    Not sure what Exch version youre using but see this - http://social.technet.microsoft.com/Forums/en-US/exchangesvrmigration/thread/8d59411d-2425-4c04-a93a-5baacd772ab1/


    Sukh

    Thursday, June 23, 2011 7:06 PM
  • Hello Sukh828,

    thank you for your prompt response.

    The thing is that we're processing standalone PST files that were given to us by our clients. We're litigation support service bureau and for processing we use Litigation Support Software and MS Outlook which we're setting up locally with dummy email account and without emailing capabilities. So, I don't think that Exch version is relevant here. More over, should this be our Organization name, it would appear, I assume, in email addresses for all emails, but that is not the case. Also, there are instances where the same person could have address like <person_name>@somedomain.com in one email and <person_name>@corp.com in another. And it's all in the same PST file.

    Are you aware of situations when this "corp.com" appears in email address? Name cannot be resolved, for example, or something else.

    I hope you could bear with me a little longer.

    Thank you.

    Thursday, June 23, 2011 7:34 PM
  • It's their Exchange org name for sure, but could also be their AD domain name and also will be one of their SMTP addresses configured in Exchange. It's possible that even within the same user you can see multiple SMTP addresses, the user could be specifying what SMTP address he wants to send from. Also if they have a complex topology doing SMTP namespace sharing with multiple forests you can see this behavior too as internal SMTPs are used for routing between their forests.
    James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com
    • Marked as answer by Jerome Xiong Monday, July 4, 2011 3:10 AM
    Thursday, June 23, 2011 7:42 PM
  • Ok, with a little more info you've given, then it would be exch org name for the company that you're looking into.  As the PST file comes from your clients, the info your're extracting from the message using your software from the from field belongs to the clients PST, therefore you are extracting their information.

    The different emails you are seeing in the From filed are as mentioned above also, it could be that the clients Exch Org has multiple email addresses and that some users may be sending an email using the sendas permission so it appears different as your seeing, for e.g, person_name>@somedomain.com in one email and <person_name>@corp.com


    Sukh
    • Marked as answer by Jerome Xiong Monday, July 4, 2011 3:12 AM
    Thursday, June 23, 2011 7:53 PM
  • Hi Jamestechman,

    now it's getting warmer. It was our uneducated guess that this might come from the PSTs we're getting and not some glitch in our software. Do you think that this "corp" could be default or generic Org name for setting up Exchange in corporate environment? Sorry if my terminology is off.

    Also, do you think we could find info on that in "official" documentation from Microsoft so that we could defend our case before the client?

    Thank you.

     

    Thursday, June 23, 2011 7:55 PM
  • It's not the default, it;s a choice when someone installs Exch. See below on install for exch 2003.

    http://technet.microsoft.com/en-us/library/bb124186(EXCHG.65).aspx

    "Also, do you think we could find info on that in "official" documentation from Microsoft so that we could defend our case before the client?"

    Not sure exactly what your looking for but you have proof, as you have the PST files, all one would have to do is ask the court to ask the 3rd party for an  email or verofy that that email you have is from there's.

     


    Sukh
    • Marked as answer by Jerome Xiong Monday, July 4, 2011 3:11 AM
    Thursday, June 23, 2011 8:03 PM
  • hi,

    Go to ADSI Edit and on CN=Configuration->CN=Services->CN=Microsoft Exchange->CN=First Organization->CN=Administrative Groups->CN=Exchange Administrative Group->CN=Routing Groups->CN=Exchange routing Group->CN=Connections->CN=Send Connector to Internet

     

    Right click the connector, select the properties, in the Security tab, set to Deny the Send Routing Headers for ANONYMOUS LOGIN

     

    Then restart the Microsoft Transport service on the Hub server and Edge server.


    Mumin CICEK | www.cozumpark.com | Please click Vote As Helpful if it is helpful for you and Propose as Answer!!!
    Thursday, June 23, 2011 8:10 PM
  • Not to be too pedantic, but note that its the legacyExchangeDN in x500 format you are seeing:

    </O=CORP/OU=FIRST ADMINISTRATIVE GROUP/CN=RECIPIENTS/CN=some_name>

    Not the x.400.

     

     

    Thursday, June 23, 2011 8:14 PM
  • Not default as mentioned, btw the company I work for we chose similar corp.DOM to be as generic as possible. 
    James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com
    Thursday, June 23, 2011 8:17 PM
  • I guess at this point I'm going to thank you all who replied - Sukh828, Jamestechman and Mumin CICEK - for you your invaluable input and for being patient with me.

    Now I do have something that I could give to the client to prove that it was not our wrongdoing but actual metadata derived from the PSTs we have processed. And this "3rd party" suggestion might be good, too.

    If anybody still have something to say on this matter - please do as I'm going to monitor this post tomorrow.

    Best regards and have a great day.

     

    THank you.

     

    Thursday, June 23, 2011 8:24 PM
  • Hi,

     

     

    I think you could find “corp.com” from one of the below places.

    1.E-mail address attribute of the user.

    2. Send as permission list.


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Monday, June 27, 2011 7:23 AM