I have a user who is recieving an email from an external domain that is not showing up correctly. The message shows up in Outlook (Outlook 2003 with Exchange settings) and OWA without a To, From, or Subject. The message body shows up as (refrences to IPs and domains/email addresses have been changed):
X-Mailer: Groupwise 6.5
From: "Sender" <firstname.lastname@example.org>
X-ASG-Orig-Subj: Re: FW: Lowe file
Subject: Re: FW: Lowe file
To: "Reciever" <email@example.com>
Content-Type: multipart/alternative; boundary="____LPHMXLZMXOMRLFKSEJCW____"
X-MessageScreenContentScore: Score of 0 assigned to Content
X-MessageScreenUCEScore: Score of 0 assigned to UCE
X-MessageScreen: Analyzed by IntelliReach MessageScreen(tm) http://www.intellireach.com
X-Barracuda-Virus-Scanned: by Barracuda Spam Firewall at recievingdomain.com
X-OriginalArrivalTime: 03 Jul 2007 14:36:41.0064 (UTC) FILETIME=[91F5A680:01C7BD7F]
Content-Type: text/plain; charset=utf-8
[encoded text removed]
Content-Type: multipart/related; boundary="____WHPEPQYSAQXEHDGESJXG____"
Content-Type: text/html; charset=utf-8
[encoded text removed]
When I check the header of the message from Outlook it shows up as:
Microsoft Mail Internet Headers Version 2.0
Received: from barracuda.recievingdomain.com ([192.168.1.130]) by mail1.recievingdomain.com with Microsoft SMTPSVC(6.0.3790.1830);
Tue, 3 Jul 2007 10:36:41 -0400
Received: from mail1.recievingdomain.com (unknown [192.168.1.131])
by barracuda.recievingdomain.com (Spam Firewall) with ESMTP id 38FC91A331F
for <firstname.lastname@example.org>; Tue, 3 Jul 2007 09:42:53 -0400 (EDT)
Received: from msg2.sendingdomain.com ([sender IP])
by mail1.recievingdomain.com with ESMTP; 03 Jul 2007 09:42:32 -0400
Received: from nsfscan.sendingdomain.net (nsfscan.INT.sendingdomain.COM [sender IP] (may be forged))
by msg2.sendingdomain.com (8.13.8/8.13.8) with SMTP id l63DgTsE014929
for <email@example.com>; Tue, 3 Jul 2007 08:42:30 -0500 (CDT)
Received: from 210gwinet.int.sendingdomain.com ([sender IP])
by nsfscan.sendingdomain.net (SMSSMTP 126.96.36.199) with SMTP id M2007070308422907491
for <firstname.lastname@example.org>; Tue, 03 Jul 2007 08:42:29 -0500
Received: from Webdom-MTA by 210gwinet.int.sendingdomain.com
with Novell_GroupWise; Tue, 03 Jul 2007 08:42:29 -0500
Date: Tue, 3 Jul 2007 08:41:59 -0500
I have two anti-spam devices (an IronPort C350 followed by a Barracuda Spam Firewall 400) in front of my Exchange server (Exchange 2003 SP2 in an active/passive cluster running on Windows Server 2003 SP1 EE). When I check the message on my Barracuda it shows up correctly when I choose View Message (which shows the HTML formated message). When I choose View Source it shows the full source of the email with the header above, a blank line, and then the message body from above.
We have recieved other emails from this same domain that have come through correctly. I checked the header of one of those and the only difference was that the References line wasn't there and that the X-Mailer was Novell GroupWise Internet Agent 7.0.2 HP instead of Groupwise 6.5 (the from servers and IPs are the same). The same sender has resent this message several times with the same result. That sender has also sent a different email with the same result. These are the only emails we are seeing with this issue.
I believe that this is caused by the senders email server, however I am not certain as this message shows up correctly in the Barracuda. Is this a bug with Exchange? Is it related to the References header? The email is getting to the correct reciepient, even though the To line is showing up in the body, so obviously the Exchange server is reading that line correctly. Maybe this is a bug in the clients (OWA and Outlook).
Any help would be greatly appreciated. Thanks in advance.
Have you figured this out?
Whenever my church sends out an e-mail, it sends out 2 e-mails. The first one appears fine althought it says it has an attachment and does not. The second one says "Unknown sender" and appears exactly as you described above. I have no idea why... and I need to fix this problem!