Solved

From field in Exchange 2007 Queue viewer showing up as <>

Posted on 2013-01-24
7
337 Views
Last Modified: 2013-02-02
Hello,

To understand my problem, I must first describe my setup and intentions.

I'm currently trying to setup journaling to a cloud based archive vendor. In order to do this, I must use a mail enabled contact for my journaling rule journaling@journal.contoso.com (My normal mail domain is contoso.com, and journal.contoso.com is a non-routable domain).

In conjunction with the mail enabled contact, I have a send connector setup to route any mail destined for *@journal.contoso.com to our smarthost, archiving.smarthost.com.

Currently, we are sending journaled mail to the smarthost just fine. The problem is, some of these messages don't display the From Address correctly, they just show up as <>.

Upon further inspection, I determined that this is occurring in our queue viewer, and is not on the smarthosts end.

Here's where it gets weird. Exchange only does this with external email addresses, not internal, and it doesn't do it to all external address either; some of them show up just fine. On the messages missing the from field, I have verified that they are legit messages, not SPAM. I can see no difference between the messages where Exchange strips the From Address, and the ones where Exchange leaves it alone.

Currently, I have two servers running HT & CAS roles, two Edge servers, and a mailbox cluster.


Any ideas at all? It is greatly appreciated.
0
Comment
Question by:txgoalie
  • 4
  • 2
7 Comments
 
LVL 20

Expert Comment

by:agonza07
ID: 38817286
0
 
LVL 49

Expert Comment

by:Akhater
ID: 38817847
These are DSN (Delivery Status Notification) messages -mostly NDRs and rejection messages etc...- there is nothing to worry about
0
 

Author Comment

by:txgoalie
ID: 38819390
I can guarantee with 100% certainty that these are not NDR's, at least not all of them. I've verified the emails are good, from known good senders, and have checked with my users to verify the legitimacy of the mail.

What I've noticed is, when Exchange forwards the message to journaling@journal.contoso.com , it changes the sender address from the original sender, to a very long Exchange email address. The problem is, it does this for all journaled messages, good and bad.


Also, I appreciate the replies, sorry for not mentioning that already.
0
Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

 
LVL 49

Expert Comment

by:Akhater
ID: 38821976
I didn't say they are all NDR's i told you these are DSN, if someone is sending an email and it was queued for a period of time for any reason it will also get a DSN.

Also you could see somtimes duplicates. i.e. the same email one with the correct sender showing and the other with just <>

again, if we are not talking about 100's of them, i wouldn't worry about it
0
 

Author Comment

by:txgoalie
ID: 38829166
Fair enough, then by your explanation, what is happening seems to be that Exchange is using the DSN from address to send mail out of my send connector for journaling. I know this because my cloud archiving service is getting the <> messages with no duplicates with a good From Address.

For instance, under your theory, for every <> in my cloud archive, I should also be seeing a positive duplicate entry with a good From Address, but I don't. Only the <> messages appear.

So, is it normal for Exchange to use the DSN address to send the journal report?
0
 

Accepted Solution

by:
txgoalie earned 0 total points
ID: 38829433
Scratch that, it is normal behavior. Everything sent to the journaling@journal.contoso.com address is sent via postmaster.

So, everything is sent to my cloud archive with a from address of <>, because it's not forwarding or relaying a message, it's actually a new message; the journal report. The postmaster sends the journal report, with the original message attached.

The issue is on my cloud archiving solution's end. They're not resolving all of the From Addresses.

Thanks for the feedback.
0
 

Author Closing Comment

by:txgoalie
ID: 38846430
This was the correct answer.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Join & Write a Comment

Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…
how to add IIS SMTP to handle application/Scanner relays into office 365.

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now