• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 372
  • Last Modified:

Exchange 2003 rewrite internal mail issue


I have an Exchange 2003 environment companya.com
An incoming email was sent to rquinn@companya.com when it got to the internal user the recipient address had changed to rquinn@nnn.com ">"

The  ">" is correct then was in the to: field in Outlook.
nnn.com is not an internal address.

Looking at the spam filtering logs its shows the incoming mail correctly as rquinn@companya.com

Here are the headers from the mail.
Anyone know what could be going on here.

Microsoft Mail Internet Headers Version 2.0
Received: from dnexgw02.companya.com ([]) by DNEXVS02.companya.com with Microsoft SMTPSVC(6.0.3790.4675);
                Thu, 31 Jan 2013 15:08:58 +0000
Received: from emps3.companya.com ([]) by dnexgw02.companya.com with Microsoft SMTPSVC(6.0.3790.4675);
                Thu, 31 Jan 2013 15:08:57 +0000
Subject: [WARNING :  MESSAGE ENCRYPTED]Your January 2013 VOIP eBilling Report
Received: from traffic.cccgroup.com ([])
  by emps4.companya.com with ESMTP/TLS/AES128-SHA; 31 Jan 2013 15:08:57 +0000
Received: from TRAFFIC.cccgroup.com ([::1]) by traffic.cccgroup.com ([::1])
with mapi id 14.02.0318.004; Thu, 31 Jan 2013 15:08:55 +0000
From: Data Processing <dataprocessing@cccgroup.com>
To: 'Ronan' <RQuinn@nnn.com ">">
Thread-Topic: Your January 2013 VOIP eBilling Report
Thread-Index: Ac3/sltT4TmIguD2TLGBKyJPS/FnOg==
Content-Class: urn:content-classes:message
Date: Thu, 31 Jan 2013 15:08:55 +0000
Message-ID: <C09AA79A002C2947B16C8733590BD57D012EF6C0@traffic.cccgroup.com>
Accept-Language: en-GB, en-US
Content-Language: en-US
X-MS-Has-Attach: yes
x-originalarrivaltime: 31 Jan 2013 13:14:18.0994 (UTC)
x-originating-ip: []
Content-Type: multipart/mixed;
MIME-Version: 1.0
Return-Path: dataprocessing@cccgroup.com

Content-Type: text/plain; charset="us-ascii"
Content-ID: <F5C078E429956045B11A4CB92FB50EEC@cccgroup.com>
Content-Transfer-Encoding: quoted-printable

Content-Type: application/x-zip-compressed; name="companya_4746_2.zip"
Content-Description: companya_4746_2.zip
Content-Disposition: attachment; filename="companya_4746_2.zip"; size=133860;
                creation-date="Thu, 31 Jan 2013 13:31:06 GMT";
                modification-date="Thu, 31 Jan 2013 13:31:06 GMT"
Content-ID: <1D51C19EEE52BC4A84448391A80D8CD6@cccgroup.com>
Content-Transfer-Encoding: base64


  • 3
1 Solution
Manpreet SIngh KhatraSolutions Architect, Project LeadCommented:
Does user has some Forwarding ?
Is this happening for some or all users ?

- Rancy
joe90kaneAuthor Commented:
Hi Rancy,

No forwarding setup and Exarcfg.EXE -l shows no rewrites.
joe90kaneAuthor Commented:
Ended up being an issue with spam filter appliance
joe90kaneAuthor Commented:
Fixed myself
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

We Need Your Input!

WatchGuard is currently running a beta program for our new macOS Host Sensor for our Threat Detection and Response service. We're looking for more macOS users to help provide insight and feedback to help us make the product even better. Please sign up for our beta program today!

  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now