Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium


Exchange 2003 rewrite internal mail issue

Posted on 2013-02-01
Medium Priority
Last Modified: 2013-06-11

I have an Exchange 2003 environment companya.com
An incoming email was sent to rquinn@companya.com when it got to the internal user the recipient address had changed to rquinn@nnn.com ">"

The  ">" is correct then was in the to: field in Outlook.
nnn.com is not an internal address.

Looking at the spam filtering logs its shows the incoming mail correctly as rquinn@companya.com

Here are the headers from the mail.
Anyone know what could be going on here.

Microsoft Mail Internet Headers Version 2.0
Received: from dnexgw02.companya.com ([]) by DNEXVS02.companya.com with Microsoft SMTPSVC(6.0.3790.4675);
                Thu, 31 Jan 2013 15:08:58 +0000
Received: from emps3.companya.com ([]) by dnexgw02.companya.com with Microsoft SMTPSVC(6.0.3790.4675);
                Thu, 31 Jan 2013 15:08:57 +0000
Subject: [WARNING :  MESSAGE ENCRYPTED]Your January 2013 VOIP eBilling Report
Received: from traffic.cccgroup.com ([])
  by emps4.companya.com with ESMTP/TLS/AES128-SHA; 31 Jan 2013 15:08:57 +0000
Received: from TRAFFIC.cccgroup.com ([::1]) by traffic.cccgroup.com ([::1])
with mapi id 14.02.0318.004; Thu, 31 Jan 2013 15:08:55 +0000
From: Data Processing <dataprocessing@cccgroup.com>
To: 'Ronan' <RQuinn@nnn.com ">">
Thread-Topic: Your January 2013 VOIP eBilling Report
Thread-Index: Ac3/sltT4TmIguD2TLGBKyJPS/FnOg==
Content-Class: urn:content-classes:message
Date: Thu, 31 Jan 2013 15:08:55 +0000
Message-ID: <C09AA79A002C2947B16C8733590BD57D012EF6C0@traffic.cccgroup.com>
Accept-Language: en-GB, en-US
Content-Language: en-US
X-MS-Has-Attach: yes
x-originalarrivaltime: 31 Jan 2013 13:14:18.0994 (UTC)
x-originating-ip: []
Content-Type: multipart/mixed;
MIME-Version: 1.0
Return-Path: dataprocessing@cccgroup.com

Content-Type: text/plain; charset="us-ascii"
Content-ID: <F5C078E429956045B11A4CB92FB50EEC@cccgroup.com>
Content-Transfer-Encoding: quoted-printable

Content-Type: application/x-zip-compressed; name="companya_4746_2.zip"
Content-Description: companya_4746_2.zip
Content-Disposition: attachment; filename="companya_4746_2.zip"; size=133860;
                creation-date="Thu, 31 Jan 2013 13:31:06 GMT";
                modification-date="Thu, 31 Jan 2013 13:31:06 GMT"
Content-ID: <1D51C19EEE52BC4A84448391A80D8CD6@cccgroup.com>
Content-Transfer-Encoding: base64


Question by:joe90kane
  • 3
LVL 52

Expert Comment

by:Manpreet SIngh Khatra
ID: 38843261
Does user has some Forwarding ?
Is this happening for some or all users ?

- Rancy

Author Comment

ID: 38843865
Hi Rancy,

No forwarding setup and Exarcfg.EXE -l shows no rewrites.

Accepted Solution

joe90kane earned 0 total points
ID: 39227347
Ended up being an issue with spam filter appliance

Author Closing Comment

ID: 39237157
Fixed myself

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Eseutil Hard Recovery is part of exchange tool and ensures Exchange mailbox data recovery when mailbox gets corrupt due to some problem on Exchange server.
Mailbox Corruption is a nightmare every Exchange DBA wishes he never has. Recovering from it can be super-hectic if not entirely futile. And though techniques like the New-MailboxRepairRequest cmdlet have been designed to help with fixing minor corr…
how to add IIS SMTP to handle application/Scanner relays into office 365.
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an anti-spam), the admin…
Suggested Courses

578 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question