Email Header, Person on to: was not reviving CC Person gets it

Hello
we are using a Exchange Server 2010 and MS Outlook 2007.
This week one of our internal colleagues received an Email on "cc",
but the person in the "to:" field was not reviving the mail.

Sender was an external company. During one of them (the cc person) received the mail I think its not an Firewall / Antivirus topic.

The full header of the mail is below
and here is one short part of it which may cause the problem?

Received: from mx1.ext.de (mx1.ext.de [123..43.155.4])      by
 mail-04-ext.dyndns.com (Postfix) with ESMTP id 5B8a56E8C52      for
 <user_cc@company.com>; Wed,  2 Oct 2013 07:20:02 +0000 (UTC)

this Part of the header only includes the CC Person anyway the main person was includet later. I have no ideas why this Person was not able to get this message.

Also interesting:
The Exchange Mail Massage Tracking Log was also not receiving this Email (only the CC Person shows up) and we have no error logs in Firewall or Antivirus!







Here is the full Header of the Email:

Received: from mail-04-ext.dyndns.com (111.111.111.1) by mail.company.com
 (222.222.222.222) with Microsoft SMTP Server id 333.333.333.333; Wed, 2 Oct 2013
 09:20:09 +0200

X-Mail-Handler: MailHop by DynDNS
X-Originating-IP: 194.76.156.4

Received: from mx1.ext.de (mx1.ext.de [123..43.155.4])      by
 mail-04-ext.dyndns.com (Postfix) with ESMTP id 5B8a56E8C52      for
 <user_cc@company.com>; Wed,  2 Oct 2013 07:20:02 +0000 (UTC)

Received: from webmail.extcomp.de ([145.253.126.51])      by mx1.exts.de
 (8.14.5/8.14.5) with ESMTP id r927HkXn014253;      Wed, 2 Oct 2013 09:17:46 +0200


In-Reply-To: <AEE24521C1587443B023308UF8BD9550195D5C15@serv.domain.local>
References: <AEE24521C1587443B023308UF8BD9550195D5C15@serv.domain.local>
Subject: Antwort: Presentation
X-KeepSent: 11E08E17:5ECFF13B-C1257BF8:00280DED;
 type=4; name=$KeepSent


To: Internal User <internal.user@company.com>
CC: User_cc <user_cc@company.com>
Message-ID: <OF11E08E17.5ECFE17A-ONC1257BF8.00280DED-C1257BF8.002815C7@ds-bremen.de>
From: external user <ext@extcomp.de>
Date: Wed, 2 Oct 2013 09:17:49 +0200
MIME-Version: 1.0
Content-Type: multipart/mixed;
      boundary="0__=4EBBF16BDFB44zuid489e8a93df938690918c4EBBF16BDFBB8B7D"
Content-Disposition: inline
Return-Path: prvs=1987fe30c0= external.user@extcomp.de


X-MS-Exchange-Organization-AuthSource: serv.domain.local
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Exchange-Organization-PRD: extcomp.de
X-MS-Exchange-Organization-SenderIdResult: None


Received-SPF: None (serv.domain.local: ext@extcomp.de  does not designate
 permitted sender hosts)


X-MS-Exchange-Organization-Antispam-Report: SenderOnRecipientSafeSendersList
X-MS-Exchange-Organization-SCL: -1
X-TM-AS-Product-Ver: SMEX-10.5.0.1057-7.000.1014-20188.004
X-TM-AS-Result: No--24.889900-5.000000-31
X-TM-AS-User-Approved-Sender: No
X-TM-AS-User-Blocked-Sender: No
X-MS-Exchange-Organization-AVStamp-Mailbox: SMEXr^dE;2387456;0;This mail has
 been scanned by Security Agent;


Any ideas?
Thanks
HelpdeskJBCAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Chinthaka_ShameeraCommented:
Please can you more elaborate below statements.

1) but the person in the "to:" field was not reviving the mail.  ?

This To filed should contain your Internal employee email address ?  

Regards
0
unknown_routineCommented:
On scenario this can happen is the Account of person who was CC'ed is setup as Pop3.


So go to outlook for this person and see if that's the case and change it to IMAP.
0
HelpdeskJBCAuthor Commented:
Both (the mail To Person and the mail cc Person) are internal members. The Mail comes from an external company.

The Exchange Server itself only gets the cc Email in the System (shown on Message Tracking)

Yes the Person in the mail "To" field was not receiving the email, but the cc person did!
It was some kind of luck that we noticed this, because the cc person asks the "to" person about the email and he answered which email? ...

During the Mail was not shown up on message tracking we don't need to check junk email folders etc. (I checked it anyway)

Could anyone check the header is this the normal way they work? (cc person shows up on top receive for...)
0
Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

Chinthaka_ShameeraCommented:
Check To person's OWA whether email may there or not ?

run below cmdlet and post result here. Change the parameters as you configuration.

get-messagetrackinglog -Recipients:external user -Sender "internaluser" -Start "10/3/2013 6:27:00 PM" -End "10/3/2013 6:37:00 PM" | FL
0
HelpdeskJBCAuthor Commented:
[PS] C:\Windows\system32>get-messagetrackinglog -Recipients: "compinternal.user@ourcompany.com" -Sender "external_user@extcompany" | FL

As mentioned the cc person is in the log but the main recipient is missing in the log.
I can search for messages from this external guy to the main recipient but there are only other emails shown in the log not that email with the subject "Presentation" this email only shows up to the CC guy.


RunspaceId              : 5ba9bb64-cad5-49ef-baa1-06afde8cc7a3
Timestamp               : 02/10/2013 09:20:10
ClientIp                : 111.222.333.23
ClientHostname          : mail-04-ewr.dyndns.com
ServerIp                : 123.456.789.2
ServerHostname          : Mailserver
SourceContext           : 08D03D7555649F9F;2013-10-02T07:20:09.272Z;0
ConnectorId             : MAILSERVER\Default MAILSERVER
Source                  : SMTP
EventId                 : RECEIVE
InternalMessageId       : 813095
MessageId               : <OF11E08E17.5ECFE17A-ONC1257BF8.00280DED-C1257BF8.002815C7@extcompany>
Recipients              : {compinternal.user@ourcompany.com}
RecipientStatus         : {}
TotalBytes              : 10910
RecipientCount          : 1
RelatedRecipientAddress :
Reference               :
MessageSubject          : Antwort: Presentation
Sender                  : external_user@extcompany
ReturnPath              : prvs=1987fe30c0=external_user@extcompany
MessageInfo             : 00A: NTS:
MessageLatency          :
MessageLatencyType      : None
EventData               : {[FirstForestHop, mailserver.domain.local]}



RunspaceId              : 5ba9bb64-cad5-49ef-baa1-06afde8cc7a3
Timestamp               : 02/10/2013 09:20:10
ClientIp                :
ClientHostname          : Mailserver
ServerIp                :
ServerHostname          :
SourceContext           : Transport Rule Agent
ConnectorId             :
Source                  : AGENT
EventId                 : DEFER
InternalMessageId       : 813095
MessageId               : <OF11E08E17.5ECFE17A-ONC1257BF8.00280DED-C1257BF8.002815C7@extcompany>
Recipients              : {compinternal.user@ourcompany.com}
RecipientStatus         : {, }
TotalBytes              : 0
RecipientCount          : 1
RelatedRecipientAddress :
Reference               :
MessageSubject          : Antwort: Presentation
Sender                  : external_user@extcompany
ReturnPath              : prvs=1987fe30c0=external_user@extcompany
MessageInfo             : 02/10/2013 09:20:10
MessageLatency          :
MessageLatencyType      : None
EventData               :

RunspaceId              : 5ba9bb64-cad5-49ef-baa1-06afde8cc7a3
Timestamp               : 02/10/2013 09:20:14
ClientIp                :
ClientHostname          : Mailserver
ServerIp                :
ServerHostname          : mailserver
SourceContext           : 08D03D7555649FA3;2013-10-02T07:20:14.186Z;0
ConnectorId             :
Source                  : STOREDRIVER
EventId                 : DELIVER
InternalMessageId       : 813095
MessageId               : <OF11E08E17.5ECFE17A-ONC1257BF8.00280DED-C1257BF8.002815C7@extcompany>
Recipients              : {compinternal.user@ourcompany.com}
RecipientStatus         : {}
TotalBytes              : 12238
RecipientCount          : 1
RelatedRecipientAddress :
Reference               :
MessageSubject          : Antwort: Presentation
Sender                  : external_user@extcompany
ReturnPath              : prvs=1987fe30c0=external_user@extcompany
MessageInfo             : 2013-10-02T07:20:09.896Z;SRV=mailserver.domain.local:TOTAL=4|QS=3
MessageLatency          : 00:00:04.3680000
MessageLatencyType      : EndToEnd
EventData               : {[MailboxDatabaseName, mailbox], [DatabaseHealth, -1]}
0
Chinthaka_ShameeraCommented:
Please check your Transport Rules. EventId   : DEFER will happen when you have transport rule matching the TO Field .

YOu can see transport rule agent is there as Source context.
0
HelpdeskJBCAuthor Commented:
We are blocking incoming emails from:
mail-01-ewr.dyndns.com
This was implemented during spam in the past.


Current Mail Header:
Received: from mx1.melchers.de (mx1.melchers.de [194.76.156.4])      by
 mail-04-ewr.dyndns.com (Postfix) with ESMTP id 5B8DC7E8C52      for
 <comp_internal@our_company.com>; Wed,  2 Oct 2013 07:20:02 +0000 (UTC)

Could this be the problem?
0
Chinthaka_ShameeraCommented:
Did you check if there any Transport rule effect TO: ?
0
HelpdeskJBCAuthor Commented:
some of them, but they work with distribution lists disallow sending outside the organization etc. But the Person is not a member of this lists.

Also one rule include not allow sending from outside to outside.

So any other ideas?
0
Chinthaka_ShameeraCommented:
What is outside to outside ?
It should be Inside to Outside or Outside to Inside
0
HelpdeskJBCAuthor Commented:
we don't allow outside emails addresses to send to outside emails addresses
also called "open relay" but this is not the problem here.
0
Chinthaka_ShameeraCommented:
I don't think we should be abot to diagnostic more.
What you can do is, please enable Pipeline Trace and reproduce the problem.
0
Chinthaka_ShameeraCommented:
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
HelpdeskJBCAuthor Commented:
At the moment we don't want to contact the customer for sending "Test" Emails.

Could you take one more look to the email header on the first post?


Received: from mx1.melchers.de (mx1.melchers.de [194.76.156.4])        by
mail-04-ewr.dyndns.com (Postfix) with ESMTP id 5B8DC7E8C52                for
<Mail_on_CC_internal.member@our_company.com>; Wed,  2 Oct 2013 07:20:02 +0000 (UTC)

On other Emails from the client this lines above are not included. It says that there is one more server (DynDNS) included as usual.

And more interesting in each other email (other company other persons) which also have this additional Mail Server included (not only dyndns)... all of them have the "main" the "Mail To" person in this reference and not! the cc Person!

This is the only strange thing I can see any other ideas?

Thanks
0
HelpdeskJBCAuthor Commented:
Never mind no futher problems still dont know what couses this missing email
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.