Cisco Ironport ESA Not Showing From Header in Message Tracking Logs
Posted on 2014-09-05
I have a Cisco Ironport C370 Appliance, ASync OS version 7.6.3-019, I noticed in the Message Tracking Details logs, that there is no From field in the message header. Instead there is "Envelope Sender". The issue we are seeing is if a recipient in our Exchange 2010 environment receives certain e-mails, they contain a From header, and will show one e-mail address. For example firstname.lastname@example.org. However, in some cases, I see that the message tracking details do not contain any reference to the email@example.com e-mail address, instead they are showing a completely different e-mail domain under the Envelope Sender. This is especially the case when some automated systems/mailing companies are used to send e-mail.
The problem is, user's report to us that they aren't receiving e-mail from firstname.lastname@example.org, yet when we search the message tracking logs for email@example.com, it yields no results. So we are not able to effectively troubleshoot, add domain exclusions for abccompany.com.
Any ideas if this is by design on the Cisco Ironport ESA appliances? How can we get around this issue? Is there any way to display the From header?
Thank you in advance.