Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - Strange behaviour with CC and TO
  FAQ FAQ  Forum Search   Register Register  Login Login

Strange behaviour with CC and TO

 Post Reply Post Reply
Author
Wayne View Drop Down
Groupie
Groupie
Avatar

Joined: 29 August 2006
Location: Switzerland
Status: Offline
Points: 60
Post Options Post Options   Thanks (0) Thanks(0)   Quote Wayne Quote  Post ReplyReply Direct Link To This Post Topic: Strange behaviour with CC and TO
    Posted: 15 September 2011 at 5:38am
Hi Roberto
Finally I have a little problem again with the current release of SF and have to bother you Wink

We have the problem, that we often get a email, always from the same sender, who send these mails to one or two users addressed in the RCPT TO: field and one or two in the CC:
Strange behaviour is, the guys in the the CC: get the mail, one of the TO: also, but mostly one in the TO: not and it's allways the same user.

I'll try to explain with the Log's:

09.14.11 04:14:28:358 -- (1932) Detected TCP Connection: 98.139.91.96
09.14.11 04:14:28:358 -- (1932) Connection from: 98.139.91.96  -  Originating country : United States
09.14.11 04:14:28:733 -- (1932) Received MAIL FROM: <marge@gemagpp.com>
09.14.11 04:14:28:920 -- (1932) Received RCPT TO: g.ahrendt@mydomain.ch
09.14.11 04:14:28:920 -- (1932) Bypassed all rules for: g.ahrendt@mydomain.ch from marge@gemagpp.com ( Whitelisted EMail Address From)
09.14.11 04:14:29:811 -- (1932) Starting queueing procedures
09.14.11 04:14:29:826 -- (1932) EMail from marge@gemagpp.com to g.ahrendt@mydomain.ch was queued. Size: 18 KB, 18432 bytes
09.14.11 04:14:29:826 -- (888) Sending email from marge@gemagpp.com to g.ahrendt@mydomain.ch --
09.14.11 04:14:34:967 -- (1932) Starting bayesian procedures
09.14.11 04:14:35:155 -- (1932) Disconnect

Looks everything just as usual, but if you have a look at the header of the email, you will recognize there is one recipient more, and the guy who get the mail is not in the TO: field how the SF log lies to me, he's in the CC

Received: from mail.mydomain.ch (172.17.36.2) by EXGEMA.myinternaldomain.ads
 (172.17.36.75) with Microsoft SMTP Server id 8.3.159.2; Wed, 14 Sep 2011
 04:14:33 +0200
Received: from 98.139.91.96 by mail.mydomain.ch (LogSat Software SMTP Server);
 Wed, 14 Sep 2011 04:14:29 +0200
Received: from [98.139.91.66] by nm26.bullet.mail.sp2.yahoo.com with NNFMP; 13
 Sep 2011 05:03:41 -0000
Received: from [98.139.91.53] by tm6.bullet.mail.sp2.yahoo.com with NNFMP; 13
 Sep 2011 05:02:41 -0000
Received: from [127.0.0.1] by omp1053.mail.sp2.yahoo.com with NNFMP; 13 Sep
 2011 05:02:41 -0000
X-Yahoo-Newman-Id: 456611.67652.bm@omp1053.mail.sp2.yahoo.com
Received: (qmail 31463 invoked from network); 13 Sep 2011 05:02:41 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1315890161; bh=9ze7KKmKWTiItY8PlW1nXxjdbK+ymnmgtbzrgAMPrqs=; h=X-Yahoo-Newman-Property:X-YMail-OSG:X-Yahoo-SMTP:Received:Return-Receipt-To:From:To:Cc:References:In-Reply-To:Subject:Date:Message-ID:MIME-Version:Content-Type:X-Priority:X-MSMail-Priority:X-Mailer:Importance:Thread-Index:Content-Language:Disposition-Notification-To; b=Tgd9HjZZ5h2CeJxXtd1k0Hd5Le6np/fTFD4KbuOrEbuIhNn7wMNL25v9Vsa11bexWDccK7IXiADPK9zysSs4rac1VU3T1UEw/fIMnvQGFFnTgzkANin+Cpy/Lu0wJjKyhsRWdUALMQzRdQtKNre5kgOUh2mH/anYS/FJCiAV5d8=
X-Yahoo-Newman-Property: ymail-3
X-YMail-OSG: .t7FvOYVM1kNqXzIGYpRLGrrbszZ33UG4n0Z8Q5vOFFh5Yc
 iIfyJmOLCD5UjKXvtOwnZ4C9bKgdohLogF9caimCjI6urXYUWTRcb9UOH4bR
 qqSqS8U0-
X-Yahoo-SMTP: jDvKeMqswBDGbotT02CRMr8zDHSm8fdgTRiOZjI2
Received: from DELLMARGE (marge@86.98.89.131 with login)        by
 smtp113.biz.mail.sp1.yahoo.com with SMTP; 12 Sep 2011 22:02:36 -0700 PDT
Return-Receipt-To: "Marge" <marge@gemagpp.com>
From: Marge <marge@gemagpp.com>
To: 'Christensen Sandra' <s.christensen@mydomain.ch>     <---- never received the mail
CC: 'Ahrendt Georg' <g.ahrendt@mydomain.ch>    <---- he got the mail
References: <528B040A4679FF4BAED4DB3C6EDD32A903437B6D53@EXGEMA.myinternaldomain.ads>
In-Reply-To: <528B040A4679FF4BAED4DB3C6EDD32A903437B6D53@EXGEMA.myinternaldomain.ads>
Subject: RE: Inquiry for Discount-Powder Hoses
Date: Tue, 13 Sep 2011 09:02:29 +0400
Message-ID: <!&!AAAAAAAAAAAYAAAAAAAAAEbRgNQv/uhLgXwWpGKhvE3CgAAAEAAAAOaFe2dJyoZLur42h25gZE0BAAAAAA==@gemagpp.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----=_NextPart_000_0026_01CC71F3.E0908120"
X-Priority: 1 (Highest)
X-MSMail-Priority: High
X-Mailer: Microsoft Office Outlook 12.0
Importance: High
Thread-Index: AcxQFA7Sxp3ibCibS0O+arh+hObWjQbtsCBAAAE64rAAAAeEAgAiVJSgADnlCkABJFGOkA==
Content-Language: en-us
Disposition-Notification-To: "Marge" <marge@gemagpp.com>
X-Server: LogSat Software SMTP Server
X-SF-RX-Return-Path: <marge@gemagpp.com>
X-SF-HELO-Domain: nm26.bullet.mail.sp2.yahoo.com
X-SF-Originating-IP: 98.139.91.96
X-SF-WhiteListedReason: Whitelisted EMail Address From
Return-Path: marge@gemagpp.com

Do you have any idea what happen here? It looks like this sender is always using Yahoo to forward the mail, but if one recipient is getting the mail, why the hell the second not? I have no f**king clue LOL

Thx for any suggestions

Reagrds Wayne
 


Edited by Wayne - 15 September 2011 at 5:40am
SF4.5.0.1-beta
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 3911
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 15 September 2011 at 10:50pm
Hi Wayne,

Most of the headers in an email that is received (including the To: and the CC: ones) are inserted by the mail client. Those addresses in the headers are actually not related in any way to the addresses that the sender's mail server provides in the RCPT TO command. The emails specified in the RCPT TO command are the actual recipients of the email, not the ones specified in the TO: and CC: headers. 

This said, in "normal" non-spam emails the addresses in the headers and the ones provided in the RCPT TO commands do match, but please do remember that I could for example send you an email in which the TO: headers shows "president@whitehouse.gov" and the CC: header shows "vice.president@whitehouse.gov".

In this specific email, Yahoo did indeed sent to SpamFilter only one RCTP TO command, specifying the email address "g.ahrendt@mydomain.ch". As the email looks legitimate, non-spam, it's a bit unusual that the TO and CC headers do not match the RCPT TO, but the issue should be looked into by the sender, as ultimately it is the remote server that only asked for delivery to one user.

What's odd is that there appears to be a delay of about one hour and 11 minutes before the email is received by SpamFilter from Yahoo's servers. Are you using greylisting by any chance? Yahoo has known problems with greylisting - see this thread http://www.logsat.com/SpamFilter/Forums/forum_posts.asp?TID=6942#14084 for a more detailed description (and solution). I would not see why greylisting could cause Yahoo to deliver emails to one user and not another, but if they violate RFCs in one way they could be doing it in others....

 and they do not necessarily have to match 


Edited by LogSat - 19 September 2011 at 3:45pm
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
Wayne View Drop Down
Groupie
Groupie
Avatar

Joined: 29 August 2006
Location: Switzerland
Status: Offline
Points: 60
Post Options Post Options   Thanks (0) Thanks(0)   Quote Wayne Quote  Post ReplyReply Direct Link To This Post Posted: 19 September 2011 at 8:41am
Hi Roberto

Thx for your comments.
Of course I know that it's possible to fake the TO: headers, but in this case our customer is not doing that and is just using Outlook as mail client. So that means Yahoo is mixing up or deleting some header informations when they forward his mail and that's really strange for such a big internet company like Yahoo is. This is simply unbelievable.

The delay problem of Yahoo is beacuse we use the greylist feature. It's again just unbelievable that Yahoo is still having problems with such a old function like greylisting and still violates the RFCs.

So then we will advise our customers to not longer use yahoo anymore.

Thx Roberto
SF4.5.0.1-beta
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 3911
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 19 September 2011 at 3:46pm
Hi Wayne,

You could try manually adding the entries I mentioned in the other posts to the GreyListAllowed.txt file - they are the known outbound SMTP servers for Yahoo at the time. That may help alleviate the issue with Yahoo.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
Wayne View Drop Down
Groupie
Groupie
Avatar

Joined: 29 August 2006
Location: Switzerland
Status: Offline
Points: 60
Post Options Post Options   Thanks (0) Thanks(0)   Quote Wayne Quote  Post ReplyReply Direct Link To This Post Posted: 19 September 2011 at 3:56pm
Roberto

I've checked your list with the IP's, but in all our examples the mails were sent from IP's from Yahoo server who are not in this list. So for me it's not worth to hunting always the IP's of their server.

But thx
SF4.5.0.1-beta
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.141 seconds.

Spam Filter ISP - Copyright © 2002-2013 LogSat Software LLC - PO BOX 916340 Longwood, FL 32791 USA

 Sales: sales@LogSat.com - Support: support@LogSat.com - Tel. (sales only): +1 407-650-3008