User Alerts appear to come from random user or "??"
Has anyone ever seen this situation before? One of our clients has an issue where user alerts will appear to come from an e-mail address other than what is configured in the Outgoing E-mail Settings. The same setting for the from address exists at the farm and web application level. This is a SharePoint 2007 environment. Farm build version 12.0.0.6421. The servers are Windows Server 2003 R2 Standard x64 Edition Service Pack 2. They are using Exchange 2007. I have set myself up with an alert on the same lists and my alerts come from what is set under Outgoing E-mail Settings. I have not had over a hundred alerts come to my address outside of the client's domain without seeing an instance of the issue. This issue only occurs occasionally and is not always from the same address. I have had users delete and recreate their User Alert, but the issue continues. We have tried changing the from address, as it was previously an e-mail address which did not exist in Exchange. Now it is a Distribution List tied to an e-mail address and the issue continues. I have tested e-mail settings by opening a telnet session to the SMTP relay server and composing an e-mail with the address in question. Can not reproduce the issue that way. Heres a screenshot of one of the alerts that is one of the strangest I have seen thusfar: Heres what I received from their Exchange Admin when I asked about tracking the e-mail through Exchange. The messages should have been coming from SharePointNoReply@xyzdomain.com and not ?? or Random.User@xyzdomain.com. Not sure if it may be helpful or if its too much info. (Names have been changed to protect the innocent): From the logs on the SMTP relay server, smtpapp, the problem is somewhere in SharePoint. The messages are coming out of SharePoint with the incorrect sender. As shown in this excerpt from the log on smtpapp, the Seadrift message came from the SharePoint App server with ?? as the sender: 2012-07-17 19:40:34 172.29.172.235 tepappmos01 SMTPSVC1 TEPAPPGIN01 172.24.28.80 0 HELO - +tepappmos01 250 0 48 16 0 SMTP - - - - 2012-07-17 19:40:34 172.29.172.235 tepappmos01 SMTPSVC1 TEPAPPGIN01 172.24.28.80 0 MAIL - +FROM:<??> 250 0 51 14 0 SMTP - - - - 2012-07-17 19:40:34 172.29.172.235 tepappmos01 SMTPSVC1 TEPAPPGIN01 172.24.28.80 0 RCPT - +TO:<User1@xyzdomain.com> 250 0 38 35 0 SMTP - - - - 2012-07-17 19:40:34 172.29.172.235 tepappmos01 SMTPSVC1 TEPAPPGIN01 172.24.28.80 0 DATA - +<3BD50098E401463AA228377848493927-{AD6AE8FF-7F02-4068-B655-C90A8CD8832A}@xyzdomain.com> 250 0 169 9043 16 SMTP - - - - 2012-07-17 19:40:34 172.29.172.235 tepappmos01 SMTPSVC1 TEPAPPGIN01 172.24.28.80 0 QUIT - tepappmos01 240 16 68 4 0 SMTP - - - - The following excerpt shows the Benkelman message coming from the SharePoint App server correctly: 2012-07-19 19:20:34 172.29.172.235 tepappmos01 SMTPSVC1 TEPAPPGIN01 172.24.28.80 0 HELO - +tepappmos01 250 0 48 16 0 SMTP - - - - 2012-07-19 19:20:34 172.29.172.235 tepappmos01 SMTPSVC1 TEPAPPGIN01 172.24.28.80 0 MAIL - +FROM:<SharePointNoReply@xyzdomain.com> 250 0 54 41 0 SMTP - - - - 2012-07-19 19:20:34 172.29.172.235 tepappmos01 SMTPSVC1 TEPAPPGIN01 172.24.28.80 0 RCPT - +TO:<User1@xyzdomain.com > 250 0 38 35 0 SMTP - - - - 2012-07-19 19:20:34 172.29.172.235 tepappmos01 SMTPSVC1 TEPAPPGIN01 172.24.28.80 0 DATA - +<3BD50098E401463AA228377848493927-{20ACD2ED-8A62-445A-AED2-80E0E924B9D6}@xyzdomain> 250 0 169 12013 16 SMTP - - - - 2012-07-19 19:20:34 172.29.172.235 tepappmos01 SMTPSVC1 TEPAPPGIN01 172.24.28.80 0 QUIT - tepappmos01 240 16 68 4 0 SMTP - - - - Just for fun, I also found the relevant log entries for the email message that prompted all of this, which shows that it came from the SharePoint Web server with Random.User@xyzdomain.com as the sender: 2012-07-18 18:00:35 172.29.172.237 TEPWEBMOS01 SMTPSVC1 TEPAPPGIN01 172.24.28.80 0 HELO - +TEPWEBMOS01 250 0 48 16 0 SMTP - - - - 2012-07-18 18:00:35 172.29.172.237 TEPWEBMOS01 SMTPSVC1 TEPAPPGIN01 172.24.28.80 0 MAIL - +FROM:<Random.User@xyzdomain.com> 250 0 50 37 0 SMTP - - - - 2012-07-18 18:00:35 172.29.172.237 TEPWEBMOS01 SMTPSVC1 TEPAPPGIN01 172.24.28.80 0 RCPT - +TO:<User2@xyzdomain.com> 250 0 38 35 0 SMTP - - - - 2012-07-18 18:00:35 172.29.172.237 TEPWEBMOS01 SMTPSVC1 TEPAPPGIN01 172.24.28.80 0 DATA - +<3BD50098E401463AA228377848493927-{422C1D36-2F21-4335-8925-D56B9E6F9C41}@xyzdomain.com> 250 0 169 6493 46 SMTP - - - - 2012-07-18 18:00:35 172.29.172.237 TEPWEBMOS01 SMTPSVC1 TEPAPPGIN01 172.24.28.80 0 QUIT - TEPWEBMOS01 240 46 68 4 0 SMTP - - - - Any thoughts or leads would be greatly appreciated! Thank you, Gary M.
September 19th, 2012 12:16pm

Hi Gary, any updates on this issue? We seem to have the same problem here with one of our servers, alerts sometimes coming from a user in a different website (!) instead of FROM:noreply@foo.com Regards Jesper D
Free Windows Admin Tool Kit Click here and download it now
October 14th, 2012 9:14am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics