Hi everyone,

Got an interesting issue with one of the hosted exchange platforms that we currently manage. We have a spamfilter (SpamTitan) that filters the messages, then forwards them on to the Exchange mailboxes, and I'm seeing a particular message from a specific sender being sent through the filter, whitelisted, and then sent on to Exchange.

In Exchange message tracking, I can see the message being RECEIVE SMTP delivered, but the message is not found in the user's OWA/mailbox anywhere.

The only thing that's different is the sender is coming from a postmaster@internal.local address from the 3rd party engine that's sending the emails to our hosted exchange system.

The messages are Delivery Failure Notices with bouncebacks (the user actually wants them to know who's Invoices sent out are bouncing etc)

Under our Exchange 2013 content filter config I've allowed this postmaster@internal.local address to bypassed senders, but still the message is not delivered even though all our message tracking says it is.

Here is a copy of the SpamTitan message log:

SpamTitan ID: wnt42jLvqRVg

Message Received: September 1, 2015, 10:52:51

Envelope From Address: MAILER-DAEMON

From Address: postmaster@internal.local

Recipient: destination@mailbox.com

Subject: Delivery Status Notification (Failure)

Client Address: [external smtp server]

Country of Origin: AU

Message Size: 268953

Content Classification: Whitelisted

Virus Infected: No

Score: 0

Quarantined: No

Message ID: ZS2TRqf690000003a@internal.local

SMTP Response: 250 2.6.0 [InternalId=75020193760376, Hostname=our.hosted.exchange.fqdn] Queued mail for delivery

Delivery Status: Sent

Blacklisted Sender: N

Whitelisted Sender: Y

Mail flow direction: Inbound

Encryption: None

And here is a copy of the Exchange message tracking delivery:

RunspaceId : 9a660b50-f4fb-4f3a-84a3-e2ef42cbfbe0

Timestamp : 1/09/2015 10:52:59 AM

ClientIp : exchange.IP

ClientHostname : our.hosted.exchange.fqdn

ServerIp : exchange.IP

ServerHostname : exchange

SourceContext : 08D10381D3F1D083;2015-09-01T02:52:50.305Z;0

ConnectorId : PER-EX1\Default PER-EX1

Source : SMTP

EventId : RECEIVE

InternalMessageId : 75020193760376

MessageId : ZS2TRqf690000003a@internal.local

Recipients : {destination@mailbox.com}

RecipientStatus : {}

TotalBytes : 270928

RecipientCount : 1

RelatedRecipientAddress :

Reference :

MessageSubject : Delivery Status Notification (Failure)

Sender : postmaster@internal.local

ReturnPath : <>

Directionality : Incoming

TenantId :

OriginalClientIp : 127.0.0.1

MessageInfo : 0cA:

MessageLatency :

MessageLatencyType : None

EventData : {[FirstForestHop, our.hosted.exchange.fqdn], [ProxiedClientIPAddress, exchange.IP], [ProxiedClientHostname, antispam.fqdn], [ProxyHop1, our.hosted.exchange.fqdn(exchange.IP)], [DeliveryPriority, Normal]}

I've checked junk mail, spam filter, mailbox folder rules, but cannot find these messages anywhere.

I have also added this email address - postmaster@internal.local to the BypassedSenders on our Exchange 2013 Content filter config. No change.

Anyone got any suggestions?

Cheers

• Edited by resads Tuesday, September 08, 2015 6:01 AM

Hi resads,

Thank you for your question.

Did you try to use OWA to check if you could see the email which come from postmaster@internal.local ?

Could you receive other external emails?

We could check if there any inbox rule on destination@mailbox.com. For testing, create a new account in organization and send email from postmaster@internal.local to this new account to check if you could receive emails. We could restart Microsoft Exchange Information Store and Microsoft Exchange Transport, then check if we could receive it.

If there are any questions regarding this issue, please be free to let me know.

Best Regard,

Jim