I have a customer that when receives and email from an address the FROM address gets changed when delivered to outlook. They have barracuda spamfilter output below. X-ASG-Debug-ID: 1255509892-046a74960001-0KRwF5Received: from evempbp09.workforpbp.com (evempbp09.workforpbp.com [208.89.23.74]) by barracuda.bransoncvb.com with ESMTP id 7gkG4HNA5by3aufg for <EMAIL GONE>; Wed, 14 Oct 2009 03:44:53 -0500 (CDT)X-Barracuda-Envelope-From: EMAIL GONEReceived: from PBP-09 (127.0.0.1) by evempbp09.workforpbp.com (PowerMTA(TM) v3.5r14) id hqm7oc0r7cge for <EMAIL GONE>; Wed, 14 Oct 2009 04:44:52 -0400 (envelope-from <EMAIL GONE>)Date: Wed, 14 Oct 2009 04:44:52 -0400X-Barracuda-BBL-IP: nilX-Mailer: PDSoft Smtp Control v4.0.390X-Sender: EMAIL GONETo: EMAIL GONEFrom: EMAIL GONE <EMAIL GONE>X-ASG-Orig-Subj: Introduction to Programming C# 3.0 - 10/27/09 WebinarSubject: Introduction to Programming C# 3.0 - 10/27/09 WebinarMime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"X-Barracuda-Connect: evempbp09.workforpbp.com[208.89.23.74]X-Barracuda-Start-Time: 1255509892X-Barracuda-URL: http://192.168.1.254:8000/cgi-mod/mark.cgiX-Barracuda-Orig-Rcpt: EMAIL GONEX-Virus-Scanned: by bsmtpd at bransoncvb.comMessage-Id: <EMAIL GONE>X-Barracuda-Spam-Score: 0.20X-Barracuda-Spam-Status: No, SCORE=0.20 using global scores of TAG_LEVEL=4.0 QUARANTINE_LEVEL=5.0 KILL_LEVEL=6.0 tests=BSF_SC0_SA074bX-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.2.11739 Here is the header after going through exchange 2007, from outlook. Received: from barracuda.bransoncvb.com (192.168.1.254) by MXSERVER.BACC.local (192.168.1.6) with Microsoft SMTP Server id 8.1.393.1; Wed, 14 Oct 2009 03:45:39 -0500X-ASG-Debug-ID: 1255509892-046a74960001-0KRwF5Received: from evempbp09.workforpbp.com (evempbp09.workforpbp.com [208.89.23.74]) by barracuda.bransoncvb.com with ESMTP id 7gkG4HNA5by3aufg for <EMAIL GONE>; Wed, 14 Oct 2009 03:44:53 -0500 (CDT)X-Barracuda-Envelope-From: EMAIL GONEReceived: from PBP-09 (127.0.0.1) by evempbp09.workforpbp.com (PowerMTA(TM) v3.5r14) id hqm7oc0r7cge for <EMAIL GONE>; Wed, 14 Oct 2009 04:44:52 -0400 (envelope-from <EMAIL GONE>)Date: Wed, 14 Oct 2009 04:44:52 -0400X-Barracuda-BBL-IP: nilX-Mailer: PDSoft Smtp Control v4.0.390X-Sender: EMAIL GONETo: EMAIL GONEFrom: "elearning@" <progressivebusinesstechnologytraining.com EMAIL GONE>X-ASG-Orig-Subj: Introduction to Programming C# 3.0 - 10/27/09 WebinarSubject: Introduction to Programming C# 3.0 - 10/27/09 WebinarMIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii"X-Barracuda-Connect: evempbp09.workforpbp.com[208.89.23.74]X-Barracuda-Start-Time: 1255509892X-Barracuda-URL: http://192.168.1.254:8000/cgi-mod/mark.cgiX-Virus-Scanned: by bsmtpd at bransoncvb.comMessage-ID: <EMAIL GONE>X-Barracuda-Spam-Score: 0.20X-Barracuda-Spam-Status: No, SCORE=0.20 using global scores of TAG_LEVEL=4.0 QUARANTINE_LEVEL=5.0 KILL_LEVEL=6.0 tests=BSF_SC0_SA074bX-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.2.11739 Rule breakdown below pts rule name description ---- ---------------------- -------------------------------------------------- 0.20 BSF_SC0_SA074b Custom Rule SA074bReturn-Path: EMAIL GONE Any ideas would be great. Thanks.

The FROM: has been obscured. Can you post exactly what changes spelling it out so it doesnt get obscured?

Hi, I suggest you enable Pipeline Tracing on the Exchange 2007 to check whether the From address in the message header has already been changed before the message is processed by Exchange 2007: How to Enable Pipeline Tracing http://technet.microsoft.com/en-us/library/bb125018.aspx In addition, as Andy indicated, the FROM: has been obscured. Would you please post the two message header again?~~~~~~~~~~~~~~~~ Mike Shen TechNet Subscriber Support in forum If you have any feedback on our support, please contact tngfb@microsoft.com ~~~~~~~~~~~~~~~~