Prev: SBS 2008 Backup-Fails with Creation of the shared protection point
Next: CTIW Fails When Looking for Router
From: Dave on 30 Nov 2009 10:28
The email is coming from a vendor's server via web
it shows up on my hotmail or comcast email addresses but not my company
email account
Vendor's employees can email us the report attached and we get them, suppose
to be done automatically
it is a different domain name than ours
Don't know what IMF is
we're not using POP3

--
Dave


"Ace Fekay [MCT]" wrote:

> "Dave" <Dave(a)discussions.microsoft.com> wrote in message
> news:A9CD3A16-98D9-4F3D-9727-DF5B87B24EC8(a)microsoft.com...
> > It's not internal, comes from a vendor's server.
> > --
> > Dave
> >
>
> I know a lot of info was covered in this thread between everyone, but I just
> wanted to understand the scenario a little better. Are you saying that the
> report is coming from a a server somewhere on the Internet and not inside
> your network? If so, is the report's "From:" address an internal user's
> actual email address, such as AnInternalUser(a)yyy.com, or is it the "From:"
> address a name that is not an actual internal user, yet has the same domain
> suffix as your mail server, such as
> someUserThatDoesNotExistInternally(a)yyy.com?
>
> If so, have you configured the IMF, or do you have a third party spam
> software. If so, I would look at either of their settings.
>
> Otherwise, are you using a POP3 connector?
>
> --
> Ace
>
> This posting is provided "AS-IS" with no warranties or guarantees and
> confers no rights.
>
> Please reply back to the newsgroup or forum for collaboration benefit among
> responding engineers, and to help others benefit from your resolution.
>
> Ace Fekay, MCT, MCITP EA, MCTS Windows 2008 & Exchange 2007, MCSE & MCSA
> 2003/2000, MCSA Messaging 2003
> Microsoft Certified Trainer
>
> For urgent issues, please contact Microsoft PSS directly. Please check
> http://support.microsoft.com for regional support phone numbers.
>
>
>
>
>
> .
>
From: Ace Fekay [MCT] on 30 Nov 2009 11:54
"Dave" <Dave(a)discussions.microsoft.com> wrote in message
news:6971102F-C70D-47B4-8271-0F770C42B202(a)microsoft.com...
> The email is coming from a vendor's server via web
> it shows up on my hotmail or comcast email addresses but not my company
> email account
> Vendor's employees can email us the report attached and we get them,
> suppose
> to be done automatically
> it is a different domain name than ours
> Don't know what IMF is
> we're not using POP3
>
> --
> Dave

Just to understand it fully, you are saying (referencing your response to
Larry), that the FROM address on the email from the vendor, is not your own
domain name that your server normally receives mail on?

In otherwords:

1. Your domain name is (example) yourdomain.com.

2. The vendor's email is vendordomain.com

3. Your report generator at your location sends an email to the vendor, such
as to: vendorReports(a)vendordomain.com

4. The vendor then sends you an email to dave(a)yourdomain.com, and the from
address is vendorReports(a)vendordomain.com

Is that correct?

Is the mail coming from the vendor coming from somewhere else other than the
vendor's mail server (such as from their web server)?
Does the vendor's mailoes the vendor's domain name (vendordomain.com) have
an SPF record?
If so, is there an entry in their SPF record for their Sending email Server
on vendordomain.com?
If so, is there an entry for the web server (or whatever server it's
originating from) in the SPF record?

The IMF is the Intelligent Mail Filter. That's Exchange's spam filter.

Are you using a 3rd party spam filter?

Ace



From: Ace Fekay [MCT] on 30 Nov 2009 11:55
"Dave" <Dave(a)discussions.microsoft.com> wrote in message
news:2F3A50E2-90B9-426E-8BFD-D9EDE3077B6E(a)microsoft.com...
> Okay,
> ran the smtp inbound test, see below:
>
> Testing Inbound SMTP Mail flow for domain payroll(a)qqest.com
> Inbound SMTP mail flow was verified successfully.
> Test Steps
> Attempting to retrieve DNS MX records for domain qqest.com
> Successfully retrieved one or more MX records from DNS
> Additional Details
> MX Records Host mail.qqest.com, Preference 1
>
>
> Testing Mail Exchanger mail.qqest.com.
> This Mail Exchanger was tested successfully.
> Test Steps
> Attempting to resolve the host name mail.qqest.com in DNS.
> Host successfully resolved
> Additional Details
> IP(s) returned: 67.137.30.226
>
> Testing TCP Port 25 on host mail.qqest.com to ensure it is listening and
> open.
> The port was opened successfully.
> Additional Details
> Banner Received: 220 barracuda.qqest.com ESMTP
> (3869784aaaa24f32f8070d56dce0275b)
>
> Attempting to send test email message to payroll(a)qqest.com using MX
> mail.qqest.com.
> The test message was delivered successfully.
> Testing the MX mail.qqest.com for open relay by trying to relay to user
> Admin(a)TestExchangeConnectivity.com
> Open Relay test passed. This mx is not an open relay
> Additional Details
>
> didn't understand the article
>

Dave,

Which article?

Ace



From: Larry Struckmeyer[SBS-MVP] on 30 Nov 2009 13:28
Hi Dave:

It would seem that you are testing the mail server at qqest.com, which I
would expect to be a valid mail server. But their ability to receive mail
should not be an issue here. What seems to be an issue, and please correct
me if I misunderstand, is that a message generated by the qqest.com payroll
calculator is not received at your mail server.

Yes? No?

You did say that the program at qqest.com does successfully send the message
to your hotmail address, but not to your exchange server. that means that
it is being rejected by your anti spam or anti content filters as it enters
the exchange server.

What I would do is look carefully at the message headers for a successful
message that lands in any inbox to see what the originating mail server is.
Then, depending on the results, create an exception in the various blocks
you have in place, or temporarily disable them to see if the message can
get to your exchange server mailbox.

You might also be able to use message tracking to see where it is stopped
from entering your server.

A workaround might be to have the message sent to a mailbox used only for
this purpose on hotmail, Gmail, msnmail. any mail that will receive it, then
have that forwarded to your exchange server mailbox. this should have the
effect of a message coming from the intermediate mailbox, not the originating
one.

-
Larry
Please post the resolution to your
issue so others may benefit
-
Get Your SBS Health Check at
www.sbsbpa.com


> "Dave" <Dave(a)discussions.microsoft.com> wrote in message
> news:2F3A50E2-90B9-426E-8BFD-D9EDE3077B6E(a)microsoft.com...
>
>> Okay,
>> ran the smtp inbound test, see below:
>> Testing Inbound SMTP Mail flow for domain payroll(a)qqest.com
>> Inbound SMTP mail flow was verified successfully.
>> Test Steps
>> Attempting to retrieve DNS MX records for domain qqest.com
>> Successfully retrieved one or more MX records from DNS
>> Additional Details
>> MX Records Host mail.qqest.com, Preference 1
>> Testing Mail Exchanger mail.qqest.com.
>> This Mail Exchanger was tested successfully.
>> Test Steps
>> Attempting to resolve the host name mail.qqest.com in DNS.
>> Host successfully resolved
>> Additional Details
>> IP(s) returned: 67.137.30.226
>> Testing TCP Port 25 on host mail.qqest.com to ensure it is listening
>> and
>> open.
>> The port was opened successfully.
>> Additional Details
>> Banner Received: 220 barracuda.qqest.com ESMTP
>> (3869784aaaa24f32f8070d56dce0275b)
>> Attempting to send test email message to payroll(a)qqest.com using MX
>> mail.qqest.com.
>> The test message was delivered successfully.
>> Testing the MX mail.qqest.com for open relay by trying to relay to
>> user
>> Admin(a)TestExchangeConnectivity.com
>> Open Relay test passed. This mx is not an open relay
>> Additional Details
>> didn't understand the article
>>
> Dave,
>
> Which article?
>
> Ace
>


From: "Robbin Meng [MSFT]" on 30 Nov 2009 22:21

Hi Dave,

Thanks for you update.

Based on the current situation, if you can receive regular emails from the vendor mail server except the automatically sent report mail, then I agree with Larry and Ace that it is
probably caused by your Exchange server that may be the IMF or other 3rd party spam filter block/reject the report email that from an automatic sent email address(which might
not exist and no mailbox at all) of the vendor mail system.

Basically, to verify a legitimate sender, your Exchange server checks for the sending domain's SPF (Sender Policy Framework) record, which is published in the DNS record.
The mail server then determines whether the sending e-mail server's IP address matches the IP address that is published in the DNS record. SenderID and SPF are not equal,
but enabling SenderID filtering will make your Exchange check sender's SPF records.

New Weapons In The Fight Against Spam
http://207.46.16.252/en-us/magazine/2006.01.newweapons.aspx


More information about IMF:

Microsoft Exchange Server Intelligent Message Filter v2 Operations Guide
http://technet.microsoft.com/en-us/library/aa996624(EXCHG.65).aspx

Hope this helps.




Best regards,
Robbin Meng(MSFT)
Microsoft Online Newsgroup Support


First  |  Prev  |  Next  |  Last
Pages: 1 2 3 4 5
Prev: SBS 2008 Backup-Fails with Creation of the shared protection point
Next: CTIW Fails When Looking for Router