unsual mail listing for users

[colin.eyton]

In the past couple of days, users have been receiving within their quarantine reports details of mail that has a prefix to the email address that has been set up for that user.

IE if the user is sent up as abc@abc.com, they are now seeing mail addressed to 123.abc@abc.com or mail.abc@abc.com etc

Previously the user would only see mail specifically addressed to themselves

This has only just started occurring and we have made no changes within EFA

Could someone point me in the right direction on how to resolve this

Many thanks

[colin.eyton]

Is anyone able to point me in the right direction regarding this issue ?

Many thanks

[shawniverson]

Have a sample (sanitized) that you could share?

[colin.eyton]

Please find enclosed image showing issue that client is having.

This is happening for all users within this domain, so far have been unable to spot a similar issue with any other domains.

Basically anything that proceeds their actual email address is being delivered to the specific user

Other examples not shown in image are emailm.j.robinson, bj.robinson, emails.lilley etc

[colin.eyton]

Shawn

any ideas on this issue at all ?

[shawniverson]

No, I need a detailed sample with headers.

[SharazJek]

ive seen similar spam deliveries before, turns out the valid email address was in the BCC field, thus why the user was getting the email.

[colin.eyton]

Many thanks for the response Sharazjek, was a good thought but have checked and cant see anything like that in the headers.

Shawn pleased find enclosed latest email received today showing headers.

Our client has an account in the name of j.robinson, but he is receiving any mail that is addressed to xx.j.robinson as well

[shawniverson]

What you are seeing here is what is called SRS.

https://en.wikipedia.org/wiki/Sender_Rewriting_Scheme

This is normal behavior often used on mailing lists to allow forwarding and not break SPF.

[peter.munnelly]

Hi Shawn,

The issue that we are having here in the example that Colin has but up, is that we do not have a user called m.j.robinson@... we only have a user called j.robinson@...

But we are seeing spam in the quarantine for any email that is sent to any email address that contains j.robinson@ even when it has something like peter.j.robinson@....

Any ideas why we are seeing this?

[shawniverson]

Is it just showing up in the quarantine or also in the reports sent to the user?

[colin.eyton]

Its just showing up in the quarantine, the report only shows the users actual mail

[colin.eyton]

Any further suggestions in respect of this

[shawniverson]

If it is showing up in quarantine, and not the user, then it is getting caught (as it should) since it is not addressed properly. I see lots of spam that does this type of behavior.

[colin.eyton]

But when the user logs onto the portal, he is seeing these additional messages that are not addressed to him.

As he is only set up as a user he should be only seeing his own specific messages, and only admin users would see the spurious addresses with the additional prefixes.

Maybe I misunderstood your question earlier, when i replied, saying that the message are not appearing on his daily quarantine reports, but he is able to see them if he logs onto the portal and see either his last 50 messages or checks his own quarantine.

[shawniverson]

Ahh I understand now. Thought you were talking about the report emails. Gotcha.

Let me do some investigating....probably a mailwatch bug, and it may already be fixed for the upcoming release, but I'll find out...

[colin.eyton]

Any update on this Shawn

[stusmith]

Is one of those users a Domain Administrator ( type 'D')?

Can you show the filters listed for that particular user?

[colin.eyton]

No all the users are just listed as users

Which filters are you looking to see Stu ??

[shawniverson]

Any update on this Shawn

We are working on pulling in some changes in the mailwatch project. Hopefully for 3.0.1.9 we will see improvement here.