"Comments: Original 'to' not compliant with RFC 822, stripped"

  • Thread starter Thread starter RAM
  • Start date Start date
R

RAM

I have several users who have recently (within the last week or so)
report that they have received emails with nothing in the TO field. An
inspection of the Internet headers reveals that there is NO TO line,
and this line is at the bottom:

Comments: Original 'to' not compliant with RFC 822, stripped

I have been unable to find anything that tells me what server/software
is doing this, or what (if anything) I can do about it.

Can someone shed some light on the subject? Thanks in advance.

- RAM
 
Jeff (and any other interested parties),

Below is a sample of a message header with the "stripped" message:

Received: from pc42683s (pc42683s.corporate.gannettfleming.com
[10.10.1.48]) by seesar1.corporate.gannettfleming.com with SMTP
(Microsoft Exchange Internet Mail Service Version 5.5.2656.59)

id P0P98PV0; Thu, 31 Jul 2003 10:27:55 -0400
Received: from Unknown [10.10.1.7] by pc42683s - SurfControl E-mail
Filter (4.6); Thursday, 31 July 2003, 10:27:53
Received: from mail1.virtualconnect.net ([66.45.16.35]) by VARAN; Thu,
31 Jul 2003 10:28:03 -0400 (Eastern Daylight Time)

Received: from MX1.VirtualConnect.net [192.168.200.60] by
mail1.virtualconnect.net with ESMTP
(SMTPD32-7.13) id A6BC4C5E006A; Thu, 31 Jul 2003 10:25:00 -0400
Received: from ahmler4.mail.eds.com (ahmler4.mail.eds.com
[192.85.154.77])
by MX1.VirtualConnect.net (Postfix) with ESMTP id 23F0D67684
for <[email protected]>; Thu, 31 Jul 2003 10:28:02 -0400 (EDT)
Received: from ahmlir3.mail.eds.com (ahmlir3-2.mail.eds.com
[192.85.154.133])
by ahmler4.mail.eds.com (8.11.6p2/8.11.6) with ESMTP id
h6VERlB15955;
Thu, 31 Jul 2003 10:27:47 -0400
Received: from ahmlir3.mail.eds.com (localhost [127.0.0.1])
by ahmlir3.mail.eds.com (8.11.6p2/8.11.6) with ESMTP id
h6VERjA14860;
Thu, 31 Jul 2003 10:27:45 -0400 (EDT)
Received: from usahm001.examhub.exch.eds.com
(usahm001.examhub.exch.eds.com [207.37.138.140])
by ahmlir3.mail.eds.com (8.11.6p2/8.11.6) with ESMTP id
h6VERi614844;
Thu, 31 Jul 2003 10:27:45 -0400 (EDT)
Received: by usahm001.examhub.exch.eds.com with Internet Mail Service
(5.5.2656.59)
id <PFZC5KQJ>; Thu, 31 Jul 2003 10:27:40 -0400
Message-ID: <A47BFE1F2139D411A44700508BCF3CC415282FD2@USCHM201>
From: "Means, Jack W" <[email protected]>
Date: Thu, 31 Jul 2003 10:27:28 -0400
Subject:
MIME-Version: 1.0
Content-Type: text/plain
X-Mailer: Internet Mail Service (5.5.2656.59)
X-Note: This E-mail was scanned for spam and viruses by
MailProtector(sm).
Comments: Original 'to' not compliant with RFC 822, stripped
----------------------
Now, some explanation:

- PC42683s is my in-house email filter machine, running SurfControl
Email Filter v4.6 SP1. I've talked to SurfControl about the issue,
they're baffled and say it's not them doing the TO stripping.

- VARAN/Unknown [10.10.1.7] is our CheckPoint Firewall. All he does is
grab all SMTP traffic and send it to the in-house email filter. I
checked with our firewall admin; Checkpoint doesn't do anything with
the headers.

- mail1.virtualconnect.net is the mail server at MailProtector, an
anti-spam service that has been a godsend as far as keeping junk from
coming in to us. I've talked with them and they tell me "All we ever
to do headers is add the "X-Notes" and truncate the end of the header
if the entire header is over 1024 characters."

My last place to look is our Exchange servers. We have 3, with all the
incoming mail coming into one (the bridgehead server) who then divies
out the messages to the appropriate mailbox servers (himself or the
other 2 servers). All 3 are running Exchange 5.5 SP4 on NT 4.0 SP6a,
with McAfee GroupShield 5.0 for virus-scanning. (I posted this to an
Exchange newsgroup also, but I haven't seen any replies yet.)

Help!

===============================
 
Doesn't offer much help, does it? I'd be most suspicious of MailProtector,
given that you know it is actually doing header modification. The fact that
the person you talked to there says they didn't do this may just mean that
person is unaware of the code that does this. On the other hand, s/he could
be right and it could be some other server along the line...

If you want to put some effort into tracking this down, I'd see about
creating a message with an invalid RFC 2822 To field and sending it in ways
that will route it through different sets of servers to sort of triangulate
on the server responsible. Once you find it, ask (or demand, depending on
how frustrated you are at the time ;-) the vendor of the responsible
software that they identify them selves in the comment line that tells you
what they did to the message. Anything modifying the headers should
identify what was done and what is responsible for doing it....

--
Jeff Stephenson
Outlook Development
This posting is provided "AS IS" with no warranties, and confers no rights


RAM said:
Jeff (and any other interested parties),

Below is a sample of a message header with the "stripped" message:

Received: from pc42683s (pc42683s.corporate.gannettfleming.com
[10.10.1.48]) by seesar1.corporate.gannettfleming.com with SMTP
(Microsoft Exchange Internet Mail Service Version 5.5.2656.59)

id P0P98PV0; Thu, 31 Jul 2003 10:27:55 -0400
Received: from Unknown [10.10.1.7] by pc42683s - SurfControl E-mail
Filter (4.6); Thursday, 31 July 2003, 10:27:53
Received: from mail1.virtualconnect.net ([66.45.16.35]) by VARAN; Thu,
31 Jul 2003 10:28:03 -0400 (Eastern Daylight Time)

Received: from MX1.VirtualConnect.net [192.168.200.60] by
mail1.virtualconnect.net with ESMTP
(SMTPD32-7.13) id A6BC4C5E006A; Thu, 31 Jul 2003 10:25:00 -0400
Received: from ahmler4.mail.eds.com (ahmler4.mail.eds.com
[192.85.154.77])
by MX1.VirtualConnect.net (Postfix) with ESMTP id 23F0D67684
for <[email protected]>; Thu, 31 Jul 2003 10:28:02 -0400 (EDT)
Received: from ahmlir3.mail.eds.com (ahmlir3-2.mail.eds.com
[192.85.154.133])
by ahmler4.mail.eds.com (8.11.6p2/8.11.6) with ESMTP id
h6VERlB15955;
Thu, 31 Jul 2003 10:27:47 -0400
Received: from ahmlir3.mail.eds.com (localhost [127.0.0.1])
by ahmlir3.mail.eds.com (8.11.6p2/8.11.6) with ESMTP id
h6VERjA14860;
Thu, 31 Jul 2003 10:27:45 -0400 (EDT)
Received: from usahm001.examhub.exch.eds.com
(usahm001.examhub.exch.eds.com [207.37.138.140])
by ahmlir3.mail.eds.com (8.11.6p2/8.11.6) with ESMTP id
h6VERi614844;
Thu, 31 Jul 2003 10:27:45 -0400 (EDT)
Received: by usahm001.examhub.exch.eds.com with Internet Mail Service
(5.5.2656.59)
id <PFZC5KQJ>; Thu, 31 Jul 2003 10:27:40 -0400
Message-ID: <A47BFE1F2139D411A44700508BCF3CC415282FD2@USCHM201>
From: "Means, Jack W" <[email protected]>
Date: Thu, 31 Jul 2003 10:27:28 -0400
Subject:
MIME-Version: 1.0
Content-Type: text/plain
X-Mailer: Internet Mail Service (5.5.2656.59)
X-Note: This E-mail was scanned for spam and viruses by
MailProtector(sm).
Comments: Original 'to' not compliant with RFC 822, stripped
----------------------
Now, some explanation:

- PC42683s is my in-house email filter machine, running SurfControl
Email Filter v4.6 SP1. I've talked to SurfControl about the issue,
they're baffled and say it's not them doing the TO stripping.

- VARAN/Unknown [10.10.1.7] is our CheckPoint Firewall. All he does is
grab all SMTP traffic and send it to the in-house email filter. I
checked with our firewall admin; Checkpoint doesn't do anything with
the headers.

- mail1.virtualconnect.net is the mail server at MailProtector, an
anti-spam service that has been a godsend as far as keeping junk from
coming in to us. I've talked with them and they tell me "All we ever
to do headers is add the "X-Notes" and truncate the end of the header
if the entire header is over 1024 characters."

My last place to look is our Exchange servers. We have 3, with all the
incoming mail coming into one (the bridgehead server) who then divies
out the messages to the appropriate mailbox servers (himself or the
other 2 servers). All 3 are running Exchange 5.5 SP4 on NT 4.0 SP6a,
with McAfee GroupShield 5.0 for virus-scanning. (I posted this to an
Exchange newsgroup also, but I haven't seen any replies yet.)

Help!

===============================
"Jeff Stephenson [MSFT]" <[email protected]> wrote in
message news: said:
Can you post the headers? It sounds as if some server along the path is
doing this - maybe further inspection can show which.
Click to expand...
Click to expand...
 
Thanks for the tips jeff.

And I've recently discoverd evidence that it's NOT MailProtector --
looks like it's my OTHER anti-spam software. Now I just have to
convince them of it, I suppose.

Let me know if you'd be interested in the final outcome, and I'll let
you know.

- Rachel
 
Sure, if you could post a follow-up that would be great. I'd be interested
to know what about the address they were objecting to, and am interested in
any general knowledge of the playing-field in which Outlook has to operate.

--
Jeff Stephenson
Outlook Development
This posting is provided "AS IS" with no warranties, and confers no rights


RAM said:
Thanks for the tips jeff.

And I've recently discoverd evidence that it's NOT MailProtector --
looks like it's my OTHER anti-spam software. Now I just have to
convince them of it, I suppose.

Let me know if you'd be interested in the final outcome, and I'll let
you know.

- Rachel

"Jeff Stephenson [MSFT]" <[email protected]> wrote in
message news: said:
Doesn't offer much help, does it? I'd be most suspicious of MailProtector,
given that you know it is actually doing header modification. The fact that
the person you talked to there says they didn't do this may just mean that
person is unaware of the code that does this. On the other hand, s/he could
be right and it could be some other server along the line...

If you want to put some effort into tracking this down, I'd see about
creating a message with an invalid RFC 2822 To field and sending it in ways
that will route it through different sets of servers to sort of triangulate
on the server responsible. Once you find it, ask (or demand, depending on
how frustrated you are at the time ;-) the vendor of the responsible
software that they identify them selves in the comment line that tells you
what they did to the message. Anything modifying the headers should
identify what was done and what is responsible for doing it....
Click to expand...
Click to expand...
ts
 
Well, it WASN'T the anti-spam software after all. It was our
CheckPoint Firewall.

I had found one obscure posting that mentioned the very problem and
that they had a CP firewall (forget the version, my firewall admin has
the hardcopy of the posting). She looked into with CheckPoint's tech
support and they gave her a patch to load. Since she applied it, the
problem has not recurred.

Thanks for the interest.

- RAM
 
Back
Top