Hi everyone,

Got an interesting issue with one of the hosted exchange platforms that we currently manage. We have a spamfilter (SpamTitan) that filters the messages, then forwards them on to the Exchange mailboxes, and I'm seeing a particular message from a specific sender being sent through the filter, whitelisted, and then sent on to Exchange.

In Exchange message tracking, I can see the message being RECEIVE SMTP delivered, but the message is not found in the user's OWA/mailbox anywhere.

The only thing that's different is the sender is coming from a postmaster@internal.local address from the 3rd party engine that's sending the emails to our hosted exchange system.

The messages are Delivery Failure Notices with bouncebacks (the user actually wants them to know who's Invoices sent out are bouncing etc)

Under our Exchange 2013 content filter config I've allowed this postmaster@internal.local address to bypassed senders, but still the message is not delivered even though all our message tracking says it is.

Here is a copy of the SpamTitan message log:

SpamTitan ID: wnt42jLvqRVg

Message Received: September 1, 2015, 10:52:51

Envelope From Address: MAILER-DAEMON

From Address: postmaster@internal.local

Recipient: destination@mailbox.com

Subject: Delivery Status Notification (Failure)

Client Address: [external smtp server]

Country of Origin: AU

Message Size: 268953

Content Classification: Whitelisted

Virus Infected: No

Score: 0

Quarantined: No

Message ID: ZS2TRqf690000003a@internal.local

SMTP Response: 250 2.6.0 [InternalId=75020193760376, Hostname=our.hosted.exchange.fqdn] Queued mail for delivery

Delivery Status: Sent

Blacklisted Sender: N

Whitelisted Sender: Y

Mail flow direction: Inbound

Encryption: None

And here is a copy of the Exchange message tracking delivery:

RunspaceId : 9a660b50-f4fb-4f3a-84a3-e2ef42cbfbe0

Timestamp : 1/09/2015 10:52:59 AM

ClientIp : exchange.IP

ClientHostname : our.hosted.exchange.fqdn

ServerIp : exchange.IP

ServerHostname : exchange

SourceContext : 08D10381D3F1D083;2015-09-01T02:52:50.305Z;0

ConnectorId : PER-EX1\Default PER-EX1

Source : SMTP

EventId : RECEIVE

InternalMessageId : 75020193760376

MessageId : ZS2TRqf690000003a@internal.local

Recipients : {destination@mailbox.com}

RecipientStatus : {}

TotalBytes : 270928

RecipientCount : 1

RelatedRecipientAddress :

Reference :

MessageSubject : Delivery Status Notification (Failure)

Sender : postmaster@internal.local

ReturnPath : <>

Directionality : Incoming

TenantId :

OriginalClientIp : 127.0.0.1

MessageInfo : 0cA:

MessageLatency :

MessageLatencyType : None

EventData : {[FirstForestHop, our.hosted.exchange.fqdn], [ProxiedClientIPAddress, exchange.IP], [ProxiedClientHostname, antispam.fqdn], [ProxyHop1, our.hosted.exchange.fqdn(exchange.IP)], [DeliveryPriority, Normal]}

I've checked junk mail, spam filter, mailbox folder rules, but cannot find these messages anywhere.

I have also added this email address - postmaster@internal.local to the BypassedSenders on our Exchange 2013 Content filter config. No change.

Anyone got any suggestions?

Cheers

• Edited by resads 1 hour 21 minutes ago

As a test I've now tried set the user's mailbox for -Antispambypassenabled $True and will report back once we confirm message tracking tries to deliver more messages from postmaster@internal.local to see if that makes a difference.