Cisco ESA Showing excessive "no user information"

[Stuart C]

Hi, 

On Cisco ESA, I am seeing under "Internal Users > Top users by clean outgoing messages" an incredible amount of emails classed as "No user information".  Can any suggest why?  I see this more than any other sending type.

I've done some research and found this.

"The 'No User Information' relates to messages that have been relayed through the IronPort appliance without an Envelope-From address. These are typically bounce messages being sent by an internal host (e.g. automatic replies)  or the host that is sending the email does not have a sender address. some examples attached below"

I did some testing and found that when I put my out of office on.  I see the initial message come in from my private email account for my work email account.  I then see the out of office reply come from "No sender" rather than my email address.  When I get the out of office reply to my private account, It's a reply from my work address!!

So why does ESA show the email going out from "no sender" but when I get the reply, I can see it's from me?

[Libin Varghese]

So the important difference is between envelope sender for an email and the From header (aka friendly from)  for an email.

For bounce emails and out of office emails, the envelope sender is empty while the From header would contain the display email address. This is as such to prevent a loop of bounce emails. 

The ESA logs and processes emails based on the envelope sender. The From header is purely for display purposes in the email client.

Regards 

Libin Varghese