Detecting the mail ID in wrong format

[lingaraj19]

Hi All,

If someone is sending the mail to internal users, some time it reaches the receipent and some time it is dropping at ironport.

when I gone through the logs for the same, i have found some strange thing like below.

"Envelope Sender: suggest=websense.com__9j3y6p8k407zfhec@79hk3fmsddet.2-7dpeaq.2.bnc.salesforce.com"

actual mail id of envelope sender is "suggest@websence.com"

can any one pls suggest me why ironport is detecting the Envelope Sender mail id in wrong format and what are all the correcting steps.

pls find the attached file for more reference.

thank you very much.

Regards,

Lingaraj R N

[Robert Sherwin]

LRN -

More than likely, this is actually something that is being done from the Salesforce side when sending to the end receipient.

Please review the message tracking for the email.  Salesforce will take the email address, and re-write, in order to manage/route/track the messages on their side.

To obtain message tracking from the web interface:

- Go to MONITOR > MESSAGE TRACKING

- Search for the email in question

- Click the 'Show Details' link next to the email in question

Regards,

Robert

Email Content Security Technical Services - RTP, NC

[lingaraj19]

Hi Robert,

thanks for your revert.

does ironport change the sender mail id.

kindly confirm.

Regards,

LRN

[Robert Sherwin]

Not unless you have content/message filter in play that is doing this.

One thing to keep in mind - the "return-path" in the message is different than the envelope sender.  An injection debug of an incoming message would prove this.

-Robert

[steveshipway]

I can't say for certain, but this looks very much like a form of bounce-validation being implemented by the websence.com domain mail gateway.  The ironport does something similar if you enable the bounce validation.

Note that the envelope sender does not have to be the same as the message From header, which probably still shows the suggest@websence.com address.  The envelope sender is used more for NDRs and similar.

Steve