No User Information

[kmkrause2]

I'm getting weekly reports that include No User Information as one of the top senders. I see that these messages show no From: address. Some of these are bounce messages, but others are from internal mail servers sending reporting information. How do I change the Ironport so that sender information is required?

Thanks

[Christopher Smith]

Greetings,

You will sometimes find the user information shown as "No User  Information" for these reports.  This parameter relates to messages that have been relayed  through the IronPort appliance without an Envelope-From address. These  are typically bounce messages being sent by an internal host. This is  not a defect or a critical issue. It is just the way your  environment(internal host) is configured to send bounces.

The IronPort device has no control over this setting. Generally, your host will add a "mailer-daemon@domain.com" type address as the From message header for such bounce messages.

In short there is not really a way to force a specific identification that I am aware of.

Christopher C Smith

CSE

Cisco IronPort Customer Support

[kmkrause2]

Thanks for the quick response. The bounce messages are understandable, but I'm also showing No User Information messages related to messages that I believe are being forwarded from a user on our internal mail host through the Ironport. I would expect the forwarded messages to have From: information. Any thoughts?

Thanks again,

Ken

[Christopher Smith]

Hi Ken,

So the big question here is do we know for a fact that the messages you reference, correlate to the figures your seeing.  One way you could try to confirm this would be by searching the mail logs, specifically for null senders. The problem usually becomes one of history, as the available data in the mail logs may not go back far enough to allow you to compare it to the data your seeing for the statistics.

To start the messages you referred to should be checked to validate that they do have the correct information for the from field.

Christopher C Smith

CSE

Cisco IronPort Customer Support 

[kmkrause2]

Verifying the no sender information was my first step in troubleshooting. Over the weekend, which is when th

ese issues are more likely to come to light, our mail volume is very low. The 5

messages with no sender information appeared in the Top 10 senders report. I grepped the logs and found the messages by se

arching for the text "from: <>". Once I have the subject and recipient data, I then use our Notes server to identify the sender. From

that point I've been able to determine (just yesterday) that these messages are likely coming from a client that is not including the sender information. Once I identify the cause, I'll be putting controls in place to prevent this.

Thanks for the responses

[Christopher Smith]

Excellent trouble shooting!

Christopher C Smith

CSE

Cisco IronPort Customer Support