Sabahattin, that is a very useful post, thanks a lot.

I will setup a list using Mercury and see how it goes.

Hi folks

One of our staff has been trying to forward mail received locally to an external address.

The message being forwarded was created using Pegasus Mail, and contains rich text and two hyperlinks. It also contains a plain text attachment. The original message contains a list of local addresses from a distribution list.

When the mail is forwarded, this appears in the MercuryE log:

T 20080416 122822 48054fe4 Begin processing job MO000220 from user@lincsheritage.org
W 20080416 122843 48054fe4 Error connecting to primary server '213.40.66.235'.
T 20080416 122845 48054fe4 Established ESMTP connection to 213.40.130.235
T 20080416 122845 48054fe4 MAIL FROM:<user@lincsheritage.org> SIZE=2102
T 20080416 122845 48054fe4 250 OK
T 20080416 122845 48054fe4 RCPT TO:<user@supanet.com>
T 20080416 122850 48054fe4 250 Accepted
T 20080416 122853 48054fe5 Begin processing job MO000222 from user@lincsheritage.org
T 20080416 122920 48054fe4 Connection closed normally.
T 20080416 122920 48054fe4 Job MO000220 processing complete.
W 20080416 122954 48054fe5 Error connecting to primary server '213.40.66.235'.
T 20080416 123016 48054fe5 Established ESMTP connection to 213.40.130.235
T 20080416 123016 48054fe5 MAIL FROM:<user@lincsheritage.org> SIZE=15815
T 20080416 123016 48054fe5 250 OK
T 20080416 123016 48054fe5 RCPT TO:<user@supanet.com>
T 20080416 123018 48054fe5 250 Accepted
E 20080416 123019 48054fe5 DATA state failure - 550-Syntax error in the headers: Rejected after DATA:
T 20080416 123019 48054fe5 Connection closed normally.
T 20080416 123019 48054fe5 Job MO000222 processing complete.

The error only appears when the mail is forwarded to this supanet.com address. The same mail message sent to googlemail.com and btinternet.com succeeds.

Also, different mail messages from the same user sent to the same user@supanet.com domain succeed.

I've done a search for this on the Internet, and have seen other examples where a reason for the rejection is given after 'Rejected after DATA:', but this is not the case here.

Can anyone shed some light on what may be happening here please?

Thanks

Looks like a antispam proxy that does not like your message.

Turn on session logging for mercE, might shed a bit more light.

Two points:

First - Problem solved. The data at the start of the log shows the following:

11:39:27.406: --- Thu Apr 17 11:39:27 2008 ---
11:39:27.406: Connect to '213.40.66.235', timeout 60.
11:39:48.312: 15: Peer connect failure
11:39:48.312: --- Thu Apr 17 11:39:48 2008 ---
11:39:48.312: Connect to '213.40.2.235', timeout 60.
11:39:50.687: >> 220 goblet.sin1.netline.net.uk ESMTP Exim 4.69 Thu, 17 Apr 2008 11:40:31 +0100<cr><lf>
11:39:50.687: << EHLO apsarchaeology.co.uk<cr><lf>
11:39:50.750: >> 250-goblet.sin1.netline.net.uk Hello mail.apsarchaeology.co.uk [82.69.48.10]<cr><lf>
11:39:50.750: >> 250-SIZE 8388608<cr><lf>
11:39:50.750: >> 250-PIPELINING<cr><lf>
11:39:50.750: >> 250 HELP<cr><lf>
11:39:50.765: << MAIL FROM:<user@lincsheritage.org> SIZE=15815<cr><lf>
11:39:50.796: >> 250 OK<cr><lf>
11:39:50.812: << RCPT TO:<user@supanet.com><cr><lf>
11:39:53.406: >> 250 Accepted<cr><lf>
11:39:53.421: << DATA<cr><lf>
11:39:53.453: >> 354 Enter message, ending with "." on a line by itself<cr><lf>
11:39:53.453: << Received: from Spooler by apsarchaeology.co.uk (Mercury/32 v4.52) ID MO000754;<cr><lf>    17 Apr 2008 11:39:53 +0100<cr><lf>
11:39:53.453: << Received: from spooler by apsarchaeology.co.uk (Mercury/32 v4.52); 17 Apr 2008 11:39:19 +0100<cr><lf>
11:39:53.453: << Resent-from: "user" <user@lincsheritage.org><cr><lf>
11:39:53.453: << Resent-to: user@supanet.com<cr><lf>
11:39:53.453: << Resent-date: Thu, 17 Apr 2008 11:39:02 +0100<cr><lf>
11:39:53.453: << Comments: Header converted - 'From: "Local Sender" <local sender>'<cr><lf>
11:39:53.453: << From: "user" <user@lincsheritage.org><cr><lf>
11:39:53.453: << To: Distribution list,<cr><lf>
11:39:53.453: <<               Distribution list,<cr><lf>
11:39:53.453: <<               Distribution list,<cr><lf>
11:39:53.453: <<               Distribution list<cr><lf>
11:39:53.453: << Date: Tue, 08 Apr 2008 12:06:37 +0100<cr><lf>
11:39:53.453: << MIME-Version: 1.0<cr><lf>
11:39:53.453: << Content-type: Multipart/Mixed; boundary=Message-Boundary-4544<cr><lf>
11:39:53.453: << Subject: Internet Banking and PC Security<cr><lf>
11:39:53.453: << Message-ID: <47FB5FCD.27271.59B4F54@mark><cr><lf>
11:39:53.453: << X-mailer: Pegasus Mail for Windows (4.41)<cr><lf>
11:39:53.453: << <cr><lf>
11:39:53.453: << <cr><lf>
11:39:53.453: << --Message-Boundary-4544<cr><lf>
11:39:53.453: << Content-type: text/html; charset=ISO-8859-1<cr><lf>
11:39:53.453: << Content-transfer-encoding: Quoted-printable<cr><lf>
11:39:53.453: << Content-description: Mail message body<cr><lf>
11:39:53.453: << <cr><lf>
11:39:53.453: << <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"<cr><lf>
11:39:53.453: <<           "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><cr><lf>
11:39:53.453: << <html  xmlns=3D"http://www.w3.org/1999/xhtml" xml:lang=3D"en" lang=3D"en">=<cr><lf>
11:39:53.453: << <head><cr><lf>
11:39:53.453: << <title></title><cr><lf>
11:39:53.453: << <meta http-equiv=3D"content-type" content=3D"text/html;charset=3Dutf-8"/><cr><lf>
11:39:53.453: << <meta http-equiv=3D"Content-Style-Type" content=3D"text/css"/><cr><lf>
11:39:53.453: << </head><cr><lf>
11:39:53.468: << <body><cr><lf>
11:39:53.468: << <div align=3D"left"><cr><lf>
11:39:53.484: << <font face=3D"Arial" size=3D"2"><cr><lf>
11:39:53.484: << <span style=3D" font-size:10pt"><cr><lf>
11:39:53.484: << Dear all</span></font><cr><lf> 

 Message content

The data at the end of the log: 

11:39:53.718: << --Message-Boundary-4544--<cr><lf>
11:39:53.718: << .<cr><lf>
11:39:54.140: >> 550-Syntax error in the headers: Rejected after DATA:<cr><lf>
11:39:54.140: >> 550-unqualified address not permitted: failing address in "To:" header is:<cr><lf>
11:39:54.140: >> 550-name <cr><lf>
11:39:54.140: >> 550-If you are using BCC make sure you have an address in the TO field <cr><lf>
11:39:54.140: >> 550-try putting your own address in the TO field then send again. <cr><lf>
11:39:54.140: >> 550 Thu, 17 Apr 2008 11:40:35 +0100 on host 213.40.2.48<cr><lf>
11:39:54.156: << QUIT<cr><lf>
11:39:54.156: --- Connection closed normally at Thu Apr 17 11:39:54 2008. ---
11:39:54.156:

The name shown above was the first name in the original Distribution list (contains about 40 names). Now, this list contains only local addresses and appears in the body at the start of the forwarded message. Why was this list was being processed by the recipient's domain? This is not normal is it?

After clicking 'Forward' in Pegasus and editing the message to remove the names from the distribution list that appear in the body of the message, the mail was successfully delivered.

Secondly - There seems to be a limit on the number of log files or size of log files that Mercury will write to a folder. I have a folder dedicated to logging that exists outside the Mercury folder heirarchy. Session logging is on by default for all the modules, but xxxxxxx.ME log files had not been created for some time. The folder contained 2,590 files comprising 5.29GB data. It was only after moving these log files to another location that the .ME file was created.

Thanks for the response - it led to two problems being fixed :)

Cheers!

The name shown above was the first name in the original Distribution list

(contains about 40 names). Now, this list contains only local addresses

and appears in the body at the start of the forwarded message. Why was

this list was being processed by the recipient's domain? This is not

normal is it?

After clicking 'Forward' in Pegasus and editing the message to remove the names from the distribution list that appear in the body of the message, the mail was successfully delivered.

This server is check the from: field for a valid email address.  I would recommend entering a "Sender" field in the form "My List Name" <My@email.address> so the message get a valid RFC 2822 address.

Secondly - There seems to be a limit on the number of log files or size

of log files that Mercury will write to a folder. I have a folder

dedicated to logging that exists outside the Mercury folder hierarchy.

Session logging is on by default for all the modules, but xxxxxxx.ME

log files had not been created for some time. The folder contained

2,590 files comprising 5.29GB data. It was only after moving these log

files to another location that the .ME file was created.

I've not seen that but you may have reached the limit of the OS in files in a directory.  That said, the ME log files are reused when Mercury/32 is restarted as well and so if Mercury/32 is restarted you have no clue which of the ME files was the last file.

I strongly recommend that you do not run session logging at all except when troubleshooting a problem.  Session logging really loads down the system.   

[quote user="Thomas R. Stephenson"]

I strongly recommend that you do not run session logging at all except when troubleshooting a problem.  Session logging really loads down the system.   

[/quote]

I run session logging on mercS & mercD as a matter of course. We only have moderate throughput and I generally empty the log folders weekly.

Has saved my butt a couple of times, with some NoteTab macro's to extract copies of missing and/or munged mails from these logs.

(Clamwall removed a UUencoded attachment due to my inadvertently setting it that way [:$] and I didn't want to ask the person to send it a third time [:$])

Thanks for both your replies.

Let me get this straight - some servers will process addresses that appear in the body of the message???? If I had setup the distribution list as if it was an external one and put a valid email address in the To: section and BCC'd the rest, would that server have then attempted to send mail to all the addresses on that list??

I'm confused. The distribution list in question is available to everyone here and only contains local addresses i.e. name only, not name@domain.com. It is used to send company-wide announcements only. The forwarded message was sent to 1 user outside the organisation. How can the receiving server interpret addresses in the body of the message as being recipients???

[8-)]

[quote user="Greenman"]

Thanks for both your replies.

Let me get this straight - some servers will process addresses that appear in the body of the message???? If I had setup the distribution list as if it was an external one and put a valid email address in the To: section and BCC'd the rest, would that server have then attempted to send mail to all the addresses on that list??

[/quote]

No, it would have passed through the To: filter and been delivered to the address in the envelope RCPT TO: address. [:)]

[quote] 

I'm confused. The distribution list in question is available to everyone here and only contains local addresses i.e. name only, not name@domain.com. It is used to send company-wide announcements only. The forwarded message was sent to 1 user outside the organisation. How can the receiving server interpret addresses in the body of the message as being recipients???

[8-)]

[/quote]

It's not. It is checking for a qualified (user@domain), but not necessarily correct, address in the messages To: address.

[quote]

11:39:54.140: >> 550-unqualified address not permitted: failing address in "To:" header is:<cr><lf>

[/quote] 

This is not normally a requirement for SMTP delivery, but seems to be part of the anti-crapmail policy on this particular server.

Forwarding the message rather than 'bouncing' it , should overcome your problem.

Let me get this straight - some servers will process addresses that

appear in the body of the message???? If I had setup the distribution

list as if it was an external one and put a valid email address in the

To: section and BCC'd the rest, would that server have then attempted

to send mail to all the addresses on that list??

Many servers are now doing a lot more than just checking the From:, Cc:, Bcc; fields in the body of the message.  They are also checking for words like Viagra, Sex, etc. 

In this case that are just checking for a valid email address in the From: field as required by RFC 2822 during the receiving.  They are not going to be using the addresses for anything at all, they are simply saying that if the from: field does not contain a SMTP email address then the message is not a valid RFC 2822 message. 

Thanks folks.

I'll just ask staff to strip out the distribution list details before they send mail.

I'll also make sure I empty the log folder on a regular basis.

If they just Forward it with the Forward button, it should get a valid To: address.

It seems from these headers

[quote]

11:39:53.453: << Resent-from: "user" <user@lincsheritage.org><cr><lf>
11:39:53.453: << Resent-to: user@supanet.com<cr><lf>
11:39:53.453: << Resent-date: Thu, 17 Apr 2008 11:39:02 +0100<cr><lf>

[/quote]

that it has been sent by "Forward without editing" (unsure if this is what Pegasus calls it) so the To: header in the message has remained the same, containing only your internal addresses, hence getting rejected by a server that checks for such things.

Hi

Both forwarding methods were used (Editing first, and Bouncing), but both failed.

This is what I find really weird - I would have thought that a fowarded message would not include previous recipients in the To: header.

The Resent-from is a valid address which is not in the original distribution list.

The original mail as distributed contains

From: user

Whereas the forwarded mail contained

From: user@domain.com

If they forwarded it with editing and did not remove the headers it's quite possible that this servers anti-spam system would still reject since it's still checked the body of the email message.  Check to see exactly how the forwarded the message and again do a session log to see where the receiving server is chocking on the message body. 

Again, FWIW, people using a dist. list really should use full SMTP addresses or use a sender field to remove all non-SMTP email addresses from a message.

[quote user="Thomas R. Stephenson"]

If they forwarded it with editing and did not remove the headers it's quite possible that this servers anti-spam system would still reject since it's still checked the body of the email message.  Check to see exactly how the forwarded the message and again do a session log to see where the receiving server is chocking on the message body. 

Again, FWIW, people using a dist. list really should use full SMTP addresses or use a sender field to remove all non-SMTP email addresses from a message.

[/quote]

This is exactly why the server was rejecting the message

[quote user="greenman"]

After clicking 'Forward' in Pegasus and editing the message to remove the names from the distribution list that appear in the body of the message, the mail was successfully delivered.

[/quote]

It is very rare for a message sent via a distribution list to be forwarded outside the company. And I still can't believe that a server would act on addresses not intentionally put in the To: field [:)] However, as you say, I will put a "List name" <user@domain.com> in the sender field for the D-List settings.

It is very rare for a message sent via a distribution list to be

forwarded outside the company. And I still can't believe that a server

would act on addresses not intentionally put in the To: field However, as you say, I will put a "List name" <user@domain.com> in the sender field for the D-List settings.

I'm very surprised that you've not run into this before.  Years ago I'd turned off all local delivery on my systems for this very reason. 

In addition, in many cases what is sent internally gets sent out to the outside world and if it goes through one of those systems that 'fixes" the addresses by adding it's host name then mail can very easily be sent to the the same user in a different domain.  For example, if I were to send a message to thomas@tstephenson.com and cc: the address thomas when it get to the bayarea.net server is may well change this to thomas@bayarea.net and send it along.  If I were to reply to that message and include the Cc: address of course it's sent to the wrong domain.

Yes, I understand that, but you have intentionally added a local address to the recipient list. In your scenario, the local address 'thomas' is designed to be acted upon by the receiving server because it is located in the delivery headers,

If I forward a message sent to me via an internal distribution list (where the addresses are of the form greenman, blueman, redman), I am asked for a recipient address. I type this address in the Forward to: field e.g. rob.white@domain.com and the message is then passed onto Mercury. Mercury then sends the message from my account green.man@apsarchaeology.co.uk to rob.white@domain.com. The body of the message may contain the distribution list, but it is in the body, not in the headers.

It makes no sense for the receiving server to process local addresses that appear in the body of the message. I would have expected the contents of the message body to be ignored. Admittedly, I am still learning about this, so my comments may be quite wrong.

[quote user="Greenman"]

The body of the message may contain the distribution list, but it is in the body, not in the headers.

[/quote]

In the session log above, the local addresses are in the To: header of the message, not in the body (the part after the blank line after the headers).

This is completely separate to the SMTP envelope MAIL FROM: & RCPT TO: fields (sometimes referred to as 'headers') which may or may not be added to the message headers depending on the mail server. (e.g. Return Path:, X-Delivered To: etc)

The entire message (headers & body, as written by the mail client, with sending server additions such as Received: etc.) is passed to the server in the DATA part of the SMTP transaction, after a successful MAIL FROM: & RCPT TO: exchange.

This server is also checking the headers of the received message for compliance with it's own rules.
 

Amazing. Thanks a lot for that.

I've changed the Distribution List settings now, so hopefully this will not occur again.

Thanks to everyone for helping me understand this.

Yes, I understand that, but you have intentionally added a local

address to the recipient list. In your scenario, the local address

'thomas' is designed to be acted upon by the receiving server because

it is located in the delivery headers,

OMG! I never realised that. Thanks again.