Thank you, Thomas.

It was a filter. The original address does not exist on our system and a filter is used to move the message with that address in the To: and Cc: fields to 'user'.

So, each time Mercury/32 encountered it, the filtering rule kicked in.

Man, another one! D'oh! Thanks a lot for your help.

Cheers!

Hi folks

One of our users (user@) has just had a strange thing happen when forwarding an email message. All forwarding addresses shown below are destined for local mail accounts. All are internal.

The user received an email intended for me. They forwarded it using the second option to 'Forward the message without editing (redirect, or "bounce")' and forwarded it to green.man@aps... (the address that appears in the sysnonym list) This worked fine, and the message was received. However, what then happened was that they also received a copy of the forwarded message in their inbox. They now have two copies of the same message.

When the email is forwarded using just the local address (To: greenman), a copy is *not* received by user@. When the mail is forwarded using the firstname.lastname format (To: green.man@apsarchaeology.co.uk), user@ received a copy too.

So, I forwarded the email message back to the user, but used a second separate address. This is the strange part: The message I forwarded back to their 2nd address was received. But, they also received a copy of the same message in the user@ inbox, which was the original recipient address.

Here are the headers from the mail that was received by user@ after I forwarded it to user's.2nd.address@aps...:

Resent-from: "Green Man" <green.man@apsarchaeology.co.uk>
Resent-to: user's.2nd.address@apsarchaeology.co.uk
Resent-date: Fri, 05 Sep 2008 09:36:06 +0100
Received: from spooler by apsarchaeology.co.uk (Mercury/32 v4.52); 5 Sep 2008 09:20:26 +0100
X-Envelope-To: green.man@apsarchaeology.co.uk
Resent-from: "user" <user@apsarchaeology.co.uk>
Resent-to: green.man@apsarchaeology.co.uk
Resent-date: Fri, 05 Sep 2008 09:19:38 +0100
X-SPAMWALL: Passed through antiSPAM test by SpamHalter 4.3.1 on apsarchaeology.co.uk (1802)
X-SPAMWALL: probability - 0.0%
Return-path: <sender@lincoln.gov.uk>
Received: from mail186.messagelabs.com (85.158.138.131) by apsarchaeology.co.uk (Mercury/32 v4.52) ID MG0002A7;
   4 Sep 2008 16:48:57 +0100
X-VirusChecked: Checked
X-Env-Sender: sender@lincoln.gov.uk
X-Msg-Ref: server-14.tower-186.messagelabs.com!1220543230!9408074!1
X-StarScan-Version: 5.5.12.14.2; banners=-,-,apsarchaeology.co.uk
X-Originating-IP: [80.6.91.29]
X-SpamReason: No, hits=0.0 required=7.0 tests=Mail larger than max spam
  size
Received: (qmail 21562 invoked from network); 4 Sep 2008 15:47:12 -0000
Received: from mail.lincoln.gov.uk (HELO lincoln-sweep.Lincoln.gov.uk) (80.6.91.29)
  by server-14.tower-186.messagelabs.com with SMTP; 4 Sep 2008 15:47:12 -0000
Received: from exchange.Lincoln.local (exchange) by
    lincoln-sweep.Lincoln.gov.uk (Clearswift SMTPRS 5.1.4) with ESMTP id
    <T893aab5e010a0a019e968@lincoln-sweep.Lincoln.gov.uk> for
    <user@apsarchaeology.co.uk>; Thu, 4 Sep 2008 16:47:08 +0100
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary=
    "----_=_NextPart_001_01C90EA5.5F937458"
X-MimeOLE: Produced By Microsoft Exchange V6.5
Subject: Email Subject
Date: Thu, 4 Sep 2008 16:46:19 +0100
Message-ID: <6470D0BD54F482438375601DDB7C8E65018FB01C@exchange.Lincoln.local>
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
Thread-Topic: Email Subject
Thread-Index: AckOpU7886jxqi58RsSF2CCvsPUj4Q==
From: "sender"
    <sender@lincoln.gov.uk>
To: "User" <user@apsarchaeology.co.uk>
X-PMFLAGS: 570949760 0 1 3A275773.CNM                      

What I don't understand is why a copy of the forwarded message is being received by the user@ account, even when the message is not forwarded to that account.

All forwarding here was local. Mercury recognises all our synonyms (green.man@aps...) as local addresses.

I also tried to duplicate this without success - I sent user@ an email from my gmail account and asked user@ to forward it to both my local address (greenman) and the non-local address (green.man@aps...). They did not receive a copy of the message. Here are the headers from the message which I received:

Received: from spooler by apsarchaeology.co.uk (Mercury/32 v4.52); 5 Sep 2008 11:05:37 +0100
X-Envelope-To: green.man@apsarchaeology.co.uk
Resent-from: "User" <user@apsarchaeology.co.uk>
Resent-to: green.man@apsarchaeology.co.uk
Resent-date: Fri, 05 Sep 2008 11:05:17 +0100
Received: from spooler by apsarchaeology.co.uk (Mercury/32 v4.52); 5 Sep 2008 11:03:14 +0100
X-Envelope-To: <user@apsarchaeology.co.uk>
X-SPAMWALL: Passed through antiSPAM test by SpamHalter 4.3.1 on apsarchaeology.co.uk (1612)
X-SPAMWALL: probability - 0.0%
Return-path: <greenman@googlemail.com>
Received: from mail169.messagelabs.com (85.158.138.179) by apsarchaeology.co.uk (Mercury/32 v4.52) ID MG000199;
   5 Sep 2008 11:03:04 +0100
X-VirusChecked: Checked
X-Env-Sender: greenman@googlemail.com
X-Msg-Ref: server-8.tower-169.messagelabs.com!1220609080!9726497!1
X-StarScan-Version: 5.5.12.14.2; banners=-,-,apsarchaeology.co.uk
X-Originating-IP: [209.85.200.169]
X-SpamReason: No, hits=0.4 required=7.0 tests=HTML_50_60,HTML_MESSAGE,
  RCVD_BY_IP
Received: (qmail 16905 invoked from network); 5 Sep 2008 10:04:41 -0000
Received: from wf-out-1314.google.com (HELO wf-out-1314.google.com) (209.85.200.169)
  by server-8.tower-169.messagelabs.com with SMTP; 5 Sep 2008 10:04:41 -0000
Received: by wf-out-1314.google.com with SMTP id 27so396569wfd.17
        for <user@apsarchaeology.co.uk>; Fri, 05 Sep 2008 03:04:40 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=googlemail.com; s=gamma;
        h=domainkey-signature:received:received:message-id:date:from:to
         :subject:mime-version:content-type;
        bh=Bt1HI6dmr4lI/gdSahPj2jCEaUhyEpZx4X0aiHramMU=;
        b=E68DqLX1sg1kUe7G2773YtzG9qXhRNFLHuvIl8x+QhutDQv0Xtk3ithBCDBQ7Yh3y/
         ilefl8h2LGDtKSgN7fqIB5C0t8VAQV/skVkwCX2Chroob/4RvqxmK53/fz/ub+q4455f
         VQCu1TKCaI1TIFoVr1VPopOxv6WGMH5BITTio=
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=googlemail.com; s=gamma;
        h=message-id:date:from:to:subject:mime-version:content-type;
        b=W/Pipl2C/OlIWagDlXZy8vDD3Qv5pEwobS+IP4sh9YWWM0FPxcD6mh83IqtaqsK6KR
         osTHDaguyUj01Ptnf7ExHeLbHueTACzDs+IXb5GGnDFjLETHbHvL1aOybDZbvEacvoMG
         Cq7MV0XgnAt1OVmhFRW3ekXkbHlqfDL8mUSeE=
Received: by 10.142.222.21 with SMTP id u21mr3979234wfg.323.1220609079970;
        Fri, 05 Sep 2008 03:04:39 -0700 (PDT)
Received: by 10.142.113.9 with HTTP; Fri, 5 Sep 2008 03:04:39 -0700 (PDT)
Message-ID: <a83ac0400809050304v88e226fr9d3f7fe07b05bc1a@mail.gmail.com>
Date: Fri, 5 Sep 2008 11:04:39 +0100
From: "Green Man" <greenman@googlemail.com>
To: user@apsarchaeology.co.uk
Subject: Forward me
MIME-Version: 1.0
Content-Type: multipart/alternative;
 boundary="----=_Part_62087_9958321.1220609079979"
X-PMFLAGS: 570950016 0 1 Y69D173U.CNM

Can anyone help me understand what has happened here please? I've not seen this before.

Thanks

The first thing I would do is verify that you are not running more than one copy of Mercury/32.  Then I would check the received copies message headers to see if this is one message sent multiple times (different message ids) or the same message received multiple times (same message id).  Finally, this looks like it is going through a separate spam filter and i would verify it's only using the SMTP headers for delivering the mail since if iot used the original To: headers it would also go to the sender.

[quote user="Thomas R. Stephenson"]

The first thing I would do is verify that you are not running more than one copy of Mercury/32.  Then I would check the received copies message headers to see if this is one message sent multiple times (different message ids) or the same message received multiple times (same message id).  Finally, this looks like it is going through a separate spam filter and i would verify it's only using the SMTP headers for delivering the mail since if iot used the original To: headers it would also go to the sender.

[/quote]

Hi Thomas, thanks for the reply.

I checked the server and there is just one copy of Mercury/32 running. The original sender sent this message to one recipient - user. Each of the copies received - the original, the message I received and the copy received by user after forwarding to me and the copy received by user after I forwarded the messge back to their 2nd address all have the same message ID.

I was also wondering if the message was being redelivered to the original recipient address. But, how can this be? As I understand it, forwarding to a new address will forward the message to the new address only. Mercury/32 recognises that all the synonyms used - To: green.man@aps... and To: user's.2nd.address@aps... are local addresses and are processed inside our network. The message does not go out then arrive back in. If it did, then I could understand why user was receiving a copy.

What I find confusing is that when the same message is forwarded to the local address in its simple form To: greenman or To: user a copy is not received by the original recipient (user). There are two spam filters which the original message has gone through - Clearswift at the sender's domain, and SpamHalter at our domain.

Any further help in understanding this would be appreciated.

Thanks

As I understand it, forwarding to a new address will forward the message to the new address only.

What I find confusing is that when the same message is forwarded to the

local address in its simple form To: greenman or To: user a copy is not

received by the original recipient (user).

This is match directly to the local user and so no alias, synonym, filter is involved. If you could do this as a test you could watch the mail as it's processed through Mercury/32 and you might see what happening.  The Mercury/32 system messages (Windows | System messages)  might help here.