Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Email Security Quick-links: ESA Product Support | SMA Product Support | Email Submission and Tracking Portal | Cisco SecurityHub
Current General Deployment (GD) Releases:
ESA: 11.0.0-264 WSA: 10.5.1-296 SMA: 11.0.0-115 Email Plug-in (Reporting): 1.0.1-048 Email Plug-in (Encryption): 1.0.0-036

New Member

Detecting the mail ID in wrong format

Hi All,

If someone is sending the mail to internal users, some time it reaches the receipent and some time it is dropping at ironport.

when I gone through the logs for the same, i have found some strange thing like below.

"Envelope Sender: suggest=websense.com__9j3y6p8k407zfhec@79hk3fmsddet.2-7dpeaq.2.bnc.salesforce.com"

actual mail id of envelope sender is "suggest@websence.com"

can any one pls suggest me why ironport is detecting the Envelope Sender mail id in wrong format and what are all the correcting steps.

pls find the attached file for more reference.

thank you very much.

Regards,

Lingaraj R N

4 REPLIES
Cisco Employee

Detecting the mail ID in wrong format

LRN -

More than likely, this is actually something that is being done from the Salesforce side when sending to the end receipient.

Please review the message tracking for the email.  Salesforce will take the email address, and re-write, in order to manage/route/track the messages on their side.

To obtain message tracking from the web interface:

- Go to MONITOR > MESSAGE TRACKING

- Search for the email in question

- Click the 'Show Details' link next to the email in question

Regards,

Robert

Email Content Security Technical Services - RTP, NC

New Member

Detecting the mail ID in wrong format

Hi Robert,

thanks for your revert.

does ironport change the sender mail id.

kindly confirm.

Regards,

LRN

Cisco Employee

Detecting the mail ID in wrong format

Not unless you have content/message filter in play that is doing this.

One thing to keep in mind - the "return-path" in the message is different than the envelope sender.  An injection debug of an incoming message would prove this.

-Robert

New Member

Detecting the mail ID in wrong format

I can't say for certain, but this looks very much like a form of bounce-validation being implemented by the websence.com domain mail gateway.  The ironport does something similar if you enable the bounce validation.

Note that the envelope sender does not have to be the same as the message From header, which probably still shows the suggest@websence.com address.  The envelope sender is used more for NDRs and similar.

Steve

428
Views
0
Helpful
4
Replies