https://tools.ietf.org/html/rfc5322#section-3.6.2

Originator Fields

The originator fields of a message consist of the from field, the
sender field (when applicable), and optionally the reply-to field.
The from field consists of the field name "From" and a comma-
separated list of one or more mailbox specifications. If the from
field contains more than one mailbox specification in the mailbox-
list, then the sender field, containing the field name "Sender" and a
single mailbox specification, MUST appear in the message. In either
case, an optional reply-to field MAY also be included, which contains
the field name "Reply-To" and a comma-separated list of one or more
addresses.

from = "From:" mailbox-list CRLF

sender = "Sender:" mailbox CRLF

reply-to = "Reply-To:" address-list CRLF

The originator fields indicate the mailbox(es) of the source of the
message. The "From:" field specifies the author(s) of the message,
that is, the mailbox(es) of the person(s) or system(s) responsible
for the writing of the message. The "Sender:" field specifies the
mailbox of the agent responsible for the actual transmission of the
message. For example, if a secretary were to send a message for
another person, the mailbox of the secretary would appear in the
"Sender:" field and the mailbox of the actual author would appear in
the "From:" field. If the originator of the message can be indicated by a single mailbox and the author and transmitter are identical, the "Sender:" field SHOULD NOT be used. Otherwise, both fields SHOULD appear.

Note: The transmitter information is always present. The absence
of the "Sender:" field is sometimes mistakenly taken to mean that
the agent responsible for transmission of the message has not been
specified. This absence merely means that the transmitter is
identical to the author and is therefore not redundantly placed
into the "Sender:" field.

The originator fields also provide the information required when
replying to a message. When the "Reply-To:" field is present, it
indicates the address(es) to which the author of the message suggests
that replies be sent. In the absence of the "Reply-To:" field,
replies SHOULD by default be sent to the mailbox(es) specified in the
"From:" field unless otherwise specified by the person composing the
reply.

In all cases, the "From:" field SHOULD NOT contain any mailbox that
does not belong to the author(s) of the message. See also section
3.6.3 for more information on forming the destination addresses for a
reply.

@dbeato said in Office 365 Moving Emails to Deleted Items:

@dafyre said in Office 365 Moving Emails to Deleted Items:

@dbeato said in Office 365 Moving Emails to Deleted Items:

@dafyre said in Office 365 Moving Emails to Deleted Items:

e got a strange one... I have a user here whose Emails go from whatever folder they are in to the Deleted Items folder after being read... Sometimes. Sometimes it doesn't happen for several minutes, and other times it happens right away.
The user hasn't been phished that we can tell. No bogus rules in Outlook forwarding things to the deleted items. Check both Web and Outlook 2016.
What am I not looking at that could be causing this?

They got hacked though
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
https://docs.microsoft.com/en-us/office365/securitycompliance/responding-to-a-compromised-email-account

Sometimes the rule is a dot on the name....

I am assuming it's a hacked account, but we changed the password to a new one. I disconnected all of her sessions from Office 365.

Still happening. I see no rules with a dot in the name... or spaces or foreign characters. I see exactly the number of rules on my CLI as I do in Outlook and OWA.

Can you clear them all ? Take a screenshot of the settings and then remove them and see what changes. The rules run autonomously and is not someone running them.

That's what we've done now. All of the rules are disabled. End-user is turning them back on one at a time now.

@JaredBusch said in Resolved - Postfix on Fedora 29 - Why Can't I Send Mail?:

@wrx7m said in Resolved - Postfix on Fedora 29 - Why Can't I Send Mail?:

It applied to the instance (multiple servers)

FFS no. That is not what anything is.

It applied to the Account. Which contains multiple instances.
Instances that could be servers or desktops or WTF ever.

My apologies. I meant to put account.

@scottalanmiller said in Microsoft BCL or Bulk Complaint Level Values for Email:

Some sources call this an SCL or Spam Complaint Level.

Emails into O365 have both BCL and SCL.

Does the message trace in Exchange tell you anything? I know that when I had on-prem exchange and barracuda, I had weird issues where the attachment size restrictions being smaller/more restrictive on the Exchange server exhibited this behavior. The barracuda delivered, but Exchange rejected due to policy.

@flaxking said in Office 365 SMTP server not advertising StartTLS:

No idea, we don't manage the client's infrastructure

Then it was definitely the UTM, no question.

I used to use a barracuda 300 (for about 6 years) in conjunction with their cloud filtering for our on-prem Exchange 2010 server. I think there were 2 times that they had some sort of issue where they let a crap-ton of spam through, unfiltered.

I have moved to Office 365 and am exclusively using their filtering. I think barracuda was better at filtering. Especially, when it comes to phishing messages that pretend to be from Microsoft's services. You'd think that Microsoft would be able to catch those better than anyone. Not in my experience.

@huzefa22 said in Same subdomain name internal and external i have an issue with the DNS, specifically emails:

@Dashrender when i ping mail.abc.xyz.com i don't get a reply, the SOA is the primary and the secondary domain on the local domain. i don't know if this is what you were asking.

Regards,
Huzefa

Never test DNS with ping. Test with nslookup. Whether you can ping or not is a factor of many things, DNS just one of them and only sometimes. nslookup tests DNS and nothing else.

Good to know, I use Ubuntu/Debian so I will check for that.

@travisdh1 said in SPAM Filtering with Zimbra:

@dbeato I'm a fan of using their RBL list. Anyone know if that's still available for free?

@travisdh1 also the server is b.barracudacentral.org

@mrwright4hire said in Mail stuck in Office 365, Enterprise Exchange queue!:

@dbeato said in Mail stuck in Office 365, Enterprise Exchange queue!:

@mrwright4hire said in Mail stuck in Office 365, Enterprise Exchange queue!:

A few users are having issues sending out emails. Not everytime, but intermittent. Has anyone experienced this type of issue before? I can use all the help I can get. I would like to know how to release the emails and avoid emails getting stuck again.

In advanced, thank you for your efforts.

Have any of your users been not able to send at all? I am not seeing that right now.

Great question dbeato! Here's the thing, I myself tried to email the same address while monitoring it from Barracuda. Nothing showed up as going out. It's strange cause we received email from the address.

So it is on the received end of Barracuda?

@jaredbusch said in Does Office 365 Support Plus Notation in Email (+):

@scottalanmiller said in Does Office 365 Support Plus Notation in Email (+):

@kelly said in Does Office 365 Support Plus Notation in Email (+):

The period notation is really annoying for me. I signed up [email protected] when it was in beta and this "feature" wasn't publicized. Years later someone else was able to register [email protected] and now I get DoTerra order details and the like. I have no idea what I don't get at this point.

Don't know about a period notation feature. What does that do? And how do that not break email globally?

The same way that + doesn't break it. It is outside of the RFC altogether. So as long as wtf ever service you sign up for lets you type it, then you can do it.

As for what it does. Well [email protected] is a common thing. But someone that signs up to gmail with [email protected] can also receive email from email sent to [email protected] or even [email protected].

Google simply ignore all periods on the left of the @ for gmail based email addresses. Gmail only, not GSuite.

Wow, that's.... weird. I guess it works until they do something like the story above and screw it up.

Currently driving, but should be able to look at update relatively soon.

Yup, basically just automating Postfix configs.

The O365 account is used at multiple services (network monitoring, snipeit are some of them). I guess mailgun would be a good choice to avoid this altogether. The free version supports 10K mails

@zachary715 said in How to receive e-mail alerts from internal devices:

Do you guys go beyond the SPF records and also implement DKIM or DMARC? I've looked into these briefly but not much. DKIM looks fairly straightforward with Office 365.

I've checked them both. I will not implement DKIM anytime soon. It adds little on top of SPF.

DMARC is a layer on top of SPF and/or DKIM you cannot use DMARC without one of the other in place.

All DMARC does is tell the recipient system what to do with a message that fails the SPF/DKIM check. Instead of letting the recipient system decide what to do about it.

@anthonyh said in Testing Zimbra Upgrade - 8.6.0 to 8.8.6:

I restored our production Zimbra server (CentOS 7) from backup to use as a testing environment for upgrading from Zimbra 8.6.0 to current (8.8.6 as of this writing).

Restore was fine. Gave the host an IP on a separate network. Followed a Zimbra wiki article on changing the server's hostname which worked no problem (from what I can tell). Fired up the services and Zimbra 8.6.0 came up hunky dory.

I do a yum update and install all pending updates (not many since I try to keep prod as current as possible), reboot the test server to verify Zimbra is still happy. Everything is good.

I download the 8.8.6 installer and current hotfix and stage them. I then snapshot the VM.

I run the 8.8.6 installer and it completes without complaint.

Where the problems begin. I cannot get to the Zimbra user interface. Management (7071) works fine. This points to a proxy issue.

I check and the proxy service is not running. I fire it up manually using zmproxyctl start and wait a minute. I eventually get the following error:

Starting proxy...nginx: [emerg] invalid URL prefix in /opt/zimbra/conf/nginx/includes/nginx.conf.zmlookup:3

I edit the file in question and, sure enough, the production IP is listed.

zm_lookup_handlers [PROD-IP]:7072/service/extension/nginx-lookup;

So I change it to the IP of the test VM (also tried 127.0.0.1 for the heck of it). However, this did not resolve the problem. Attempting to start the proxy service results in the same error.

So I test by telnetting to [TEST-IP]:7072 and it works. I try browsing to the path as shown in the config via a web browser and I get (from Chrome):

[TEST-IP] didn’t send any data. ERR_EMPTY_RESPONSE

Though I don't know if that indicates if there is an issue or not with whatever service is listening on 7072.

Any ideas?

@anthonyh said in Testing Zimbra Upgrade - 8.6.0 to 8.8.6:

In case anyone needs it, here is the solution. Looks like the instructions I followed to change the hostname did not include the proxy service. So to cover all bases, use the following commands after following the article here: https://wiki.zimbra.com/wiki/ZmSetServerName

zmprov ms `zmhostname` zimbraReverseProxyUpstreamLoginServers new.hostname.com zmprov ms `zmhostname` zimbraReverseProxyUpstreamEwsServers new.hostname.com zmprov mcf zimbraReverseProxyUpstreamLoginServers new.hostname.com zmprov mcf zimbraReverseProxyUpstreamEwsServers new.hostname.com /opt/zimbra/libexec/zmproxyconfgen zmproxyctl restart

To quote this further..

Edit file /opt/zimbra/conf/nginx/includes/nginx.conf.zmlookup

Modify URL to match the below (change hostname with yours):

zm_lookup_handlers https://mail.hostname.com:7072/service/extension/nginx-lookup;

Disable module chunkin because since 1.3.9 & above, Nginx core already has built-in support for the chunked request bodies, hence its no longer needed.

Verify Nginx version to see if it has been upgraded to 1.7.1

[zimbra@mail ~]$ nginx -v nginx version: nginx/1.7.1

Edit file /opt/zimbra/conf/nginx/includes/nginx.conf.web

Comment the following:

# chunkin on;

Edit file /opt/zimbra/conf/nginx/includes/nginx.conf.web.https.default

Comment these 4 lines & save the file:

# chunkin handler # location @chunkin_handler { # chunkin_resume; # }

Finally restart the proxy service:

zmproxyctl restart

Hope this helps 🙂

Kind regards,
Viraj

@scottalanmiller said in How Does dnf-automatic Send Emails:

@dashrender said in How Does dnf-automatic Send Emails:

@scottalanmiller said in How Does dnf-automatic Send Emails:

@dashrender said in How Does dnf-automatic Send Emails:

@scottalanmiller said in How Does dnf-automatic Send Emails:

@dashrender said in How Does dnf-automatic Send Emails:

@jaredbusch said in How Does dnf-automatic Send Emails:

@scottalanmiller said in How Does dnf-automatic Send Emails:

Starting from another thread....

If you are used to dealing with commands like mail from the mailx package, you may be used to apps that require a local MTA in order to send emails. In the config files of dnf-automatic however, we can instantly see that there is configuration for entering a non-local server. This means that dnf-automatic is implementing the SMTP protocol (SMTP) itself and is not dropping files in a queue.

[email] # The address to send email messages from. email_from = [email protected] # List of addresses to send messages to. email_to = root # Name of the host to connect to to send email messages. email_host = localhost

Because of this, we know that dnf-automatic is acting as an SMTP server on its own and must be configured for how your network is going to handle email and is not just relying on the default configuration of the system MTA.

No, this is jsut droping a mail to root. not email.

Wouldn't be better to say it's an SMTP client? Akin to Thunderbird?

But in this case it's not doing that, so would be confusing. Thunderbird is an SMTP client, but doesn't do the local drop piece.

What's not doing what? dnf-automatic isn't doing a local drop piece either. It uses SMTP to drop to localhost, not whatever mailx is doing to function.
So in that regard, it should be exactly like what Thunderbird is doing, no?

I don't believe that that is true, but maybe it is.

Well we know dnf-automatic will deliver to postfix on another host assuming that host is configured to allow relay from the dnf host. Am I missing something?

Does dnf-automatic not do both, though?

I don't know if dnf-automatic is doing the local drop piece like mailx does.

@JaredBusch before this post
0_1513632960663_before.jpg

@JaredBusch after this post
0_1513632969516_after.jpg

@BRRABill said in Comparing Fax and Email Security:

@scottalanmiller said in Comparing Fax and Email Security:

@BRRABill said in Comparing Fax and Email Security:

P.S. Are you getting paid by some strange company to use the word "corruption" this week?

Calling it as it is. The world is a very corrupt place and most of it happens because society conditions us to feel like it is acceptable.

And there it is ... AGAIN! 🙂

Society hasn't changed, it's just how it is.