How can i identify if my mails are forwarded?

[MagnaDaman]

Hi all,

I'm curious about if my emails are forwarded to someoneelse.
Actually, not curious but sure. I think that someone made forwarding settings on the server.
Our mail server is Exchange 5.5.

Is there a way to identify which address or machine my mails are forwarded?

I tried some email trackers but none of them shows machine name or ip of the machine received my mails. They show only ip address of the gateway of the other location. When i send mails with these trackers, i can easily see this, someone else is reading my mails from another location.
But how can i find who reads this? machine name or ip or mail address?

This is very crucial for me.
Thanks in advance for your interest.

Regards,

 

[Grenage]

Assuming you are responsible for the network/e-mail then you can check at least that section. Before proceeding though, why exactly do you suspect your email of being copied/redirected? What evidence do you have?

I ask because when a user's e-mail is being forwarded elsewhere at the exchange level, there is nothing at the client end that could/would indicate such.


Carlsberg don't run I.T departments, but if they did they'd probably be more fun.

 

[MagnaDaman]

I'm not responsible for network/e-mail.
I'm sure my mails are forwarded/redirected to another mailbox. Because, I have some proofs from tracking software and also from other resources.

Structure is like this:
I am currently located in "Site A" and our mail server is in another site "Site B". All administration handled from "Site B". Site A and B has real ip adresses on the routers. Also, Site B has several real IP for mail, web, firewall servers.

As I said, I can see someone opens/reads my mails from trackers but i don't know who. Actually, I know but i need to prove this. Trackers show only IP of firewall or router, not clients IP. If i can catch his mail address/Client IP or machine name, this will be a very strong proof for me and others.

Any idea how to prove the issue?

 

[Grenage]

Without access to the exchange administrator console there isn't much you can do. That aside, I don't see how a 'mail tracker' can show you if your email has been forwarded. It's untraceable at the client end. You're probably just seeing the IP addresses of nodes in the e-mail header.


Carlsberg don't run I.T departments, but if they did they'd probably be more fun.

 

[dennisbbb]

The tracker probably incorporates an embedded link. Thus, when the original or forwarded email is opened, the ip address is traced. Note that by this method, any forwarded email opened, will yield a trace.

As Grenage said, there is no way to show to whom your mail is being forwarded without direct access to your profile on the Exchange Administrator.

 

[N0ktar]

Have you tried a ReadNotify service?

http://www.readnotify.com/readnotify/about.asp

This way you know for a fact the email has been read, even if you did not opent it yourself. (this way you know alrternate receipient read the email). It is possible the system will identify email address of the final receipient.

Tracking reports available:
- Date and time opened
- Location of recipient (per their ISP city /town)
- Map of location (available on paid subscriptions)
- Recipients IP address
- Apparent email address of opening (if available)
- Referrer details (ie; if accessed via web mail etc)
- URL clicks
- How long the email was read for
- How many times your email was opened
- If your email was forwarded, or opened on a different computer

 

[WDMail]

A couple of other possibilities....

- Someone with the correct permissions could be accessing your mailbox directly.

- The mail server could be journaled. Basically, tossing a copy of all mail crossing a certain point into another location.

Monitoring mail is not an uncommon practice. Most decent spam appliances will do it.

I would talk to the HR dept. They should have the authority to investigate it.

 

[Marcs41]

IF this is the case, there are 2 main possibilities:

1: It is being sent somewhere for archiving, as requested by law here and there.

2: It is being forwarded to a curious individual.

Talk to the IT dept. and ASK them to SEE your settings.

Marc
[sub]If 'something' 'somewhere' gives 'some' error, expect random guesses or no replies at all.
Free Tip: The F1 Key does NOT destroy your PC![/sub]