Single Address Not Receiving External Mail

[Malinthas]

We are using Exchange 2007. My account is configured to have several aliases, one of which is webmaster@. This alias is NOT getting any mail sent to it externally, although internal messages get delivered just fine. All other addresses and aliases are being delivered fine. What on Earth could possibly cause this? Thanks,

~Mark

 

[andrewjamesb]

Hi

Do you have any bounce back emails to share when you try to send an external email to your webmaster@ alias email address?

Can you email out from webmaster@ successfully?

Are your internal email accounts going through clearswift mimesweeper or other filtering software when sending out and receiving external emails? If so the external mail may be blocked or quarantined

Regards
Andy

 

[Malinthas]

Thanks for the reply, Andrew. I'll try to answer your questions as well as I can.

-I do not receive any bounce back messages. I have sent to the address using GMail, Road Runner, and even my txt service. They just seem to drop into an abyss.
-I'm not sure how to send "from" the address, exactly. When I use Outlook to compose mail, it sends from my (default) mark@ address. If I enter webmaster@ into the From field, it converts it back to mark@ for me. I can choose to send as other users whom I have permissions to send on behalf of, but since webmaster@ is an alias for my own account, this doesn't help me.
-We use a firewall to scan our incoming messages for spam, but I can see nothing caught in the spam filter for webmaster@ when I look. This is odd in itself, since that address normally receives more spam per day than any other. My default address, and a few other aliases, DO have mail caught in the filter, as they should.

 

[ShackDaddy]

What firewall are you using to scan messages? Is it one that is supposed to know what all the valid email addresses in the org are via LDAP query?

Dave Shackelford
ThirdTier.net
TrainSignal.com

 

[Malinthas]

I'm afraid you're outside my area of expertise. What I can tell you is that we're using an eSoft InstaGate firewall, and that I have never needed to change any settings in order to allow specific addresses through. More to the point, nobody has made any changes to the firewall recently.

 

[Malinthas]

EDIT: I just looked into my firewall's settings; LDAP is NOT turned on. In faxct, the only enabled setting under "Email: Address Verification" is "SMTP via incoming email server". Furthermore, there are no messages in-queue.

 

[Malinthas]

So, I took a look around the firewall. When I searched the e-mail activity logs, I DO see messages intended for the webmaster@ address coming through. They show as "Clean", so not a spam or blacklist problem. Still, they never arrive in my Inbox. I fel like that HAS to finger Exchange as the culprit, but I'm not sure how to track down a message's path once it arrives at my Exchange server. I mean, I checked some obvious things (like ensuring there wasn't a typo in the alias) but I'm not sure how else to troubleshoot this.

 

[Zelandakh]

Check message tracking logs and see if they show the messages and what happens to them.

Any anti spam software on Exchange or client?

 

[Malinthas]

There is no anti-spam on the Exchange server, and the only thing locally is Outlook's Junk Mail function, which is... less than robust. Anyway, I checked that folder, and nada.

I'm afraid I'll need a little hand-holding as far as the logs. Which logs, what do I use to access them, and what exactly should I be looking for?

 

[Malinthas]

Okay, I exported the Mesasge Tracking Log for any messages sent to the webmaster@ address, and... nothing. Only internal messages on the log. None of the messages I have sent from external accounts appears at all. I know they're making it to the firewall and passing through, but they appear NOT to be making it to the server, and... well, there's really nothing in-between. Any ideas?

 

[Zelandakh]

From the LAN, telnet on port 25 to the Exchange server. Note the header information.
From outside the LAN, go to

http://www.mxtoolbox.com

and look up the MX record for your domain.
Telnet to that address (eg mail.yourdomain.com) on port 25
Same header?

My guess is still that there's a box in the middle that is dropping the emails.

 

[Malinthas]

I'm not sure. I haven't ever used Telnet before, so I took a stab.

On a PC on the same network as my server, I opened an elevated command prompt I typed:
telnet 192.168.1.2 25
The result was:
220 sbs-w2k8-1.peacemakedom.local Microsoft ESMTP MAIL Service ready at Thu, 27 Dec 2012 13:04:01 -0500

I then opened an elevated command prompt on my machine at home, across town, and entered:
telnet remote.thepeacemakerprogram.org 25
The result was:
220 thepeacemakerprogram.org ESMTP Thu, 27 Dec 2012 13:04:35 -0500

I have no idea what any of that means, or if it's good, bad, or indifferent. I may need more direction regarding what to enter into telnet, to get the info you're looking for. Thanks,

~Mark

 

[Zelandakh]

So they ought to give you the same results so the outside is hitting something else.

According to my resolution, I make your IP 208.125.236.54
Look on the firewall for port 25 being published - is it published on that public IP? (It may not be listed of course).
Does the firewall setting detail the internal IP and does that match 192.168.1.2?

 

[Malinthas]

I will take a look around my firewall's settings, but I have to ask: would any of the problems you're proposing casue a SINGLE address to not receive, while all others come through fine? That's what has me stymied.

Looking at my firewall, I'm lost... can you give me a better idea where to look for the settings you're referring to? Sorry if I seem clueless... but, you know, I am.

 

[Zelandakh]

I would say that there is a device in the way between the public IP endpoint and Exchange that receives the emails and is configured not to pass on the webmaster address. You just need to find it.

There are thousands of firewalls out there so I can't help you with what to click on - somewhere in the config of the firewall you'll find how to publish externally on port 25 and that will list the internal address used on the LAN. Compare that to the Exchange server and I reckon they are different. If you can get the LAN side address of the box doing the proxying then you can connect to it and find the setting that is stopping webmaster.

 

[ShackDaddy]

Try this in Exchange Powershell:

Get-AgentLog | where {$_.recipients -like "webmaster@yourdomain.com"}

It should return a log of the ways that those messages have been handled by the anti-spam modules on the Exchange 2007 box. If examine the results, you should be able to read the Action and Reason fields to see what was done with them.

More details here:

http://ben.goodacre.name/tech/Searching_the_Anti-spam_Agent_Log_(Exchange_2007)

Dave Shackelford
ThirdTier.net
TrainSignal.com

 

[Malinthas]

@Zelandakh: I will continue to poke around the firewall, looking for any setting that specifically treats webmaster@ different. Can't imagine what it ould be, though, since the anti-spam features have already been eliminated.

@ShackDaddy: The only messages that appear on the log you recommended are those generated internally, which came through fine. External messages do not appear at all.