0

In the process of troubleshooting another issue, I have turned on protocol logging on my Exchange 2010 server. I noticed that there are numerous instances of MAIL FROM:<> in the logs. Many of the messages show information like MAIL FROM:<[email protected]> SIZE=11209, so I'm a bit worried that perhaps something is amiss.

This is even more suspicious because most instances of this appear to correspond to failed attempts as message relay.

Here's an example

2013-06-17T15:06:12.167Z,Send Connector - Internet,08D038810B434725,1,192.18.101.201:23428,64.191.104.238:25,+,,
2013-06-17T15:06:13.540Z,Send Connector - Internet,08D038810B434725,2,192.18.101.201:23428,64.191.104.238:25,<,220 mail4.canteke.com ESMTP,
2013-06-17T15:06:13.540Z,Send Connector - Internet,08D038810B434725,3,192.18.101.201:23428,64.191.104.238:25,>,EHLO mail.mydomain.com,
2013-06-17T15:06:13.587Z,Send Connector - Internet,08D038810B434725,4,192.18.101.201:23428,64.191.104.238:25,<,250 mail4.canteke.com,
2013-06-17T15:06:13.587Z,Send Connector - Internet,08D038810B434725,5,192.18.101.201:23428,64.191.104.238:25,*,85673,sending message
2013-06-17T15:06:13.587Z,Send Connector - Internet,08D038810B434725,6,192.18.101.201:23428,64.191.104.238:25,>,MAIL FROM:<>,
2013-06-17T15:06:13.634Z,Send Connector - Internet,08D038810B434725,7,192.18.101.201:23428,64.191.104.238:25,<,250 Ok,
2013-06-17T15:06:13.634Z,Send Connector - Internet,08D038810B434725,8,192.18.101.201:23428,64.191.104.238:25,>,RCPT TO:<[email protected]>,
2013-06-17T15:06:13.696Z,Send Connector - Internet,08D038810B434725,9,192.18.101.201:23428,64.191.104.238:25,<,"553 sorry, that domain isn't in my list of allowed rcpthosts (#5.7.1)",
2013-06-17T15:06:13.696Z,Send Connector - Internet,08D038810B434725,10,192.18.101.201:23428,64.191.104.238:25,>,QUIT,
2013-06-17T15:06:13.743Z,Send Connector - Internet,08D038810B434725,11,192.18.101.201:23428,64.191.104.238:25,<,221 Bye,
2013-06-17T15:06:13.743Z,Send Connector - Internet,08D038810B434725,12,192.18.101.201:23428,64.191.104.238:25,-,,Local

I'd like to discover how and why these mail attempts are being generated.

1
  • when you check the message tracking logs for this recipient does it show an internal mailbox or client IP as the source?
    – TheCleaner
    Jun 17, 2013 at 16:24

1 Answer 1

2

This is normal. Many MTAs will use a null sender address for bounces and other types of status messages, so as to avoid mail loops. This practice is referenced in section 4.5.5 of RFC 5321.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .