Emails being delivered multiple times

Use this forum if you have installed hMailServer and want to ask a question related to a production release of hMailServer. Before posting, please read the troubleshooting guide. A large part of all reported issues are already described in detail here.
Post Reply
Vega Discoveries
New user
New user
Posts: 3
Joined: 2019-06-21 22:49

Emails being delivered multiple times

Post by Vega Discoveries » 2019-06-21 23:02

Hello,
I have been using hMail for many years with no real problems.
About a month ago we started getting reports of the same email being delivered multiple times.
Knowing that we were still running on an old server, with outdated TLS, we decided to migrate to a new box.
I built a new Windows 2016 VM and migrated hMail from the 2003 server over to 2016.

With the migration completed we began watching the emails again.
Sadly, we are still receiving the same emails over and over. (Please see the attached file)
Not all messages are being repeated. Once a message starts repeating it takes close to a week for it to stop.

The last step we took to solve the problem was to adjust outlook settings to NOT save a copy of the message on the server.

What additional details should I provide?
Attachments
Repeating emails 20190621.png
Screenshot of repeating emails in outlook.

User avatar
jimimaseye
Moderator
Moderator
Posts: 8171
Joined: 2011-09-08 17:48

Re: Emails being delivered multiple times

Post by jimimaseye » 2019-06-21 23:14

Messages repeated from where? How do you know the messages are not being RECEIVED by hmailserver several times in the first place? All of those emails have different dates and times in them and dates are headers set by the sending server/client . Therefore the issue may be with the sender.

What to do: enable smtp logging and view the logs for a
message that you say is repeating. Does it appear once or more times under SMTPD entries? (I presume your mail don't come in by external download. If it does then the issue may be there. )

Put thunderbird on the server and see if the repeat emails show in that (eliminating the cause being outlook)

[Entered by mobile. Excuse my spelling.]
HMS 5.6.6 B2383 on Win Server 2008 R2 Foundation, + 5.6.7-B2415 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829

Vega Discoveries
New user
New user
Posts: 3
Joined: 2019-06-21 22:49

Re: Emails being delivered multiple times

Post by Vega Discoveries » 2019-06-21 23:45

Here are three headers:
They appear to have different timestamps - indicating that they are being sent to hMail repeatedly.
See below these three for two others that look identical!

X-CheckPoint: {5D0C694B-10003-9B8F7F-C0000000}
X-MAIL-CPID: 00000000000000000000000000000000
X-Control-Analysis:
Return-Path: mar==@===marktech.com
Received: from mx0b-0021cb01.pphosted.com ([148.163.152.203])
by vegadiscoveries.net
; Thu, 20 Jun 2019 22:17:28 -0700
X-CheckPoint: {5D0C6714-A-BE9A8F7F-C0000000}
X-MAIL-CPID: 00000000000000000000000000000000
X-Control-Analysis:
Received: from pps.filterd (m0096140.ppops.net [127.0.0.1])
by mx0b-0021cb01.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x5IDCKp9018670
for <rhanc===@===discoveries.com>; Tue, 18 Jun 2019 06:29:39 -0700
Received: from nam05-co1-obe.outbound.protection.outlook.com (mail-co1nam05lp2056.outbound.protection.outlook.com [104.47.48.56])
by mx0b-0021cb01.pphosted.com with ESMTP id 2t6ugft9r2-1
(version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT)
for <rhanc===@===discoveries.com>; Tue, 18 Jun 2019 06:29:38 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=IngramMicro.onmicrosoft.com; s=selector2-IngramMicro-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=ZsAij17ypeyt8Dh+1CwuqcF2ir3K8aACTOjRt5XFQik=;
b=NkoWfyQy8n/9DH/m9jN/xsG4abat5WqiSeZNzAk/hw6USIgu8yH0zZK2iK4ml+Lvh2Mm9V4OoyJhIjBJeqSqdob84Vxe8uqzHpBQ2+zJSNRGdjA7JxVXD1L96Gq/Dq7kE9sKCxqc4gBtNX4qWB2sq+kMWAty2JB9jV2Unw256Cw=
Received: from BN8PR10MB3282.namprd10.prod.outlook.com (20.179.138.219) by
BN8PR10MB3667.namprd10.prod.outlook.com (20.179.96.157) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.1987.10; Tue, 18 Jun 2019 13:29:36 +0000
Received: from BN8PR10MB3282.namprd10.prod.outlook.com
([fe80::29de:ddec:1892:6350]) by BN8PR10MB3282.namprd10.prod.outlook.com
([fe80::29de:ddec:1892:6350%3]) with mapi id 15.20.1987.014; Tue, 18 Jun 2019
13:29:36 +0000
From: "===ttheu, Mark" <mar==@===marktech.com>
To: R Hanc=== <rhanc===@===discoveries.com>
CC: Promark West Team <westteam@promarktech.com>
Subject: Promark - Vega Discoveries LLC (43-780912) - CHECK 2534306070
MessageContent
Thread-Index: AdUl2d3dOVRn8ok+R2O7MVlwslgUGQ==
Date: Tue, 18 Jun 2019 13:29:36 +0000
Message-ID:
<BN8PR10MB328286739972BD8F2B363CEBAFEA0@BN8PR10MB3282.namprd10.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
x-originating-ip: [96.86.61.174]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 3c0bd1c6-c52d-4380-6aec-08d6f3f101e2
x-microsoft-antispam:
BCL:0;PCL:0;RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(49563074)(7193020);SRVR:BN8PR10MB3667;
x-ms-traffictypediagnostic: BN8PR10MB3667:
x-ms-exchange-purlcount: 7
x-microsoft-antispam-prvs:
<BN8PR10MB366710D953C7E2196AFE1945AFEA0@BN8PR10MB3667.namprd10.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:8273;
x-forefront-prvs: 007271867D
x-forefront-antispam-report:
SFV:NSPM;SFS:(10019020)(366004)(136003)(376002)(39860400002)(346002)(396003)(199004)(189003)(52536014)(316002)(71190400001)(53936002)(71200400001)(86362001)(54556002)(6506007)(9686003)(7736002)(606006)(54896002)(256004)(107886003)(236005)(14444005)(99936001)(6306002)(55016002)(33656002)(733005)(478600001)(6436002)(81156014)(3846002)(81166006)(6116002)(5660300002)(66476007)(66946007)(66576008)(476003)(790700001)(186003)(99286004)(861006)(76116006)(6916009)(25786009)(4326008)(8676002)(74316002)(73956011)(102836004)(14454004)(66446008)(7696005)(68736007)(2906002)(486006)(26005)(66066001)(966005)(66556008)(64756008)(8936002)(512474002);DIR:OUT;SFP:1102;SCL:1;SRVR:BN8PR10MB3667;H:BN8PR10MB3282.namprd10.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;A:1;MX:1;
received-spf: None (protection.outlook.com: promarktech.com does not designate
permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info:
Z76gujoRqc+/sercpT5s23JIAtsn6zlx/S55YJsSvIuk9DFbLBmHTgEcvcPJSsAt+McgU1X/yYZ16bzfsnwdi/xyM0rGMCYDmkN5ME6F9NhwHz/gpGJqzYa93y47l0SYev+vdVqGIGv+bkRE1+Z8ndpEblWyvN8FcDa9/HFWMWPawqmXFCdrMLOHvX3U/VI77xR9Ly84neuqpbWBybjA506GE3u9EDjZlMGYAVj2kUcoQUmms0EfPOZAxNzPYA/2OOQkeCHAdag88EZRJSNyjV/2cUnw9snkOHxG7noN+l/Xlw6j7pNTel9va0UahlWC9U7jg3D8ly3Cx4M4EEHoye3dF2uxBO3S0tPH2B7bdk2aOJZflJb9AyoSCorwd/lOGf/38QA/GWvVtET6du0iheuHzSfoiL3AbjNsS6uDaiY=
Content-Type: multipart/related;
boundary="_012_BN8PR10MB328286739972BD8F2B363CEBAFEA0BN8PR10MB3282namp_";
type="multipart/alternative"
MIME-Version: 1.0
X-OriginatorOrg: promarktech.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 3c0bd1c6-c52d-4380-6aec-08d6f3f101e2
X-MS-Exchange-CrossTenant-originalarrivaltime: 18 Jun 2019 13:29:36.2268
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: d78aee32-8f91-4f9e-90ea-fb72965d9d7c
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: mar==@===marktech.com
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN8PR10MB3667
X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0
priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0
spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0
mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx
scancount=1 engine=8.0.1-1810050000 definitions=main-1906180109

===========================================================================================

X-CheckPoint: {5D0C5413-10007-9B8F7F-C0000000}
X-CheckPoint: {5D0C5B2F-10003-9B8F7F-C0000000}
X-MAIL-CPID: 00000000000000000000000000000000
X-Control-Analysis:
Return-Path: mar==@===marktech.com
Received: from mx0b-0021cb01.pphosted.com ([148.163.148.203])
by vegadiscoveries.net
; Thu, 20 Jun 2019 21:16:02 -0700
X-CheckPoint: {5D0C58B9-5-BE9A8F7F-C0000000}
X-MAIL-CPID: 00000000000000000000000000000000
X-Control-Analysis:
Received: from pps.filterd (m0096144.ppops.net [127.0.0.1])
by mx0a-0021cb01.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x5KIkdMB026556
for <rhanc===@===discoveries.com>; Thu, 20 Jun 2019 11:52:55 -0700
Received: from nam02-cy1-obe.outbound.protection.outlook.com (mail-cys01nam02lp2050.outbound.protection.outlook.com [104.47.37.50])
by mx0a-0021cb01.pphosted.com with ESMTP id 2t8a4magr0-1
(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT)
for <rhanc===@===discoveries.com>; Thu, 20 Jun 2019 11:52:54 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=IngramMicro.onmicrosoft.com; s=selector2-IngramMicro-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=ESi0AKwrfPbxnAVlj0Jx21WacUrgJDTfm1iqETiiCLg=;
b=mbiE0fgZHYtHmUfxPKsPK7zzyUcZAbjiHnn8WsIio6hyaMWcapUyXInlCdRfspE6zU6JizpC56BENqGEW2rI+b4Xh29HQnYUPeOiBq8HeFypijXBxeHBlPW+tafTPc2B/m25ZN14tvXtgAyTYI9yYDEIsXs1Z0/b7wMkbsvayVA=
Received: from BN8PR10MB3282.namprd10.prod.outlook.com (20.179.138.219) by
BN8PR10MB3556.namprd10.prod.outlook.com (20.179.78.225) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.1987.13; Thu, 20 Jun 2019 18:52:52 +0000
Received: from BN8PR10MB3282.namprd10.prod.outlook.com
([fe80::29de:ddec:1892:6350]) by BN8PR10MB3282.namprd10.prod.outlook.com
([fe80::29de:ddec:1892:6350%3]) with mapi id 15.20.1987.014; Thu, 20 Jun 2019
18:52:52 +0000
From: "===ttheu, Mark" <mar==@===marktech.com>
To: R Hanc=== <rhanc===@===discoveries.com>
Subject: RE: Promark - Vega Discoveries LLC (43-780912) - CHECK 2534306070
MessageContent
Thread-Index: AdUl2d3dOVRn8ok+R2O7MVlwslgUGQA4hQ8AADdM7JA=
Date: Thu, 20 Jun 2019 18:52:52 +0000
Message-ID:
<BN8PR10MB32822C4AAB618746F106047CAFE40@BN8PR10MB3282.namprd10.prod.outlook.com>
References:
<BN8PR10MB328286739972BD8F2B363CEBAFEA0@BN8PR10MB3282.namprd10.prod.outlook.com>
<010d01d526bb$f2e79220$d8b6b660$@vegadiscoveries.com>
In-Reply-To: <010d01d526bb$f2e79220$d8b6b660$@vegadiscoveries.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
x-originating-ip: [96.86.61.174]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: dc283884-d387-40b0-3306-08d6f5b07fd0
x-microsoft-antispam:
BCL:0;PCL:0;RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(49563074)(7193020);SRVR:BN8PR10MB3556;
x-ms-traffictypediagnostic: BN8PR10MB3556:
x-ms-exchange-purlcount: 10
x-microsoft-antispam-prvs:
<BN8PR10MB35564F91A41D00545D54581FAFE40@BN8PR10MB3556.namprd10.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:9508;
x-forefront-prvs: 0074BBE012
x-forefront-antispam-report:
SFV:NSPM;SFS:(10019020)(346002)(366004)(376002)(39860400002)(136003)(396003)(199004)(189003)(966005)(256004)(6246003)(25786009)(66066001)(14444005)(6916009)(66556008)(64756008)(66446008)(76116006)(446003)(66476007)(73956011)(11346002)(316002)(186003)(99936001)(66576008)(66946007)(71200400001)(71190400001)(486006)(476003)(733005)(6436002)(81156014)(54896002)(99286004)(7736002)(52536014)(478600001)(33656002)(81166006)(55016002)(8676002)(74316002)(86362001)(53936002)(26005)(102836004)(7696005)(8936002)(236005)(9686003)(53546011)(54556002)(6506007)(6306002)(76176011)(68736007)(3846002)(6116002)(790700001)(606006)(5660300002)(14454004)(2906002)(229853002)(512474002);DIR:OUT;SFP:1102;SCL:1;SRVR:BN8PR10MB3556;H:BN8PR10MB3282.namprd10.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;A:1;MX:1;
received-spf: None (protection.outlook.com: promarktech.com does not designate
permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info:
IhQGFR1pOPM+MJTpY1DrCJboW4zyyiRmaOUGxBWwgbo+FtMCZ/fEjLVJUhGmppqgNqLmSb5n3QKRtV1TDQoHUeAZA+3jF7GL87PHO2tcna3DeoRaDJtp3cxYz5mBLj/9/50BJG9uzA4mkpYbO1Vs9xUwiho22Njg7Y1brqRCv2p4kBKFHMWv1zpMsCzrq81nMuCO9xMceDlr2IfNPeocIy5+RK5rjQ/I34RLFI05gNQ0TMb4TYhNGnTGSEPTwD66tdcSTI82fbtHSvH4Lfj8XZe/yDlOZkFnV31othQF12OsH/1jXvjxk/j0DEMhbttZHwHcBJUvLePTiObCpMO9+ZLhdBWN/qTkfgCgEuVA6UatjYwEVX+tEWJ73j7LOUXX7KxrxXKUUfQR+R8g69EgPYZ+4bi1yTCTc3TEcbFMwgw=
Content-Type: multipart/related;
boundary="_021_BN8PR10MB32822C4AAB618746F106047CAFE40BN8PR10MB3282namp_";
type="multipart/alternative"
MIME-Version: 1.0
X-OriginatorOrg: promarktech.com
X-MS-Exchange-CrossTenant-Network-Message-Id: dc283884-d387-40b0-3306-08d6f5b07fd0
X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jun 2019 18:52:52.4845
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: d78aee32-8f91-4f9e-90ea-fb72965d9d7c
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: mar==@===marktech.com
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN8PR10MB3556
X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0
priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0
spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0
mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx
scancount=1 engine=8.0.1-1810050000 definitions=main-1906200135

=====================================================================================

X-CheckPoint: {5D0C5413-10007-9B8F7F-C0000000}
X-MAIL-CPID: 00000000000000000000000000000000
X-Control-Analysis:
Return-Path: mar==@===marktech.com
Received: from mx0b-0021cb01.pphosted.com ([148.163.152.203])
by vegadiscoveries.net
; Thu, 20 Jun 2019 20:44:41 -0700
X-CheckPoint: {5D0C5153-14-BE9A8F7F-C0000000}
X-MAIL-CPID: 00000000000000000000000000000000
X-Control-Analysis:
Received: from pps.filterd (m0096140.ppops.net [127.0.0.1])
by mx0b-0021cb01.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x5IDCKp9018670
for <rhanc===@===discoveries.com>; Tue, 18 Jun 2019 06:29:39 -0700
Received: from nam05-co1-obe.outbound.protection.outlook.com (mail-co1nam05lp2056.outbound.protection.outlook.com [104.47.48.56])
by mx0b-0021cb01.pphosted.com with ESMTP id 2t6ugft9r2-1
(version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT)
for <rhanc===@===discoveries.com>; Tue, 18 Jun 2019 06:29:38 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=IngramMicro.onmicrosoft.com; s=selector2-IngramMicro-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=ZsAij17ypeyt8Dh+1CwuqcF2ir3K8aACTOjRt5XFQik=;
b=NkoWfyQy8n/9DH/m9jN/xsG4abat5WqiSeZNzAk/hw6USIgu8yH0zZK2iK4ml+Lvh2Mm9V4OoyJhIjBJeqSqdob84Vxe8uqzHpBQ2+zJSNRGdjA7JxVXD1L96Gq/Dq7kE9sKCxqc4gBtNX4qWB2sq+kMWAty2JB9jV2Unw256Cw=
Received: from BN8PR10MB3282.namprd10.prod.outlook.com (20.179.138.219) by
BN8PR10MB3667.namprd10.prod.outlook.com (20.179.96.157) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.1987.10; Tue, 18 Jun 2019 13:29:36 +0000
Received: from BN8PR10MB3282.namprd10.prod.outlook.com
([fe80::29de:ddec:1892:6350]) by BN8PR10MB3282.namprd10.prod.outlook.com
([fe80::29de:ddec:1892:6350%3]) with mapi id 15.20.1987.014; Tue, 18 Jun 2019
13:29:36 +0000
From: "===ttheu, Mark" <mar==@===marktech.com>
To: R Hanc=== <rhanc===@===discoveries.com>
CC: Promark West Team <westteam@promarktech.com>
Subject: Promark - Vega Discoveries LLC (43-780912) - CHECK 2534306070
MessageContent
Thread-Index: AdUl2d3dOVRn8ok+R2O7MVlwslgUGQ==
Date: Tue, 18 Jun 2019 13:29:36 +0000
Message-ID:
<BN8PR10MB328286739972BD8F2B363CEBAFEA0@BN8PR10MB3282.namprd10.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
x-originating-ip: [96.86.61.174]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 3c0bd1c6-c52d-4380-6aec-08d6f3f101e2
x-microsoft-antispam:
BCL:0;PCL:0;RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(49563074)(7193020);SRVR:BN8PR10MB3667;
x-ms-traffictypediagnostic: BN8PR10MB3667:
x-ms-exchange-purlcount: 7
x-microsoft-antispam-prvs:
<BN8PR10MB366710D953C7E2196AFE1945AFEA0@BN8PR10MB3667.namprd10.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:8273;
x-forefront-prvs: 007271867D
x-forefront-antispam-report:
SFV:NSPM;SFS:(10019020)(366004)(136003)(376002)(39860400002)(346002)(396003)(199004)(189003)(52536014)(316002)(71190400001)(53936002)(71200400001)(86362001)(54556002)(6506007)(9686003)(7736002)(606006)(54896002)(256004)(107886003)(236005)(14444005)(99936001)(6306002)(55016002)(33656002)(733005)(478600001)(6436002)(81156014)(3846002)(81166006)(6116002)(5660300002)(66476007)(66946007)(66576008)(476003)(790700001)(186003)(99286004)(861006)(76116006)(6916009)(25786009)(4326008)(8676002)(74316002)(73956011)(102836004)(14454004)(66446008)(7696005)(68736007)(2906002)(486006)(26005)(66066001)(966005)(66556008)(64756008)(8936002)(512474002);DIR:OUT;SFP:1102;SCL:1;SRVR:BN8PR10MB3667;H:BN8PR10MB3282.namprd10.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;A:1;MX:1;
received-spf: None (protection.outlook.com: promarktech.com does not designate
permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info:
Z76gujoRqc+/sercpT5s23JIAtsn6zlx/S55YJsSvIuk9DFbLBmHTgEcvcPJSsAt+McgU1X/yYZ16bzfsnwdi/xyM0rGMCYDmkN5ME6F9NhwHz/gpGJqzYa93y47l0SYev+vdVqGIGv+bkRE1+Z8ndpEblWyvN8FcDa9/HFWMWPawqmXFCdrMLOHvX3U/VI77xR9Ly84neuqpbWBybjA506GE3u9EDjZlMGYAVj2kUcoQUmms0EfPOZAxNzPYA/2OOQkeCHAdag88EZRJSNyjV/2cUnw9snkOHxG7noN+l/Xlw6j7pNTel9va0UahlWC9U7jg3D8ly3Cx4M4EEHoye3dF2uxBO3S0tPH2B7bdk2aOJZflJb9AyoSCorwd/lOGf/38QA/GWvVtET6du0iheuHzSfoiL3AbjNsS6uDaiY=
Content-Type: multipart/related;
boundary="_012_BN8PR10MB328286739972BD8F2B363CEBAFEA0BN8PR10MB3282namp_";
type="multipart/alternative"
MIME-Version: 1.0
X-OriginatorOrg: promarktech.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 3c0bd1c6-c52d-4380-6aec-08d6f3f101e2
X-MS-Exchange-CrossTenant-originalarrivaltime: 18 Jun 2019 13:29:36.2268
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: d78aee32-8f91-4f9e-90ea-fb72965d9d7c
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: mar==@===marktech.com
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN8PR10MB3667
X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0
priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0
spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0
mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx
scancount=1 engine=8.0.1-1810050000 definitions=main-1906180109


===========================================================
===========================================================

However; Here are two others which appear to be identical.

X-CheckPoint: {5D0C5413-10007-9B8F7F-C0000000}
X-MAIL-CPID: 00000000000000000000000000000000
X-Control-Analysis:
Return-Path: Jarre====les@D====om
Received: from mx0b-00154904.pphosted.com ([148.163.137.20])
by vegadiscoveries.net
; Thu, 20 Jun 2019 20:44:21 -0700
X-CheckPoint: {5D0C529D-C-BE9A8F7F-C0000000}
X-MAIL-CPID: 00000000000000000000000000000000
X-Control-Analysis:
Received: from pps.filterd (m0170398.ppops.net [127.0.0.1])
by mx0b-00154904.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x5JGoVAn015461
for <RHAN===@veg=====veries.com>; Wed, 19 Jun 2019 12:50:57 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dell.com; h=from : to : cc :
subject : date : message-id : references : in-reply-to : content-type :
mime-version; s=smtpout1; bh=pXZtEVqF3whJNMESOBil9SjBrmX5Lt83aLUU9TjGRmc=;
b=elph6VtTbQGfVnZweGfzn0y982aL+QVNZK61vAMqHprFCILJpeUWl8XgqzUYliMHoLPp
/KpjcbPdEwULkbAWztO22fDnU+AMp7HDMe+UgbpsXbGM0oKeERmqhyvTucaMEI9hfb41
QPEpSniMJvE+Y0qvRvsjuRtp/U6w6MU/YPtPUG/QEJoM6QiU6tsE8IX3PeQFZekhi22p
nbyMCp74XcHcLP0Do36X9+EsD4BinxpwuPY7E43wg1I41jO/LcWemqxd1QqOukpgdKc7
GAp4zAEw+lL4Z1gzponf3cuR6hqGa1UAOGADdYknrN6HQRWJGAxkZ6vkEhButYj0d1XG Pw==
Received: from mx0a-00154901.pphosted.com (mx0b-00154901.pphosted.com [67.231.157.37])
by mx0b-00154904.pphosted.com with ESMTP id 2t780kd3k8-1
(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT)
for <RHAN===@veg=====veries.com>; Wed, 19 Jun 2019 12:50:56 -0400
Received: from pps.filterd (m0089484.ppops.net [127.0.0.1])
by mx0b-00154901.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x5JGm7Ho067942
for <RHAN===@veg=====veries.com>; Wed, 19 Jun 2019 12:50:56 -0400
Received: from ausxippc101.us.dell.com (ausxippc101.us.dell.com [143.166.85.207])
by mx0b-00154901.pphosted.com with ESMTP id 2t7pweta5x-1
(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK)
for <RHAN===@veg=====veries.com>; Wed, 19 Jun 2019 12:50:55 -0400
X-LoopCount0: from 10.166.134.83
X-PREM-Routing: D-Outbound
X-IronPort-AV: E=Sophos;i="5.60,346,1549951200";
d="pdf'?png'150?scan'150,208,217,150";a="1257456657"
From: <Jarre====les@D====om>
To: <Ale===lfe@d====om>, <RHAN===@veg=====veries.com>
CC: <Est===homas@D====om>
Subject: RE: R Han=== has shared some Dell products with you!
Thread-Topic: R Han=== has shared some Dell products with you!
Thread-Index: AQHVJrsvIP1QFo8PoEax+xsXLP2GRaajLrrQgAAB74A=
Date: Wed, 19 Jun 2019 16:50:51 +0000
Message-ID: <7bf703022e0648f29047bf1478cf01f6@ausx13mps311.AMER.DELL.COM>
References: <2cb503$15f64o5@ausxippc101.us.dell.com>
<68295ba4874b43d0b0eb18bd76f9676f@AUSX13MPC132.AMER.DELL.COM>
In-Reply-To: <68295ba4874b43d0b0eb18bd76f9676f@AUSX13MPC132.AMER.DELL.COM>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
msip_labels: MSIP_Label_a17f17c0-b23c-493d-99ab-b037779ecd33_Enabled=True;
MSIP_Label_a17f17c0-b23c-493d-99ab-b037779ecd33_SiteId=945c199a-83a2-4e80-9f8c-5a91be5752dd;
MSIP_Label_a17f17c0-b23c-493d-99ab-b037779ecd33_Owner=Jarred_Bales@Dell.com;
MSIP_Label_a17f17c0-b23c-493d-99ab-b037779ecd33_SetDate=2019-06-19T16:50:49.3964261Z;
MSIP_Label_a17f17c0-b23c-493d-99ab-b037779ecd33_Name=Customer Communication;
MSIP_Label_a17f17c0-b23c-493d-99ab-b037779ecd33_Application=Microsoft Azure
Information Protection;
MSIP_Label_a17f17c0-b23c-493d-99ab-b037779ecd33_Extended_MSFT_Method=Manual;
aiplabel=Customer Communication
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [10.143.242.75]
Content-Type: multipart/mixed;
boundary="_009_7bf703022e0648f29047bf1478cf01f6ausx13mps311AMERDELLCOM_"
MIME-Version: 1.0
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:,, definitions=2019-06-19_11:,,
signatures=0
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501
malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0
clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0
mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx
scancount=1 engine=8.0.1-1810050000 definitions=main-1906190136
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0
suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011
lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0
classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000
definitions=main-1906190136

=============================================================

X-CheckPoint: {5D0C37CF-10016-9B8F7F-C0000000}
X-MAIL-CPID: 00000000000000000000000000000000
X-Control-Analysis:
Return-Path: Jarre====les@D====om
Received: from mx0b-00154904.pphosted.com ([148.163.137.20])
by vegadiscoveries.net
; Thu, 20 Jun 2019 18:43:31 -0700
X-CheckPoint: {5D0C364B-3-BE9A8F7F-C0000000}
X-MAIL-CPID: 00000000000000000000000000000000
X-Control-Analysis:
Received: from pps.filterd (m0170398.ppops.net [127.0.0.1])
by mx0b-00154904.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x5JGoVAn015461
for <RHAN===@veg=====veries.com>; Wed, 19 Jun 2019 12:50:57 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dell.com; h=from : to : cc :
subject : date : message-id : references : in-reply-to : content-type :
mime-version; s=smtpout1; bh=pXZtEVqF3whJNMESOBil9SjBrmX5Lt83aLUU9TjGRmc=;
b=elph6VtTbQGfVnZweGfzn0y982aL+QVNZK61vAMqHprFCILJpeUWl8XgqzUYliMHoLPp
/KpjcbPdEwULkbAWztO22fDnU+AMp7HDMe+UgbpsXbGM0oKeERmqhyvTucaMEI9hfb41
QPEpSniMJvE+Y0qvRvsjuRtp/U6w6MU/YPtPUG/QEJoM6QiU6tsE8IX3PeQFZekhi22p
nbyMCp74XcHcLP0Do36X9+EsD4BinxpwuPY7E43wg1I41jO/LcWemqxd1QqOukpgdKc7
GAp4zAEw+lL4Z1gzponf3cuR6hqGa1UAOGADdYknrN6HQRWJGAxkZ6vkEhButYj0d1XG Pw==
Received: from mx0a-00154901.pphosted.com (mx0b-00154901.pphosted.com [67.231.157.37])
by mx0b-00154904.pphosted.com with ESMTP id 2t780kd3k8-1
(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT)
for <RHAN===@veg=====veries.com>; Wed, 19 Jun 2019 12:50:56 -0400
Received: from pps.filterd (m0089484.ppops.net [127.0.0.1])
by mx0b-00154901.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x5JGm7Ho067942
for <RHAN===@veg=====veries.com>; Wed, 19 Jun 2019 12:50:56 -0400
Received: from ausxippc101.us.dell.com (ausxippc101.us.dell.com [143.166.85.207])
by mx0b-00154901.pphosted.com with ESMTP id 2t7pweta5x-1
(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK)
for <RHAN===@veg=====veries.com>; Wed, 19 Jun 2019 12:50:55 -0400
X-LoopCount0: from 10.166.134.83
X-PREM-Routing: D-Outbound
X-IronPort-AV: E=Sophos;i="5.60,346,1549951200";
d="pdf'?png'150?scan'150,208,217,150";a="1257456657"
From: <Jarre====les@D====om>
To: <Ale===lfe@d====om>, <RHAN===@veg=====veries.com>
CC: <Est===homas@D====om>
Subject: RE: R Han=== has shared some Dell products with you!
Thread-Topic: R Han=== has shared some Dell products with you!
Thread-Index: AQHVJrsvIP1QFo8PoEax+xsXLP2GRaajLrrQgAAB74A=
Date: Wed, 19 Jun 2019 16:50:51 +0000
Message-ID: <7bf703022e0648f29047bf1478cf01f6@ausx13mps311.AMER.DELL.COM>
References: <2cb503$15f64o5@ausxippc101.us.dell.com>
<68295ba4874b43d0b0eb18bd76f9676f@AUSX13MPC132.AMER.DELL.COM>
In-Reply-To: <68295ba4874b43d0b0eb18bd76f9676f@AUSX13MPC132.AMER.DELL.COM>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
msip_labels: MSIP_Label_a17f17c0-b23c-493d-99ab-b037779ecd33_Enabled=True;
MSIP_Label_a17f17c0-b23c-493d-99ab-b037779ecd33_SiteId=945c199a-83a2-4e80-9f8c-5a91be5752dd;
MSIP_Label_a17f17c0-b23c-493d-99ab-b037779ecd33_Owner=Jarred_Bales@Dell.com;
MSIP_Label_a17f17c0-b23c-493d-99ab-b037779ecd33_SetDate=2019-06-19T16:50:49.3964261Z;
MSIP_Label_a17f17c0-b23c-493d-99ab-b037779ecd33_Name=Customer Communication;
MSIP_Label_a17f17c0-b23c-493d-99ab-b037779ecd33_Application=Microsoft Azure
Information Protection;
MSIP_Label_a17f17c0-b23c-493d-99ab-b037779ecd33_Extended_MSFT_Method=Manual;
aiplabel=Customer Communication
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [10.143.242.75]
Content-Type: multipart/mixed;
boundary="_009_7bf703022e0648f29047bf1478cf01f6ausx13mps311AMERDELLCOM_"
MIME-Version: 1.0
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:,, definitions=2019-06-19_11:,,
signatures=0
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501
malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0
clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0
mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx
scancount=1 engine=8.0.1-1810050000 definitions=main-1906190136
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0
suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011
lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0
classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000
definitions=main-1906190136

Vega Discoveries
New user
New user
Posts: 3
Joined: 2019-06-21 22:49

Re: Emails being delivered multiple times

Post by Vega Discoveries » 2019-06-21 23:53

jimimaseye wrote:
2019-06-21 23:14
Messages repeated from where? How do you know the messages are not being RECEIVED by hmailserver several times in the first place? All of those emails have different dates and times in them and dates are headers set by the sending server/client . Therefore the issue may be with the sender.

What to do: enable smtp logging and view the logs for a
message that you say is repeating. Does it appear once or more times under SMTPD entries? (I presume your mail don't come in by external download. If it does then the issue may be there. )

Put thunderbird on the server and see if the repeat emails show in that (eliminating the cause being outlook)

[Entered by mobile. Excuse my spelling.]
The first sample is from promark.com - it looks like they may be being received multiple times based timestamps in the header. - Issue may be with the sender???
The second sample is from dell.com - the timestamps look identical in the headers. - Issue does not appear to be from the sender!!
In another example it is an email sent from my bookkeeper to me. Both address domains are identical, VegaDiscoveries.com. The domain email is hosted on our hMail server. No outside email server is involved, yet I still get duplicates.

User avatar
jimimaseye
Moderator
Moderator
Posts: 8171
Joined: 2011-09-08 17:48

Re: Emails being delivered multiple times

Post by jimimaseye » 2019-06-22 00:34

The second sample is from dell.com - the timestamps look identical in the headers. - Issue does not appear to be from the sender!!
That image shows Dell 6.11 and 6.44 (not identical) .

In another example it is an email sent from my bookkeeper to me. Both address domains are identical, VegaDiscoveries.com. The domain email is hosted on our hMail server. No outside email server is involved, yet I still get duplicates.
And yet the image shows them with different date and times. Not identical. Presumably you have rules or scripts on the go? run this and post the results - include rules when prompted: https://www.hmailserver.com/forum/viewt ... 20&t=30914

[Entered by mobile. Excuse my spelling.]
HMS 5.6.6 B2383 on Win Server 2008 R2 Foundation, + 5.6.7-B2415 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829

User avatar
mattg
Moderator
Moderator
Posts: 20291
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: Emails being delivered multiple times

Post by mattg » 2019-06-22 01:43

I have this with ONE sender.
Their server incorrectly assumes that a 30 second delay in delivering mail means that the connection has dropped and they send it again.

My server responding with 'Quit' at the end is just lost to the ether.
This is entirely due to a poorly set up server at the other end (in my case).
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

Post Reply