Forwarding Envelope & Message Headers – Exchange 2003 & Exchange 2007
Posted by shauncroucher on September 5, 2009
Exchange 2007 uses a different Envelope FROM address (and Return-path) address when forwarding is enabled to an external email address.
Take the following situation. sender@example.net is an external sender, who has sent an email to receiver@example.org. receiver@example.org has a forward set up (using an AD contact) to receiver@example.com.
So to clarify, these are the addresses we are looking at:
So, for both Exchange 2003 and Exchange 2007, we are interested in the ‘forwarding’ part of this sequence of events (ie: the automated process when sending from original recipient to forwarding address).
The Envelope Header is what is used for routing the message. It is the MAIL FROM: and RCPT TO: of the SMTP conversation as set out in RFC 5321. When the forward process takes place, these will be the values used for each version of Exchange:
The key difference is that Exchange 2003 will use the ORIGINAL sender SMTP address, and not the domain for which it is authoritative. This has been changed in Exchange 2007, so that the MAIL FROM: header is set to the Original recipient, and the domain for which the email server IS authoritative.
Next is the message header information in the conversation:
The To and From of the message is what the MUA (Mail User Agent) or ‘email client’ will be presented with. They will not see a change really. They will know it is a forwarded email because it will appear to be addressed to the original receiver, and not the forwarding address. Note however, that the Return path address will be different for each version of Exchange.
This information is worth noting when it comes to mail flow issues, or if you are attempting to whitelist for your forwarded mail.
Shaun


David Sierra said
Hello Shaun,
First of all I have to congratulate you for your blog.
I’m trying to create a transport rule to overcome the empty from field problem in Exchange 2007 Out-Of-Oficce messages. My intention is to fill that field with a generic address of my organization in order that the messages can get through my ironports. I’m trying with “set header with value” (set FROM with admin@contoso.com) but an error says that I cannot set “from” header. Anyway I think this field is not empty, but it is the “from” of the envelope which is empty. I tried the Return-Path field but it is not the field that test our ironports.
Is there any way to fill the from field of the envelope in a trasnport rule? Can you give me a solution?
Thank you very much for your help!
shauncroucher said
Hi David,
Unfortunately I do not believe it is possible to manipulate this entry on the fly using transport rules. Microsoft would argue (and correctly) that their systems are currently following RFC guidelines by using a blank sender, but obviously there is the world and then there is the real world, and this has caused a few problems for IT professionals.
I will continue looking for a way to achieve this and if I find any method I will post a further reply.
Sorry I couldn’t be of any more help on this one,
Shaun
David Sierra said
Thank you very much for your reply, Shaun.
We have Microsoft premium support so I think the best we can do is to open a case directly with them. I hope they can give us a solution. Again I want to thank you for your efforts. If they solve this I will tell you here.
Best Wishes!!!
David.
shauncroucher said
No problem at all,
I’d be very keen if Microsoft are able to provide some further information on this subject,
Please do keep me posted,
Thanks for visiting the blog
Shaun
Diego said
There are any document from Microsoft that explains this?
shauncroucher said
Hi Diego,
Unfortunately I have been unable to locate specific information regarding the change of behavior on the Microsoft technet or blog site. The information is from the behaviour I have witnessed during tests / client deployments.
Shaun
David Sierra said
Hello Diego,
the only similar thing I found is this document, but perhaps it is not what you are looking for. Read the section called “Delivery Report Redirection for Distribution Groups”
http://technet.microsoft.com/en-us/library/bb430743.aspx
Also you have the RFC that Microsoft has followed to implement the empty from in OOF messages
http://rfc.sunsite.dk/rfc/rfc2298.html
Sorry, I think there is no much more over there….
Stefan said
Any feedback from MS premium support yet?
We have a similar problem with that…
cheers,
stefan
David Sierra said
Sorry, I think we will not have a response from Microsoft until the end of November.
I will keep in contact.
Ian Eiloart said
Useful documentation, but why have you exposed three innocent bystanders to email address harvesters? And why have you used live links to those addresses (or are they all your addresses?).
Please note RFC2606 reserves some special domains for documentation purposes. http://www.apps.ietf.org/rfc/rfc2606.html
shauncroucher said
Thank you Ian for your feedback.
You are objecting to my use of potentially real domain names in my examples.
Quite right you are too, I should have used the example.xxx domains all along.
All changed.
Thanks for visiting my blog,
Shaun