Hello,

Can you post the full snippet for 24342130, it appears you included only the delivery portion of this delivery.

There is NOTHING in Delivery for 24342130. That number only exists in SMTP. I checked EVERY search type.

Here's another one that just came through. And nope, not in delivery again. I did find a DELIVERY though with the same email address of POCUpdateForm@verizonwireless.com. You can see in the log that it DOES go to the right person IN THE LOG but in the "real world" it goes to a user in the WRONG DOMAIN.

SMTP

[2019.12.10] 14:05:46.978 [63.27.6.3][31950131] rsp: 220 ec2-3-14-181-208.us-east-2.compute.amazonaws.com [2019.12.10] 14:05:46.978 [63.27.6.3][31950131] connected at 12/10/2019 2:05:46 PM [2019.12.10] 14:05:46.978 [63.27.6.3][31950131] Country code: US [2019.12.10] 14:05:47.025 [63.27.6.3][31950131] cmd: EHLO smtpout3-tpa.verizon.com [2019.12.10] 14:05:47.025 [63.27.6.3][31950131] rsp: 250-ec2-3-14-181-208.us-east-2.compute.amazonaws.com Hello [63.27.6.3]250-SIZE250-AUTH LOGIN CRAM-MD5 NTLM250-STARTTLS250-8BITMIME250-DSN250 OK [2019.12.10] 14:05:47.072 [63.27.6.3][31950131] cmd: STARTTLS [2019.12.10] 14:05:47.072 [63.27.6.3][31950131] rsp: 220 Start TLS negotiation [2019.12.10] 14:05:47.197 [63.27.6.3][31950131] cmd: EHLO smtpout3-tpa.verizon.com [2019.12.10] 14:05:47.197 [63.27.6.3][31950131] rsp: 250-ec2-3-14-181-208.us-east-2.compute.amazonaws.com Hello [63.27.6.3]250-SIZE250-AUTH LOGIN CRAM-MD5 NTLM250-8BITMIME250-DSN250 OK [2019.12.10] 14:05:47.244 [63.27.6.3][31950131] cmd: MAIL FROM: SIZE=7270 [2019.12.10] 14:05:47.244 [63.27.6.3][31950131] senderEmail(1): POCUpdateForm@verizonwireless.com parsed using: [2019.12.10] 14:05:53.221 [63.27.6.3][31950131] rsp: 250 OK  Sender ok [2019.12.10] 14:05:53.221 [63.27.6.3][31950131] Sender accepted. Weight: 0. Block threshold: 50. [2019.12.10] 14:05:53.268 [63.27.6.3][31950131] cmd: RCPT TO: [2019.12.10] 14:05:53.284 [63.27.6.3][31950131] rsp: 250 OK  Recipient ok [2019.12.10] 14:05:53.331 [63.27.6.3][31950131] cmd: DATA [2019.12.10] 14:05:53.331 [63.27.6.3][31950131] rsp: 451 Greylisted, please try again in 180 seconds [2019.12.10] 14:05:53.331 [63.27.6.3][31950131] disconnected at 12/10/2019 2:05:53 PM [2019.12.10] 14:06:54.522 [63.27.6.3][44156175] rsp: 220 ec2-3-14-181-208.us-east-2.compute.amazonaws.com [2019.12.10] 14:06:54.522 [63.27.6.3][44156175] connected at 12/10/2019 2:06:54 PM [2019.12.10] 14:06:54.522 [63.27.6.3][44156175] Country code: US [2019.12.10] 14:06:54.569 [63.27.6.3][44156175] cmd: EHLO smtpout3-tpa.verizon.com [2019.12.10] 14:06:54.569 [63.27.6.3][44156175] rsp: 250-ec2-3-14-181-208.us-east-2.compute.amazonaws.com Hello [63.27.6.3]250-SIZE250-AUTH LOGIN CRAM-MD5 NTLM250-STARTTLS250-8BITMIME250-DSN250 OK [2019.12.10] 14:06:54.616 [63.27.6.3][44156175] cmd: STARTTLS [2019.12.10] 14:06:54.616 [63.27.6.3][44156175] rsp: 220 Start TLS negotiation [2019.12.10] 14:06:54.758 [63.27.6.3][44156175] cmd: EHLO smtpout3-tpa.verizon.com [2019.12.10] 14:06:54.758 [63.27.6.3][44156175] rsp: 250-ec2-3-14-181-208.us-east-2.compute.amazonaws.com Hello [63.27.6.3]250-SIZE250-AUTH LOGIN CRAM-MD5 NTLM250-8BITMIME250-DSN250 OK [2019.12.10] 14:06:54.805 [63.27.6.3][44156175] cmd: MAIL FROM: SIZE=7270 [2019.12.10] 14:06:54.805 [63.27.6.3][44156175] senderEmail(1): POCUpdateForm@verizonwireless.com parsed using: [2019.12.10] 14:06:54.805 [63.27.6.3][44156175] rsp: 250 OK  Sender ok [2019.12.10] 14:06:54.805 [63.27.6.3][44156175] Sender accepted. Weight: 0. Block threshold: 50. [2019.12.10] 14:06:54.836 [63.27.6.3][44156175] cmd: RCPT TO: [2019.12.10] 14:06:54.836 [63.27.6.3][44156175] rsp: 250 OK  Recipient ok [2019.12.10] 14:06:54.883 [63.27.6.3][44156175] cmd: DATA [2019.12.10] 14:06:54.883 [63.27.6.3][44156175] rsp: 451 Greylisted, please try again in 118 seconds [2019.12.10] 14:06:54.883 [63.27.6.3][44156175] disconnected at 12/10/2019 2:06:54 PM [2019.12.10] 14:08:56.731 [63.27.6.3][7440567] rsp: 220 ec2-3-14-181-208.us-east-2.compute.amazonaws.com [2019.12.10] 14:08:56.731 [63.27.6.3][7440567] connected at 12/10/2019 2:08:56 PM [2019.12.10] 14:08:56.731 [63.27.6.3][7440567] Country code: US [2019.12.10] 14:08:56.825 [63.27.6.3][7440567] cmd: EHLO smtpout3-tpa.verizon.com [2019.12.10] 14:08:56.825 [63.27.6.3][7440567] rsp: 250-ec2-3-14-181-208.us-east-2.compute.amazonaws.com Hello [63.27.6.3]250-SIZE250-AUTH LOGIN CRAM-MD5 NTLM250-STARTTLS250-8BITMIME250-DSN250 OK [2019.12.10] 14:08:56.872 [63.27.6.3][7440567] cmd: STARTTLS [2019.12.10] 14:08:56.872 [63.27.6.3][7440567] rsp: 220 Start TLS negotiation [2019.12.10] 14:08:56.997 [63.27.6.3][7440567] cmd: EHLO smtpout3-tpa.verizon.com [2019.12.10] 14:08:56.997 [63.27.6.3][7440567] rsp: 250-ec2-3-14-181-208.us-east-2.compute.amazonaws.com Hello [63.27.6.3]250-SIZE250-AUTH LOGIN CRAM-MD5 NTLM250-8BITMIME250-DSN250 OK [2019.12.10] 14:08:57.043 [63.27.6.3][7440567] cmd: MAIL FROM: SIZE=7270 [2019.12.10] 14:08:57.043 [63.27.6.3][7440567] senderEmail(1): POCUpdateForm@verizonwireless.com parsed using: [2019.12.10] 14:09:02.739 [63.27.6.3][7440567] rsp: 250 OK  Sender ok [2019.12.10] 14:09:02.739 [63.27.6.3][7440567] Sender accepted. Weight: 0. Block threshold: 50. [2019.12.10] 14:09:02.786 [63.27.6.3][7440567] cmd: RCPT TO: [2019.12.10] 14:09:02.786 [63.27.6.3][7440567] rsp: 250 OK  Recipient ok [2019.12.10] 14:09:02.833 [63.27.6.3][7440567] cmd: DATA [2019.12.10] 14:09:02.833 [63.27.6.3][7440567] Performing PTR host name lookup for 63.27.6.3 [2019.12.10] 14:09:02.849 [63.27.6.3][7440567] PTR host name for 63.27.6.3 resolved as smtpout3-tpa.verizon.com [2019.12.10] 14:09:02.849 [63.27.6.3][7440567] rsp: 354 Start mail input; end with . [2019.12.10] 14:09:02.896 [63.27.6.3][7440567] senderEmail(2): pocupdateform@verizonwireless.com parsed using: POCUpdateForm@verizonwireless.com [2019.12.10] 14:09:02.896 [63.27.6.3][7440567] Sender accepted. Weight: 0. Block threshold: 50. [2019.12.10] 14:09:02.958 [63.27.6.3][7440567] rsp: 250 OK [2019.12.10] 14:09:02.958 [63.27.6.3][7440567] Received message size: 7728 bytes [2019.12.10] 14:09:02.958 [63.27.6.3][7440567] Successfully wrote to the HDR file. (H:\SmarterMail\Spool\SubSpool7\-1333473744893.hdr) [2019.12.10] 14:09:02.958 [63.27.6.3][7440567] Data transfer succeeded, writing mail to -1333473744893.eml (MessageID: <613541018.25227.1575986745921.JavaMail.vzwadmin@sassowfmlap01.sdc.vzwcorp.com>) [2019.12.10] 14:09:08.011 [63.27.6.3][7440567] cmd: QUIT [2019.12.10] 14:09:08.011 [63.27.6.3][7440567] rsp: 221 Service closing transmission channel [2019.12.10] 14:09:08.011 [63.27.6.3][7440567] disconnected at 12/10/2019 2:09:08 PM 

Delivery

[2019.12.10] 14:09:03.067 [44893] Delivery started for POCUpdateForm@verizonwireless.com at 2:09:03 PM [2019.12.10] 14:09:06.070 [44893] Added to SpamCheckQueue (1 queued; 0/30 processing) [2019.12.10] 14:09:06.070 [44893] [SpamCheckQueue] Begin Processing. [2019.12.10] 14:09:06.118 [44893] Starting Spam Checks. [2019.12.10] 14:09:06.588 [44893] Spam check results: [REVERSE DNS LOOKUP: 0,Passed], [_MESSAGESNIFFER: 0,code:0], [_SPF: 0,Pass], [_DKIM: 0,Pass], [BACKSCATTER: 0,passed], [CBL: 0,passed], [DNS REAL-TIME BLACKHOLE LIST: 0,passed], [HOSTKARMA - BLACKLIST: 0,passed], [HOSTKARMA - BROWNLIST: 0,passed], [MAILSPIKE L3: 0,passed], [MAILSPIKE L4: 0,passed], [MAILSPIKE L5: 0,passed], [MCAFEE: 0,passed], [SEM - BLACK: 0,passed], [SORBS - ABUSE: 0,passed], [SORBS - DYNAMIC IP: 0,passed], [SORBS - NO SERVER: 0,passed], [SORBS - NOMAIL: 0,passed], [SORBS - PROXY: 0,passed], [SORBS - RECENT: 0,passed], [SORBS - SOCKS: 0,passed], [SPAMCOP: 0,passed], [SPAMHAUS - CSS: 0,passed], [SPAMHAUS - PBL: 0,passed], [SPAMHAUS - SBL: 0,passed], [SURRIEL: 0,passed], [TRUNCATE: 0,passed], [SURBL: 0,passed], [SEM-URI: 0,passed], [URIBL BLACK: 0,passed], [URIBL GREY: 0,passed], [URIBL RED: 0,passed], [SPAMRATS: 0,passed], [UCEPROTECT LEVEL 1: 0,passed], [UCEPROTECT LEVEL 2: 0,passed], [UCEPROTECT LEVEL 3: 0,passed] [2019.12.10] 14:09:06.588 [44893] Spam Checks completed. [2019.12.10] 14:09:06.588 [44893] Removed from SpamCheckQueue (0 queued or processing) [2019.12.10] 14:09:09.078 [44893] Added to LocalDeliveryQueue (0 queued; 1/50 processing) [2019.12.10] 14:09:09.078 [44893] [LocalDeliveryQueue] Begin Processing. [2019.12.10] 14:09:09.078 [44893] Starting local delivery to mike@wecanwash.com [2019.12.10] 14:09:09.078 [44893] Delivery for POCUpdateForm@verizonwireless.com to mike@wecanwash.com has completed (Delivered) Filter: None [2019.12.10] 14:09:09.078 [44893] End delivery to mike@wecanwash.com (MessageID: <613541018.25227.1575986745921.JavaMail.vzwadmin@sassowfmlap01.sdc.vzwcorp.com>) [2019.12.10] 14:09:09.078 [44893] Removed from LocalDeliveryQueue (0 queued or processing) [2019.12.10] 14:09:12.086 [44893] Removing Spool message: Killed: False, Failed: False, Finished: True [2019.12.10] 14:09:12.086 [44893] Delivery finished for POCUpdateForm@verizonwireless.com at 2:09:12 PM    [id:-1333473744893] [2019.12.10] 14:09:57.151 [44901] Delivery started for mike@wecanwash.com at 2:09:57 PM [2019.12.10] 14:10:00.155 [44901] Added to SpamCheckQueue (1 queued; 0/30 processing) [2019.12.10] 14:10:00.155 [44901] [SpamCheckQueue] Begin Processing. [2019.12.10] 14:10:00.155 [44901] Starting Spam Checks. [2019.12.10] 14:10:00.155 [44901] Skipping spam checks: User authenticated [2019.12.10] 14:10:00.155 [44901] Spam Checks completed. [2019.12.10] 14:10:00.155 [44901] Removed from SpamCheckQueue (0 queued or processing) [2019.12.10] 14:10:03.161 [44901] Added to RemoteDeliveryQueue (1 queued; 7/50 processing) [2019.12.10] 14:10:03.161 [44901] [RemoteDeliveryQueue] Begin Processing. [2019.12.10] 14:10:03.161 [44901] Sending remote mail for mike@wecanwash.com [2019.12.10] 14:10:03.192 [44901] Failed to connect to the recipient's mail server. No MX records were found for the 'mailgun.wecanwash.com' domain. Failing over to A records. [2019.12.10] 14:10:03.192 [44901] MxRecord count: '1' for domain '' [2019.12.10] 14:10:03.192 [44901] Attempting MxRecord Host Name: 'mailgun.wecanwash.com', preference '1', Ip Count: '1' [2019.12.10] 14:10:03.192 [44901] Attempting to send to MxRecord 'mailgun.wecanwash.com' ip: '52.89.202.100' [2019.12.10] 14:10:03.192 [44901] Sending remote mail to: pocupdateform@verizonwireless.com [2019.12.10] 14:10:03.192 [44901] Initiating connection to 52.89.202.100 [2019.12.10] 14:10:03.192 [44901] Connecting to 52.89.202.100:587 (Id: 1) [2019.12.10] 14:10:03.255 [44901] Connection to 52.89.202.100:587 from 172.31.20.211:59071 succeeded (Id: 1) [2019.12.10] 14:10:03.364 [44901] RSP: 220 ak47 ESMTP ready [2019.12.10] 14:10:03.364 [44901] CMD: EHLO ec2-3-14-181-208.us-east-2.compute.amazonaws.com [2019.12.10] 14:10:03.442 [44901] RSP: 250-ak47 [2019.12.10] 14:10:03.442 [44901] RSP: 250-AUTH PLAIN LOGIN [2019.12.10] 14:10:03.442 [44901] RSP: 250-SIZE 52428800 [2019.12.10] 14:10:03.442 [44901] RSP: 250-8BITMIME [2019.12.10] 14:10:03.442 [44901] RSP: 250-ENHANCEDSTATUSCODES [2019.12.10] 14:10:03.442 [44901] RSP: 250-SMTPUTF8 [2019.12.10] 14:10:03.442 [44901] RSP: 250 STARTTLS [2019.12.10] 14:10:03.442 [44901] CMD: STARTTLS [2019.12.10] 14:10:03.536 [44901] RSP: 220 2.0.0 Start TLS [2019.12.10] 14:10:03.677 [44901] Certificate name mismatch. [2019.12.10] 14:10:03.677 [44901] CMD: EHLO ec2-3-14-181-208.us-east-2.compute.amazonaws.com [2019.12.10] 14:10:03.755 [44901] RSP: 250-ak47 [2019.12.10] 14:10:03.755 [44901] RSP: 250-AUTH PLAIN LOGIN [2019.12.10] 14:10:03.755 [44901] RSP: 250-SIZE 52428800 [2019.12.10] 14:10:03.755 [44901] RSP: 250-8BITMIME [2019.12.10] 14:10:03.755 [44901] RSP: 250-ENHANCEDSTATUSCODES [2019.12.10] 14:10:03.755 [44901] RSP: 250 SMTPUTF8 [2019.12.10] 14:10:03.755 [44901] CMD: AUTH LOGIN [2019.12.10] 14:10:03.849 [44901] RSP: 334 VXNlcm5hbWU6 [2019.12.10] 14:10:03.942 [44901] RSP: 334 UGFzc3dvcmQ6 [2019.12.10] 14:10:04.130 [44901] RSP: 235 2.0.0 OK [2019.12.10] 14:10:04.130 [44901] CMD: MAIL FROM: SIZE=212592 [2019.12.10] 14:10:04.225 [44901] RSP: 250 Sender address accepted [2019.12.10] 14:10:04.225 [44901] CMD: RCPT TO: [2019.12.10] 14:10:04.319 [44901] RSP: 250 Recipient address accepted [2019.12.10] 14:10:04.319 [44901] CMD: DATA [2019.12.10] 14:10:04.413 [44901] RSP: 354 Continue [2019.12.10] 14:10:06.023 Updating the ClamAV database has completed successfully14:10:06.352 [44901] RSP: 250 Great success [2019.12.10] 14:10:06.352 [44901] CMD: QUIT [2019.12.10] 14:10:06.445 [44901] RSP: 221 See you later. Yours truly, Mailgun [2019.12.10] 14:10:06.445 [44901] Attempt to ip, '52.89.202.100' success: 'True' [2019.12.10] 14:10:06.445 [44901] Delivery for mike@wecanwash.com to pocupdateform@verizonwireless.com has completed (Delivered) [2019.12.10] 14:10:06.445 [44901] Removed from RemoteDeliveryQueue (8 queued or processing) [2019.12.10] 14:10:09.170 [44901] Removing Spool message: Killed: False, Failed: False, Finished: True [2019.12.10] 14:10:09.170 [44901] Delivery finished for mike@wecanwash.com at 2:10:09 PM    [id:-1333473744901]

We are having some problems like this, but we think the problem is in Outlook cached names.   Affects only a few users, but one user is having chronic problems.

I'm seeing
RCPT TO:<mike@wecanwash.com>
Which is the most important line when determining who will get the email, which in this case is what happened. How is the client sending the email?

That is who SHOULD BE RECEIVING but it is NOT who is receiving. It is going to a completely different user at a completely different domain. That is the problem. Everything is addressed correctly but the system is sending to the wrong user.

The people sending our outside of our server. One I know is Outlook. The other is an automated CRM.

I have become convinced that my problem is all on the Outlook name cache.   Flushing the user's cache has not worked, so the next step is to repair her inbox.   if that fails, the final step is to disable name caching, which will not be well received.

This client is solely using Webmail so Outlook is out of the question on the receivers computers. The senders we have no control over.

John,

  I tested by telnet port 25 of your mail server :

250 OK <mike@winfieldamerican.com> Recipient ok

250 OK <mjkucic@winfieldamerican.com> Recipient ok

250 OK <mike@wecanwash.com> Recipient ok

550 <mjkucic@wecanwash.com> No such user here

  So you do have a mike & mjkucic @ winfieldamerican.com you need to find out why

that is.

  Check for rules, Global Address Rules, Domain Alias and Content Filtering, to be sure

something in those areas isn't causing this issue.

Good Luck,

-dave

One, even if I did (I don't) have a mjkucic@ and mike@ winfieldamerican.com it shouldn't matter being it was sent to @wecanwash.com. There is an alias for mike@winfield... but that should not matter. It was sent to a different domain. There are no forwarding, rules, domain aliases, etc. on @wecanwash.

@John, David's test does reveal an interesting note though and that is your mail is accepting emails for mike@winfieldamerican.com but you mentioned that you don't have account for that user but an alias. Does this occur for users who do not have an alias?

Another thing we can try is to hop onto your environment and check. Since this is a live-production environment we need you to fill out an RSAA containing your credentials. We can continue the main conversation here but I still need you to create that ticket for the credentials at least, mention this thread in it.

I truly don't know the answer to that Matt. If I send a message to user@domain-1.com and it reaches user@domain-2.com (which is an alias) I see this as a major issue.

I can say I have deleted the alias account to try and "fix" the issue.

This should be something easily reproducible.

I originally started with a ticket but will create one this afternoon when I have time to do so.