Virgin Media
My Virgin Media
Mobile Your Account
Menu
Are you able to get them to forward one of these mails back to you as an attachment and look at the headers of said mail (preferably by downloading it from webmail and not Outlook (Outlook has an annoying tendency to mangle the headers).
Tim
You need to look at the dates of the received: lines. Specifically the most recent line that has by mx etc on it and the next ones down
What I'm looking for is the arrival at the server - what email service sends it.
It looks as if the mails are arriving at a NON Virgin Media domain from what you've posted.
the lines I'm looking for all read Received at the beginning.
For example here's some headers sent to my email server.
Return-Path: <***********@blueyonder.co.uk>
Delivered-To: <***************@timothydutton.co.uk>
Received: from box.timothydutton.co.uk ([127.0.0.1])
by box.timothydutton.co.uk (Dovecot) with LMTP id /HjkJv6eK1wZEwAAqnml9w
for <**************@timothydutton.co.uk>; Tue, 01 Jan 2019 17:10:22 +0000
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on
box.timothydutton.co.uk
X-Spam-Level:
X-Spam-Status: No, score=-0.8 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED,
DKIM_VALID,DKIM_VALID_AU,HTML_MESSAGE,RCVD_IN_DNSWL_LOW autolearn=ham
autolearn_force=no version=3.4.2
X-Spam-Report:
* -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/,
* low trust
* [212.54.57.96 listed in list.dnswl.org]
* 0.0 HTML_MESSAGE BODY: HTML included in message
* -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
* author's domain
* 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
* valid
* -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
* -0.0 DKIMWL_WL_MED DKIMwl.org - Whitelisted Medium sender
X-Spam-Score: -0.8
Received: from smtpq1.tb.ukmail.iss.as9143.net (smtpq1.tb.ukmail.iss.as9143.net [212.54.57.96])
(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
(No client certificate requested)
by box.timothydutton.co.uk (Postfix) with ESMTPS id 6E2501208AC
for <************@timothydutton.co.uk>; Tue, 1 Jan 2019 17:10:22 +0000 (GMT)
Authentication-Results: box.timothydutton.co.uk; dmarc=pass header.from=blueyonder.co.uk
Authentication-Results: box.timothydutton.co.uk; dkim=pass
reason="2048-bit key; unprotected key"
header.d=blueyonder.co.uk header.i=@blueyonder.co.uk
header.b=X57rS981; dkim-adsp=pass; dkim-atps=neutral
Received: from [212.54.57.81] (helo=smtp2.tb.ukmail.iss.as9143.net)
by smtpq1.tb.ukmail.iss.as9143.net with esmtp (Exim 4.86_2)
(envelope-from <************@blueyonder.co.uk>)
id 1geNYb-0002Yr-N1
for ****************@timothydutton.co.uk; Tue, 01 Jan 2019 18:10:21 +0100
Received: from oxbe13.tb.ukmail.iss.as9143.net ([172.25.160.144])
by smtp2.tb.ukmail.iss.as9143.net with ESMTP
id eNYbgDHLoVeiReNYbg425W; Tue, 01 Jan 2019 18:10:21 +0100
X-Env-Mailfrom: **************@blueyonder.co.uk
X-Env-Rcptto: ****************@timothydutton.co.uk
X-SourceIP: 172.25.160.144
X-CNFS-Analysis: v=2.3 cv=UMCj4xXy c=1 sm=1 tr=0
a=wuFMYA7voKp1dZz7Z+vj5Q==:117 a=POWzxHd8dzsA:10 a=x7bEGLp0ZPQA:10
a=KuV6g8DJIGQA:10 a=D_-jf9nNoQj9hnjaIKIA:9 a=QEXdDO2ut3YA:10
a=EdtJt982nQX_Z0wARJcA:9 a=_W_S_7VecoQA:10 a=pHzHmUro8NiASowvMSCR:22
a=nt3jZW36AmriUCFCBwmW:22
X-Authenticated-Sender: **************@blueyonder.co.uk
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=blueyonder.co.uk;
s=meg.feb2017; t=1546362621;
bh=tS5B51kYKfTlgOM5HrkpEEevCCtebH3cRsWlWC5YLlY=;
h=Date:From:To:Subject;
b=X57rS981jfWfNi0QAPth8EbIhZWjPTRiWECCSsHx6mOpfpmKrEVbANVsgpxSlOaTP
n8JHoyZuDn39fbiX6tv5TGc+Cz1vlXh+Zekml7xC/6V8DAbBmWPhcMiloGQjPBk3E/
p2slc2UvK2XqphyUE/b0DaJbe1UyAuCkO+5L9kycoriwP4jJEsqc+iSkezGhLFkTUo
VmSY1iRrlCoGL3hOY0OgOS0KDR4p4g69tP9SRQ3z/xxmAPb1tqgWCUbzx9QykMOL/E
/6vzhj7MVWgbiB+qEZxfIaLuFNl1V3UNQusLJgE7G83NTHoFDWEbZtdBwxd5xA5z0W
gZonhYGu7yVcA==
Date: Tue, 1 Jan 2019 17:10:21 +0000 (GMT)
From: Timothy Dutton <****************@blueyonder.co.uk>
To: "tim dutton" <***************@outlook.com>,
Timothy Dutton <****************@timothydutton.co.uk>
Message-ID: <2099630559.738434.1546362621626@mail2.virginmedia.com>
Subject: A quick test
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_Part_738433_578720565.1546362621621"
X-Priority: 3
Importance: Medium
X-Mailer: Open-Xchange Mailer v7.8.4-Rev47
X-Originating-IP: 80.195.90.23
X-Originating-Client: open-xchange-appsuite
X-CMAE-Envelope: MS4wfMY9xoo+s7pBuFzNIfuO2eO+sNpiNcYRmBHbcEQMx/jG5t6tPMULu4W6SYJWptdnGi3v4Vbs2Fbekh7pe+fIBfw297UbnFw1/AI1qJHarvMsUjelsqX0
VGSshtMeRZ2CnANSc2n/8bScyqbxzLlUoXI5dOJC9E+a/lLa4CXq+iwwfnJ+KDANEPNY3aK6ktXiTzoT2zHujR2VuvgVGrATuNAtQUfndxMvwjzwQ0FDc/OJ
Vv2/4E+DS3kF20/tyXnq/A==In my case the line I would be looking for is the one in red and then all the Received lines below that. It shows me the path the mail has taken to get to my email server.
Tim
Note: I've redacted parts of my email addresses as one should never post full email addresses on the open Forum.
