Virgin Media Community

[Holtyd86]

Hey, my ntl world email address has been sending out emails from 5 years ago today, so basically anything I sent in a email over 5 years ago is being resent out again.

Anybody know why this might be?

Thanks

[Lindsey_C]

Hi Holtyd86,

Thanks for your post.

Very sorry to hear you are having trouble with your email. We would need some more information from you please if that's OK?

Is your email end in ntlworld.com?

Are you using an email client such as Outlook or are you accessing this through the website?

Do you have any mail forwarding options set up on your email address?

Thanks

Lindsey_C

[Holtyd86]

It ends in ntlworld.com I use outlook on my phone and via the virgin media website on my computer.

I've checked my sent mail and nothing looks to have been sent but I've had lots of people saying they have received duplicate emails from me from upto 5 years ago.

[ravenstar68]

Are you able to get them to forward one of these mails back to you as an attachment and look at the headers of said mail (preferably by downloading it from webmail and not Outlook (Outlook has an annoying tendency to mangle the headers).

Tim

[Holtyd86]

What am I looking for in the header please?

[ravenstar68]

You need to look at the dates of the received: lines. Specifically the most recent line that has by mx etc on it and the next ones down

[Holtyd86]

X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Feb 2019 11:10:53.4493

[ravenstar68]

What I'm looking for is the arrival at the server - what email service sends it.

It looks as if the mails are arriving at a NON Virgin Media domain from what you've posted.

the lines I'm looking for all read Received at the beginning.

For example here's some headers sent to my email server.

Return-Path: <***********@blueyonder.co.uk>
Delivered-To: <***************@timothydutton.co.uk>
Received: from box.timothydutton.co.uk ([127.0.0.1])
    by box.timothydutton.co.uk (Dovecot) with LMTP id /HjkJv6eK1wZEwAAqnml9w
    for <**************@timothydutton.co.uk>; Tue, 01 Jan 2019 17:10:22 +0000
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on
    box.timothydutton.co.uk
X-Spam-Level: 
X-Spam-Status: No, score=-0.8 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED,
    DKIM_VALID,DKIM_VALID_AU,HTML_MESSAGE,RCVD_IN_DNSWL_LOW autolearn=ham
    autolearn_force=no version=3.4.2
X-Spam-Report: 
    * -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/,
    * low trust
    * [212.54.57.96 listed in list.dnswl.org]
    * 0.0 HTML_MESSAGE BODY: HTML included in message
    * -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
    * author's domain
    * 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
    * valid
    * -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
    * -0.0 DKIMWL_WL_MED DKIMwl.org - Whitelisted Medium sender
X-Spam-Score: -0.8
Received: from smtpq1.tb.ukmail.iss.as9143.net (smtpq1.tb.ukmail.iss.as9143.net [212.54.57.96])
    (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
    (No client certificate requested)
    by box.timothydutton.co.uk (Postfix) with ESMTPS id 6E2501208AC
    for <************@timothydutton.co.uk>; Tue, 1 Jan 2019 17:10:22 +0000 (GMT)
Authentication-Results: box.timothydutton.co.uk; dmarc=pass header.from=blueyonder.co.uk
Authentication-Results: box.timothydutton.co.uk; dkim=pass
    reason="2048-bit key; unprotected key"
    header.d=blueyonder.co.uk header.i=@blueyonder.co.uk
    header.b=X57rS981; dkim-adsp=pass; dkim-atps=neutral
Received: from [212.54.57.81] (helo=smtp2.tb.ukmail.iss.as9143.net)
    by smtpq1.tb.ukmail.iss.as9143.net with esmtp (Exim 4.86_2)
    (envelope-from <************@blueyonder.co.uk>)
    id 1geNYb-0002Yr-N1
    for ****************@timothydutton.co.uk; Tue, 01 Jan 2019 18:10:21 +0100
Received: from oxbe13.tb.ukmail.iss.as9143.net ([172.25.160.144])
    by smtp2.tb.ukmail.iss.as9143.net with ESMTP
    id eNYbgDHLoVeiReNYbg425W; Tue, 01 Jan 2019 18:10:21 +0100
X-Env-Mailfrom: **************@blueyonder.co.uk
X-Env-Rcptto: ****************@timothydutton.co.uk
X-SourceIP: 172.25.160.144
X-CNFS-Analysis: v=2.3 cv=UMCj4xXy c=1 sm=1 tr=0
    a=wuFMYA7voKp1dZz7Z+vj5Q==:117 a=POWzxHd8dzsA:10 a=x7bEGLp0ZPQA:10
    a=KuV6g8DJIGQA:10 a=D_-jf9nNoQj9hnjaIKIA:9 a=QEXdDO2ut3YA:10
    a=EdtJt982nQX_Z0wARJcA:9 a=_W_S_7VecoQA:10 a=pHzHmUro8NiASowvMSCR:22
    a=nt3jZW36AmriUCFCBwmW:22
X-Authenticated-Sender: **************@blueyonder.co.uk
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=blueyonder.co.uk;
    s=meg.feb2017; t=1546362621;
    bh=tS5B51kYKfTlgOM5HrkpEEevCCtebH3cRsWlWC5YLlY=;
    h=Date:From:To:Subject;
    b=X57rS981jfWfNi0QAPth8EbIhZWjPTRiWECCSsHx6mOpfpmKrEVbANVsgpxSlOaTP
    n8JHoyZuDn39fbiX6tv5TGc+Cz1vlXh+Zekml7xC/6V8DAbBmWPhcMiloGQjPBk3E/
    p2slc2UvK2XqphyUE/b0DaJbe1UyAuCkO+5L9kycoriwP4jJEsqc+iSkezGhLFkTUo
    VmSY1iRrlCoGL3hOY0OgOS0KDR4p4g69tP9SRQ3z/xxmAPb1tqgWCUbzx9QykMOL/E
    /6vzhj7MVWgbiB+qEZxfIaLuFNl1V3UNQusLJgE7G83NTHoFDWEbZtdBwxd5xA5z0W
    gZonhYGu7yVcA==
Date: Tue, 1 Jan 2019 17:10:21 +0000 (GMT)
From: Timothy Dutton <****************@blueyonder.co.uk>
To: "tim dutton" <***************@outlook.com>,
    Timothy Dutton <****************@timothydutton.co.uk>
Message-ID: <2099630559.738434.1546362621626@mail2.virginmedia.com>
Subject: A quick test
MIME-Version: 1.0
Content-Type: multipart/alternative; 
    boundary="----=_Part_738433_578720565.1546362621621"
X-Priority: 3
Importance: Medium
X-Mailer: Open-Xchange Mailer v7.8.4-Rev47
X-Originating-IP: 80.195.90.23
X-Originating-Client: open-xchange-appsuite
X-CMAE-Envelope: MS4wfMY9xoo+s7pBuFzNIfuO2eO+sNpiNcYRmBHbcEQMx/jG5t6tPMULu4W6SYJWptdnGi3v4Vbs2Fbekh7pe+fIBfw297UbnFw1/AI1qJHarvMsUjelsqX0
    VGSshtMeRZ2CnANSc2n/8bScyqbxzLlUoXI5dOJC9E+a/lLa4CXq+iwwfnJ+KDANEPNY3aK6ktXiTzoT2zHujR2VuvgVGrATuNAtQUfndxMvwjzwQ0FDc/OJ
    Vv2/4E+DS3kF20/tyXnq/A==

In my case the line I would be looking for is the one in red and then all the Received lines below that.  It shows me the path the mail has taken to get to my email server.

Tim

Note: I've redacted parts of my email addresses as one should never post full email addresses on the open Forum.

[Holtyd86]

Received: from VI1PR08MB0861.eurprd08.prod.outlook.com (10.152.12.55) by
VE1EUR02FT025.mail.protection.outlook.com (10.152.12.109) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.1580.10 via Frontend Transport; Thu, 31 Jan 2019 19:46:11 +0000
Received: from VI1PR08MB0861.eurprd08.prod.outlook.com
([fe80::c15e:af69:7675:8e91]) by VI1PR08MB0861.eurprd08.prod.outlook.com
([fe80::c15e:af69:7675:8e91%2]) with mapi id 15.20.1558.023; Thu, 31 Jan 2019
19:46:11 +0000

So looking at that, I'm guessing it's outlook which has sent them out?

Thanks

[Jen_A]

Hi  Holtyd86,

I've taken a look at the outbound mail log data and see only a single email sent out on the 31st January, from a Microsoft (Outlook) IP address. The subject last word is 'era', does this sound familiar?