Virgin Media Community

[Rfelley]

I have had a few recent emails rejected from postmaster @virginmedia.nl rather than postmaster @virginmedia.com.  Is this suspicious?

[ravenstar68]

I'd be interested in seeing the headers of the rejection messages. (please obscure the part of any legitimate email addresses before the @ symbol)

I'm going to do some asking in the background on this one.  But seeing the headers would definitely tell me more.  As would seeing the rejection message.

Tim

[Rfelley]

If this is what you mean by the header then the only difference is that the older ones are from virginmedia.com

Is this what you need?

[ravenstar68]

If you click the menu icon (3 lines) on the mail itself and then click view source.  That will show you the mail headers.

And you're right to wonder about virginmedia.nl  However a check shows that the domain is owned by Liberty Global (Virgin Media's parent company).

I'm hoping that the @ModTeam can get someone to escalate this for investigation.

Here's an example from a legitimate bounce:

Return-Path: <>
Delivered-To: myaddress@virginmedia.com
Received: from md6.tb.ukmail.iss.local ([212.54.57.75])
by mc33.tb.ukmail.iss.local with LMTP id mImONsYacV46GgAAVGfrGw
for <myaddress@virginmedia.com>; Tue, 17 Mar 2020 19:45:27 +0100
Received: from smtpclienthelo ([212.54.57.75])
by md6.tb.ukmail.iss.local with LMTP
id 8I5oNsYacV77AwAACKiK/Q
(envelope-from <>)
for <myaddress@virginmedia.com>; Tue, 17 Mar 2020 19:45:26 +0100
Authentication-Results: ukmail.iss.as9143.net;
spf=none (212.54.57.96;);
dkim=pass header.d=virginmedia.com;
dmarc=pass header.from=virginmedia.com (p=quarantine sp=quarantine dis=pass);
X-Env-Mailfrom:
X-Env-Rcptto: myaddress@virginmedia.com
X-SourceIP: 212.54.57.96
X-CNFS-Analysis: v=2.3 cv=Role0BuK c=1 sm=1 tr=0 cx=a_idp_d
a=rKl3PZ0TtsH76cviVwgYBQ==:117 a=KiCxJD0x+Pe5VASQKmYoJrcyuOo=:19
a=SS2py6AdgQ4A:10 a=jmdcTMp_Gj4A:10 a=JVZ6HA4KAAAA:8 a=RaroxqcrVzzFHpaWYmAA:9
a=vN1fya-Xws52jdYN:21 a=S2JzpJ38t0OX9MBQ:21 a=CjuIK1q_8ugA:10
a=cIF5Tx0qAAAA:8 a=Xolr7LyvDbnoz9bztpQA:9 a=juVlzFFWDXkOJygZ:21
a=Irue5xKl7tYTyzuZ:21 a=CdUuA98fHEQA:10 a=lW2LlPV2uUUA:10
a=qPIQoZ1KbBn4iqwGBRwA:9 a=QEXdDO2ut3YA:10 a=Evvq3DngU_sqAmXWYzEA:9
a=_W_S_7VecoQA:10 a=r2qDm9uDy9D1f1nKyJmp:22 a=0MObOHtTKSZSGUUTr8QS:22
Received: from smtpq1.tb.ukmail.iss.as9143.net ([212.54.57.96])
by mx8.tb.ukmail.iss.as9143.net with ESMTP
id EHDSjg6yxSHGsEHDSjSJ8d; Tue, 17 Mar 2020 19:45:26 +0100
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=virginmedia.com; s=meg.feb2017; h=Date:Message-Id:Subject:MIME-Version:
Content-Type:To:From; bh=KyKuHoffxTJInc9+BBH3Wfm1MxETCQ+12VmENshkoN8=; b=W9ix
TY0tqyNwby/1nOCWVtNM4HZwg02Skno0CLSwkb59NJRqUbHt1n0kniDprbbclcDLrsvgv5ci2dpdJ
uhL1rRZWiKEv8SN7eFMRCtHXETSLPVgHiD+w4UAgr9QJDiE7500IS4yvg7n+pz317KLHvc4GUY6N+
MZPbofY/IAnZ3CtwciOq+fxrywko3y3NXEWtJLwJIPscQJIZAyOfTv/KtnkufsO8U3xpxG7tq/gVK
y8vvKQwq89zpx2xLa9Vo7dr2XYzXidKf/WzMHtsMytW/Npt5H6ZSIXc/Izwwgy7cULN2N87lsP9ax
Ml28fXMNZOeB2R7MsqLzXjdxtLkVMQ==;
Received: from Debian-exim by smtpq1.tb.ukmail.iss.as9143.net with local (Exim 4.86_2)
id 1jEHDS-0002gG-Pp
for myaddress@virginmedia.com; Tue, 17 Mar 2020 19:45:26 +0100
X-Failed-Recipients: failed@timothydutton.co.uk
Auto-Submitted: auto-replied
From: Mail Delivery System <postmaster@virginmedia.com>
To: myaddress@virginmedia.com
Content-Type: multipart/report; report-type=delivery-status; boundary=1584470726-eximdsn-969508641
MIME-Version: 1.0
Subject: Mail delivery failed : returned to sender
Message-Id: <E1jEHDS-0002gG-Pp@smtpq1.tb.ukmail.iss.as9143.net>
Date: Tue, 17 Mar 2020 19:45:26 +0100
X-CMAE-Envelope: MS4wfEAb61YlsSWLsyMyg59rmxtsqypOO8Q+GtJm79jFJBmQJ1tVX2IRH+5xiqyDbioylzee5k9j6AN0hJOUXqkQIuX6M428YjLYo14k7vuoBCUx6qrz/y65
h+4dQLTQpGdtzKYICeGUQCr6NxuKLUJyPbAc3k0rvTmJvbmFg6fWuIb/V2ksy7WhuklpkfE7Wnxubw==

Tim

Edit - On the face of it the screenshot seems to show a legitimate bounce the only unusual thing being the virginmedia.nl address.

Tim

[ModTeam]

Hi Rfelley, 

Thanks for your post on the community. 

We would need the full mail headers from these bounce emails in order to escalate this to our team for more information. 

If you could send these over in the private message to the 'Mod Team' account we can take it from there. 

Thanks

Mod Team

[Rfelley]

Thank you

[Rfelley]

Headers sent in PM to ModTeam - thank you