Email Disconnections


April 6th, 2004 - 10:23 | 8 comments

The problem of the disconnecting email has returned today…I’m going to first see if it happens on my computer, then find the exact email and analyse the headers line by line. I really want to get this one sorted!

UPDATE: Ok, I can’t replicate it on my computer atm, but here is the entire message source:

Return-Path: <oleabaens@mail.zp.ua>
Received: from cm-24-196-163-013.ash.nc.charter.com (24.196.163.13) by mk-cpfrontend.uk.tiscali.com(7.0.024.3-1)
id 4059BFE801A267C6; Sat, 3 Apr 2004 11:42:01 +0000
Sender: oleabaens@mail.zp.ua (derived from envelope by postmaster@uk.tiscali.com)
Date: Sat, 3 Apr 2004 11:42:01 +0000 (added by postmaster@uk.tiscali.com)
Message-ID: <4059BFE801A267C6@mk-cpfrontend-10.mail.uk.tiscali.com> (added by postmaster@uk.tiscali.com)
X-Message-Info: O[4

How the hell is this getting anywhere? Do you think it could be infected with a virus, which is then being stripped by Norton, but half the headers are getting removed too?

-----

8 Responses to “Email Disconnections” 

  1. Gravatar Icon 1 Edward 

    X-Message-Info: O[4

    ^^^^^^^^^^^^^^ is Spam Assassin running on their mail servers????
    And if so, is it breaking????

  2. Gravatar Icon 2 Andrew 

    Is X-Message-Info a SpamAssassin header? I’m trying to find out about it, but not having much luck atm

  3. Gravatar Icon 3 Edward 

    Well I thought that it was since I’m running NAV, and on my SpamAssassin (I am pretty sure it is SapmAssassin) protected emails, I get loads of extra headers

    From - Sun Apr 04 14:38:35 2004
    X-UIDL: UID1990-1070046922
    X-Mozilla-Status: 0001
    X-Mozilla-Status2: 00000000
    Return-path:
    Delivery-date: Sun, 04 Apr 2004 06:38:14 -0700
    Received: from [216.148.213.132] (helo=smtp.mailix.net)
    by mx.mailix.net with esmtp (Exim 4.24-GA)
    id 1BA7pE-0003l2-QN
    for email@email.email; Sun, 04 Apr 2004 06:38:12 -0700
    Received: from [212.56.110.225] (helo=edbateman.com)
    by smtp.mailix.net with asmtp (Exim 4.24-H)
    id 1BA7p6-00064A-E3
    for email; Sun, 04 Apr 2004 06:38:04 -0700
    Message-ID:
    Date: Sun, 04 Apr 2004 14:37:40 +0100
    From: emailemail
    User-Agent: Mozilla Thunderbird 0.5 (Windows/20040207)
    X-Accept-Language: en-us, en
    MIME-Version: 1.0
    To: email@email.email
    X-uvscan-result: clean (1BA7p6-00064A-E3)
    X-SA-Exim-Mail-From: email@email.email
    Subject: (no subject)
    Content-Type: text/plain; charset=us-ascii; format=flowed
    Content-Transfer-Encoding: 7bit
    X-Spam-Checker-Version: SpamAssassin 2.61 (1.212.2.1-2003-12-09-exp) on
    westvirginia.backend
    X-Spam-Report:
    X-Spam-Status: No, hits=0.0 required=10.0 tests=none autolearn=no version=2.61
    X-Spam-Level:
    X-SA-Exim-Version: 3.1 (built Thu Oct 23 13:26:47 PDT 2003)
    X-SA-Exim-Scanned: Yes
    X-uvscan-result: clean (1BA7pE-0003l2-QN)

  4. Gravatar Icon 4 Edward 

    (my emails are also virus scanned too at the mail server!)

  5. Gravatar Icon 5 Edward 

    Actually, I want to change my mind. (sorry)
    SpamAssassin adds extra fields in, but it doesn’t mention that it adds the X-Message-Info. I think that some servers, when sending emails on copy the Message-Info old message info to a new X-Message-Info, and then replace the Message-Info.
    I will do a search through all my emails and see if any have these headers

  6. Gravatar Icon 6 Edward 

    After mucho searching on the web and emails, I’ve concluded that I’m at a loss.
    The only emails that have those headers are from hotmail emails, and the email headers continue on after the X-Message-Info headers.
    Perhaps you might want to:
    a) check whether the mail.zp.ua is a blacklisted web server
    b) check what Tiscali thinks about the problem?

    It might be a: ‘It is a feature, not a bug’.
    Sorry to have been no more help.

  7. Gravatar Icon 7 Andrew 

    No problem, thanks very much for looking! I’ll do some investigating of the IP etc as you suggest

  8. Gravatar Icon 8 Bert 

    I’m not sure if there are legitimate uses of X-Message-Info, but the ones you quote are consistent with certain spam software.

    The clipped message is in all likelyhood also caused by the spamware. My hypothesis is that they use an unreliable protocol to talk to the (virus/worm) infected machine, and therefore only manage to send parts of the spam out when the network connection of the victim in between gets overloaded.

-----

Leave a Reply

Commenting Policy: Thoughts, observations, argument, debate and all other conversational wonderments are encouraged, but personal attacks or general trolling will result in your comment being deleted and your account/IP banned. If you're nice, however, you get strawberries.



(comments may take ~20 seconds to process due to anti-spam pixies)