help please

finchx6

I posted this under off topic, but I'm not getting any responses... I dont know if no one knows the answer, or if I just posted it in the wrong spot for anyone to find it, so... here goes again...

Alright, I've got a problem on my hands that I've got absolutely no idea about. I've searched all over the net, and can't seem to find any existing forums that were very helpful, so I thought, why not ask here?? I've been studying for my CCNA with so much help from this site, I really think someone will be able to help me. Below is the header to an email. This email was sent by a client of the company I work for. As you can see, the email was bounced back to him due to an invalid address. I'm sure you're thinking, "well, he got the email address wrong or it got deleted." Well, I wish that were true, HOWEVER, look at the addresses it was SUPPOSE to be sent to, as opposed to the email address it attempted to get sent to... The email was addressed to a Kathleen McCullock and Fred Roper, however, it was sent to the address BrantClose@humuf.improvisatize.com instead... which is the invalid email address that bounced the email back to the sender/client. Does ANYONE know why this happened, what could have caused it, and any ways to resolve it? I'm in dire need of help here, because I've got no idea, and our client is toying with the notion that this was some kind of hijack attempt, and I'd like to be able to put his mind at ease by either explaining what happened (in the instance that it was some kind of fluke error, if even possible???) or how to fix it, in the instance that it really is some kind of spam or hijack attempt.. The header is below:


Subject: failure notice

Hi. This is the qmail-send program at hosting2.cableone.net.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

<BrantClose@humuf.improvisatize.com>:
qmail-spawn unable to open message. (#4.3.0) I'm not going to try again; this message has been in the queue too long.

--- Below this line is a copy of the message.

Return-Path: <russell.neisig@bullockscott.com>
Received: (qmail 25903 invoked from network); 21 Nov 2006 08:14:37 -0700
Received: from exprod7og55.obsmtp.com (64.18.2.165)
by hosting2.cableone.net with SMTP; 21 Nov 2006 08:14:36 -0700
Received: from source ([209.240.191.51]) by exprod7ob55.obsmtp.com
([64.18.6.12]) with SMTP;
Tue, 21 Nov 2006 07:14:34 PST
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----_=_NextPart_001_01C70D80.CA00D298"
Subject: WTGGP v. Katty
X-MimeOLE: Produced By Microsoft Exchange V6.5
Date: Tue, 21 Nov 2006 09:21:55 -0600
Message-ID: <49714E5074B63F4581367F7479F8CC4E6CC257@WIN2K3.bsno.com>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: WTGGP v. Katty
Thread-Index: AccNgMcsDf1IdKmmSAKT5k071RNdxw==
From: "Russell Neisig" <russell.neisig@bullockscott.com>
To: "Kathleen McCulloch - New" <kmcculloch@shaferfirm.com>,
<cinskeep@shaferfirm.com>
Cc: "Fred Roper" <froper@westtexasgas.com>

This is a multi-part message in MIME format.

---

_=_NextPart_001_01C70D80.CA00D298
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Kathleen, =20

forbesl

...and you feel like for some reason this belongs in the CCNA forum??

Also, you posted it in "off-topic" for only 45 minutes, couldn't get an immediate answer and then posted it in here? This is a forum, not a chat room.

finchx6

I just assumed it was worth a shot. I can't find or get answers elsewhere and I've usually had pretty good feedback in the CCNA forum.

Everlife

Did this reach any of the recipients, or did it fail on all of them?

Trailerisf

forbesl wrote:

...and you feel like for some reason this belongs in the CCNA forum??

Also, you posted it in "off-topic" for only 45 minutes, couldn't get an immediate answer and then posted it in here? This is a forum, not a chat room.

Come on, you've had 45 minutes to drive there and fix it for him.

forbesl

Trailerisf wrote:

Come on, you've had 45 minutes to drive there and fix it for him.

I could have beamed over, but my transporter is busted at this time. Scotty's workin' on it now.

finchx6

"Did this reach any of the recipients, or did it fail on all of them? "



No, none of the INTENDED recipients actually received it. Although I'm under the influence that the address it actually got sent to didn't either.

forbesl

finchx6 wrote:

Although I'm under the influence....

There's your problem. Drinking and IT work don't mix.

finchx6

Can't help it, they keep the break room stocked with grey goose vodka... That would be pretty funny actually. "No, I don't know whats wrong with your computer.... have you tried just stepping away from it and never touching another one again?"

sprkymrk

<BrantClose@humuf.improvisatize.com> could be an alias or auto-forward setting on the remote server for one of the actual recipients. Best thing is to call the intended recipients (since there are only 2) and ask if they recognize the address.

TechJunky

Have him manually type the persons email address. I bet he is using a contact list and for whatever reason the email address that it is trying to send to is tied to that persons name in his contact list.

Problem solved.

finchx6

"Have him manually type the persons email address. I bet he is using a contact list and for whatever reason the email address that it is trying to send to is tied to that persons name in his contact list. "

I wish it were that simple, but he doesn't know anyone from that email address... it came from nowhere, according to the client. Plus, if it were just the contacts list doing that, why would the two correct INTENDED recipients be listed in the bounce header??

Slowhand

I think that part of your problem, finchx6, is that you've titled the posting "please help". Undescriptive topics rarely get much attention, since people don't know what they're getting into when they click. Next time, try being a little more descriptive, like "Emails getting bounced back with an error message reading 'Subject: failure notice'. . ." or something like that.

boatguy1982

Could the people he has been trying to send it to been moved or fired and this is an automatic redirect? Also could the address he is sending it to have been hijacked? Is he using a wireless connection could someone be physically taping into his network? Could he have someones noun name listed as a certain e-mail address?

finchx6

good point... I thought about the title of the post shortly after I posted it... I was basically panicking because I had absolutely NO idea what to tell this client, and he's freaking out hardcore worrying about virii, worms, and all the other malicious things he's heard about...

sprkymrk

finchx6 wrote:

and he's freaking out hardcore worrying about virii, worms, and all the other malicious things he's heard about...

He should be concerned. It might be nothing, but then again it could be something. There's nothing worse than a user who has had a security problem for weeks before mentioning it to an admin, and saying something like "Oh, I didn't know what was going on so I just figured if there was a problem you'd come to me...."

Silver Bullet

How many times has this occurred? The way it reads is that it has only happened once.

Does it happen if he/she sends to any other recipients or just those 2?

Can you or him successfully send these people mail from another PC, ISP, Webmail like gmail or hotmail?

Plantwiz

Slowhand wrote:

I think that part of your problem, finchx6, is that you've titled the posting "please help". Undescriptive topics rarely get much attention, since people don't know what they're getting into when they click. Next time, try being a little more descriptive, like "Emails getting bounced back with an error message reading 'Subject: failure notice'. . ." or something like that.

finchx6 wrote:

finchx6 Posted: Tue Nov 21, 2006 4:51 pm Post subject:

---

good point... I thought about the title of the post shortly after I posted it... I was basically panicking because I had absolutely NO idea what to tell this client, and he's freaking out hardcore worrying about virii, worms, and all the other malicious things he's heard about...

Still, Slowhand is correct. Find some descriptive topic heading so members will know what they are getting into AND it also makes for a valueable search months from now. "PLEASE HELP" is useless. Also, please keep in mind this is a global site as well as other members have 'crisis' situations that they too want to have responses to. The more you offer in your title, the better the members with the best skills will find you. We all volunteer here


edit - to fix quoting error

supertechCETma

the mail server cannot reach the humuf.improvisatize.com site.
That site requires a log in and since it can't reach it, it kicked it out.

sprkymrk

http://www.ietf.org/rfc/rfc1893.txt

4.X.X Persistent Transient Failure

A persistent transient failure is one in which the message as
sent is valid, but some temporary event prevents the successful
sending of the message. Sending in the future may be successful.

Some other 1893 codes that can show up in bounce messages:

System resources temporarily unavailable. (#4.3.0)
Unable to read message. (#4.3.0)
Unable to switch to home directory. (#4.3.0)
Unable to read control files. (#4.3.0)
Aack, child crashed. (#4.3.0)
Unable to rewind message. (#4.3.0)
Unable to fork. (#4.3.0)
Error while reading message. (#4.3.0)
Error while writing message. (#4.3.0)
Temporary error in forwarding message. (#4.3.0)
Timeout on maildir delivery. (#4.3.0)
Temporary error on maildir delivery. (#4.3.0)
Temporary error trying to open .qmail file. (#4.3.0)
Permission error trying to open .qmail file. (#4.3.0)
File has been locked for 30 seconds straight. (#4.3.0)
Text busy. (#4.3.0)
Out of memory. (#4.3.0)
I/O error. (#4.3.0)
qmail-spawn out of memory. (#4.3.0)
qmail-spawn unable to open message. (#4.3.0)
qmail-spawn unable to fstat message. (#4.3.0)
qmail-spawn unable to create pipe. (#4.3.0)
qmail-spawn unable to fork. (#4.3.0)
Unable to switch to home directory. (#4.3.0)
Unable to stat home directory. (#4.3.0)
Temporary error. (#4.3.0)