@Obsolesce said in Office 365 NDR for strange email address.: Azure AD > Monitoring > Sign-ins: to track unauthorized access to accounts. There's no telling what all they did, so it may be best to back up the data and recreate the account... and of course enable 2FA/MFA on ALL accounts. This is a good idea. You can also set alerts to be notified if forwarding rules are created like the ones you discovered.

@Emad-R said in Researching Mailing List Email Server Options: So you dont want the SMTP server part, just the sending to many and if a user opt to be removed that will auto reflect ... Either way. If we handle the SMTP that's fine. If we don't, that's fine.

@IRJ said in Email investigation - have we been hacked?: @Dashrender said in Email investigation - have we been hacked?: one of the addresses is for an @ameritrade.com address, but only for one person. I have yet to find any connection via google searches between this person and ameritrade.... so I'm not sure why this was tried? Thoughts? You dont have that data either, right? What do you mean?

@Dashrender Confirmed, our MailCow is using ActiveSync to my phone, works beautifully.

@Pete-S said in MailCow Command Line Reference: @scottalanmiller said in MailCow Command Line Reference: @Dashrender said in MailCow Command Line Reference: @Pete-S said in MailCow Command Line Reference: If you don't intend to use the webinterface then what purpose does mailcow have? You could just install dovecot, postfix etc for email and sogo for calendar and have the same thing without the middle man. I bet you have to tweak config files even with mailcow. I'm assuming Scott is asking about management stuff - he wants to script that stuff, not GUI manage it. Right. GUI is fine for low capacity sites. But we are looking at two use cases both in the 10K+ range. But mailcow doesn't add any functionality that the original packages don't already have. It's just a wrapper. Is it not? Mostly. But it is handling the testing and integration of the components, which is the hard bit. It's actually doing a fair amount of work. I've built an extremely similar system in the past and the effort was quite large for just the "wrapper" bits that they are doing And the central API is a huge deal.

@wrx7m said in Exchange 2016 - NDR: @scottalanmiller said in Exchange 2016 - NDR: @Natchos said in Exchange 2016 - NDR: @JasGot Awesome, thanks for the input. I'll look into SPF. SPF is considered a requirement these days. And DKIM is heavily recommended. People are starting to come around. I have been using DKIM for a few years for all services sending email outside our org. With O365, SPF and DKIM are part of the setup. Same with Zoho.

We are going back to Mandrill, as we already are using Mailchimp.

@Kelly said in This doesn't sound right - 3rd-Party "Deduction Management Firm": It hasn't gone into effect, but as of 1/1/20 you will be operating under this law: https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375. Thanks. At this point, it is only companies that this request would apply to.

@pattonb said in DNS PTR Record with 2 FQDN Entries with SPAM Check: @JaredBusch incorrect, Scott has summarized succinctly That is what you asked. But going with that is not what you actually wanted, then the answer to your original post is that you don't fix anything. You whitelist the domain in question and move on. The sender's ISP is in charge of setting the PTR record and there is not a damned thing you can do about it.

@flaxking said in Outlook SMTP Non-Compliant Sender Address: Hmm, I just got the same when testing using telnet 550 5.7.1 Non-Compliant sender address. Code : -4 Oh, good info! Thanks.

@wrx7m said in Sales Person Wants Me to Provide Independent Rep With an Email Account: @scottalanmiller said in Sales Person Wants Me to Provide Independent Rep With an Email Account: My second thought is, if having an email account creates a security concern, it is not creating the account that creates the problem, it simply exposes an existing security problem. Not necessarily security, but accessing features like SFB, OD and Teams. But, as Kelly mentioned, they have Exchange Online P1, which doesn't have any of the other services (different than E1.) Right, i was assuming that they'd only get email. Even those other things, though, still have security. but no reason to think that you'd provision those, too.

@scottalanmiller said in Get Active User Login Count from Dovecot: cat /var/log/maillog | grep pop3-login:\ Login | sed -e 's/.Login: user=<(.)>, method=.*/\1/g' | sort | uniq | wc -l This tiny variation will get you all logins from all logs that you have stored. cat /var/log/maillog* | grep pop3-login:\ Login | sed -e 's/.*Login: user=<\(.*\)>, method=.*/\1/g' | sort | uniq | wc -l

can we get some tags added to this? o365 scan2email receiveconnector

I know SFB accesses the ost file.

@wrx7m said in Office 365 User Quarantine - How Do You Access After Redesign?: @dbeato said in Office 365 User Quarantine - How Do You Access After Redesign?: @wrx7m I have not found a way to do so, you can create a folder in Outlook to manage it from there. Example here http://www.expta.com/2015/02/how-to-add-access-to-office-365-eop.html Have you done this? The link that includes admin seems like it would try to access the admin portion, not the specific user's quarantine. If this works as I need, I wonder if there is a policy to set this up, or if it would be a manual, one-by-one endeavor. I have not but I can test.

@Dashrender said in MailCow in Production Datacenter: Question for Scott - the customer wanted self hosted email? why? It's a commercial mail hosting business. Among other things.

@JaredBusch said in Email server options: @Dashrender said in Email server options: This comparison misses taking it beyond year 5. Why take it beyond 5 years? Because if it is on premises, it will need to be upgraded again. @Dashrender said in Email server options: If you add SA to the original licenses - because you know the plan is the keep using Exchange going forward - it will raise the costs noticeably in the beginning, but come renewal time it will make it significantly less. Less enough to be under O365? not likely, hell, even the 5 year plan would be more expensive for onprem vs O365... but it might lower itself over time because of the SA difference. SA is a scam to get more money. Always has been for the SMB. With negotiated pricing for Enterprise, it is the right thing. If you're a company that only upgrades once every 10 years - then yeah... SA is a waste of money, but you're already talking about upgrading again in 5 years, so SA could very much make financial sense - show me the numbers before you poo poo it.

@zachary715 said in Does Anyone Actually Use Conversation View Intentionally for Email: All of my folders are subfolders of my Inbox, so although my Inbox itself is kept clean, I can easily search my Inbox and it searches the entirety of all subfolders. CV doesn't make this any more or less complicated. Me, too. But every system handles broken up threads like that differently.

@360col said in Why Do Email Readers Always Default to Oldest Email First: @scottalanmiller said in Why Do Email Readers Always Default to Oldest Email First: ability to search well in a large volume of emails Thunderbird does this very well. Its whats I used for my private email accounts. Me too. I don't use it day to day, but when I have a search problem, I fire it up.

@justin867 said in how to check this exchange email issue?: One user keeps on complaining that the email message she sent was not received by the intended receiver? how to check the issue? We are using exchange 2010. Message tracing in ECP.

@Osvaldo said in Email not showing in Outlook, but Have Been Delivered?: yes, it is intermedia If it is on Intermedia, check the Admin quarantine https://kb.intermedia.net/article/36031 Also use Email tracking https://kb.intermedia.net/article/38036

@dbeato said in Zimbra 8.8.12 Released: @scottalanmiller said in Zimbra 8.8.12 Released: Wow, They release Open Drive and it only works up to NextCloud 13? NextCloud 16 is in RC today. What the heck? Yeah, that is weird. Behind the times. My level of impressed keeps slipping.

https://tools.ietf.org/html/rfc5322#section-3.6.2 Originator Fields The originator fields of a message consist of the from field, the sender field (when applicable), and optionally the reply-to field. The from field consists of the field name "From" and a comma- separated list of one or more mailbox specifications. If the from field contains more than one mailbox specification in the mailbox- list, then the sender field, containing the field name "Sender" and a single mailbox specification, MUST appear in the message. In either case, an optional reply-to field MAY also be included, which contains the field name "Reply-To" and a comma-separated list of one or more addresses. from = "From:" mailbox-list CRLF sender = "Sender:" mailbox CRLF reply-to = "Reply-To:" address-list CRLF The originator fields indicate the mailbox(es) of the source of the message. The "From:" field specifies the author(s) of the message, that is, the mailbox(es) of the person(s) or system(s) responsible for the writing of the message. The "Sender:" field specifies the mailbox of the agent responsible for the actual transmission of the message. For example, if a secretary were to send a message for another person, the mailbox of the secretary would appear in the "Sender:" field and the mailbox of the actual author would appear in the "From:" field. If the originator of the message can be indicated by a single mailbox and the author and transmitter are identical, the "Sender:" field SHOULD NOT be used. Otherwise, both fields SHOULD appear. Note: The transmitter information is always present. The absence of the "Sender:" field is sometimes mistakenly taken to mean that the agent responsible for transmission of the message has not been specified. This absence merely means that the transmitter is identical to the author and is therefore not redundantly placed into the "Sender:" field. The originator fields also provide the information required when replying to a message. When the "Reply-To:" field is present, it indicates the address(es) to which the author of the message suggests that replies be sent. In the absence of the "Reply-To:" field, replies SHOULD by default be sent to the mailbox(es) specified in the "From:" field unless otherwise specified by the person composing the reply. In all cases, the "From:" field SHOULD NOT contain any mailbox that does not belong to the author(s) of the message. See also section 3.6.3 for more information on forming the destination addresses for a reply.

@dbeato said in Office 365 Moving Emails to Deleted Items: @dafyre said in Office 365 Moving Emails to Deleted Items: @dbeato said in Office 365 Moving Emails to Deleted Items: @dafyre said in Office 365 Moving Emails to Deleted Items: e got a strange one... I have a user here whose Emails go from whatever folder they are in to the Deleted Items folder after being read... Sometimes. Sometimes it doesn't happen for several minutes, and other times it happens right away. The user hasn't been phished that we can tell. No bogus rules in Outlook forwarding things to the deleted items. Check both Web and Outlook 2016. What am I not looking at that could be causing this? They got hacked though https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/ https://docs.microsoft.com/en-us/office365/securitycompliance/responding-to-a-compromised-email-account Sometimes the rule is a dot on the name.... I am assuming it's a hacked account, but we changed the password to a new one. I disconnected all of her sessions from Office 365. Still happening. I see no rules with a dot in the name... or spaces or foreign characters. I see exactly the number of rules on my CLI as I do in Outlook and OWA. Can you clear them all ? Take a screenshot of the settings and then remove them and see what changes. The rules run autonomously and is not someone running them. That's what we've done now. All of the rules are disabled. End-user is turning them back on one at a time now.