Journal Envelope Header malformation

Question

Overview
•     My company has Designed and Implemented an Journal Archive and Discovery Solution for a University.
The solution provides Journal Archive and Discovery for approximately 22,000 users.
Approximately 15,000 University users /students are using Sun Mail Messaging , that BCC’s every message to an Exchange 2007 Journal Mailbox.
Journal Archive Solution , will then Journal Archive the Sun Mail message from the Exchange 2007 Journal Mailbox.
Problem Description - Sun Mail Messages Journaled by Exchange 2007 are unable to be Journal Archived by Archiving Software
•     Sun mail has a feature to enable Microsoft like journaling. The message looks quite similar to exchange 2003 journaling when it arrives in a Exchange mailbox ( the message gets into the exchange mailbox via SMTP).
•     The internal recipients (mailboxes that have mailboxes on the Sun mail system) have the recipients email address as userid@ims-ms-daemon e.g
Sender: <[email protected]>
Message-id: <[email protected]>
Recipients:
<jbrown@ims-ms-daemon>
<jdoe@ims-ms-daemon>
<jshaw@ims-ms-daemon>
<jsmith@ims-ms-daemon>
<[email protected]>
•     All the sender & recipient addresses were not preceded by smtp
•     Archiving Software Journal Archive, requires an Exchange 2007 Journal Message Report field/header to be , Message-ID
KB Article that outlines the required Header.
http://technet.microsoft.com/en-us/library/bb331962(EXCHG.80).aspx
•     Currently the Exchange 2007 Message Report Field/Header and the Sunmail message recipient address fields are incorrect and therefore cannot be archived by Archiving software.
Current Workaround
•     Manually Modified the current Sun Mail message format and recipient address fields , using the following process , and then the Sun Mail messages were archived successfully:
Using Outlookspy the message was modified with the following changes, and EV was then able to process the message as an envelope Journal message and the results were exactly similar to how an exchange 2003 Envelope journal message is archived.
1.     Add PR_CONTENT_IDENTIFIER_W Tag number:0x0008001F Type:PT_UNICODE Value:ExJournalReport
2.     Change the Message-id: [email protected] to Message-ID: [email protected]
3.     Replace ims-ms-daemon with xxxxx.edu (our internal mail domain)
Sender: <[email protected]>
Message-id: <[email protected]>
Recipients:
<[email protected] >
<[email protected] >
<[email protected] >
<[email protected] >
<[email protected]>
Original message body     Modified message body
Sender: <[email protected]>
Message-id: <[email protected]>
Recipients:
<jbrown@ims-ms-daemon>
<jdoe@ims-ms-daemon>
<jshaw@ims-ms-daemon>
<jsmith@ims-ms-daemon>
<[email protected]>
Sender: <[email protected]>
Message-Id: <[email protected]>
Recipients:
<[email protected] >
<[email protected] >
<[email protected] >
<[email protected] >
<[email protected]>
Actions Taken
•     Conducted a meeting with Archiving Software Vendor Technical Product Management to discuss the problem , analyze root cause and determine action plan.
Response
• Journal Archive Solution is designed to archive messages that are eligible for archiving .
•     The Current Exchange 2007 Journal format of Sun Mail messages is not eligible for archiving.
•     Archiving Software is not designed to alter Exchange 2007 Message format.
Root Cause
•     Something is happening during the routing / redirection of the Sun Mail message to Exchange 2003 and then to the Exchange 2007 Journal Mailbox that is malforming the message format and spoofing Exchange 2007 to accept the Sun mail message format.
Suggested Action Plan
•     Follow the Sun Mail message flow, through the entire routing / redirection process , from Sun Mail to Exchange 2003 and then to the Exchange 2007 Journal Mailbox .
•     Determine where and when the message is malformed in this process , and correct the problem .
***Important note on flow of mail, Sun uses SIEVE REDIRECT to send copy of messages to Exchange 2003 server, Exchange 2003 forwards to Exchange 2007, where archiving is than done from the journal folder.***
SIEVE REDIRECT looks like this:
#BEGINFILTER
if anyof(true){
keep;
redirect "[email protected]";
stop;
#ENDFILTERDO you have any idea where header malformation can be happening and how to prevent it?

Answer 1

DamnGoodSE wrote:
&#149;     The internal recipients (mailboxes that have mailboxes on the Sun mail system) have the recipients email address as userid@ims-ms-daemon e.g
Sender: <[email protected]>
Message-id: <[email protected]>
Recipients:
<jbrown@ims-ms-daemon>
<jdoe@ims-ms-daemon>
<jshaw@ims-ms-daemon>
<jsmith@ims-ms-daemon>
<[email protected]>
The Exchange format journal information is telling you which recipients received the email. A users email address may change over time or the email could have been forwarded to another account on the same system, so sending an email to "[email protected]" doesn't mean the user jbrown was the end recipient.
Equally, recording the initial submission address doesn't tell you who received the email. A mailing list address doesn't tell you who received the email as mailing lists change over time.
A possible enhancement to the journal format is to provide the "initial" submission address/forwarded address fields.
&#149;     All the sender & recipient addresses were not preceded by smtpThe examples provided in the KB article you point to below don't have sender/recipient addresses preceded by "smtp:".
&#149;     Archiving Software Journal Archive, requires an Exchange 2007 Journal Message Report field/header to be , Message-ID
KB Article that outlines the required Header.
http://technet.microsoft.com/en-us/library/bb331962(EXCHG.80).aspx
I see nothing in that document to say that the header name is case sensitive i.e. "Message-ID" is not the same as "Message-id". In fact, the "Journal report that displays basic recipient fields" example use "Message-Id:"
&#149;     Currently the Exchange 2007 Message Report Field/Header and the Sunmail message recipient address fields are incorrect and therefore cannot be archived by Archiving software.The information is not incorrect. It may not be in the format/case your particular "Archiving Software" expects however that doesn't mean they are wrong.
DO you have any idea where header malformation can be happening and how to prevent it?I see no evidence of "header malformation".
Regards,
Shane.