{"id":2054,"date":"2018-09-07T11:59:48","date_gmt":"2018-09-07T15:59:48","guid":{"rendered":"http:\/\/www.exchangedefender.com\/blog\/?p=2054"},"modified":"2018-09-07T12:00:35","modified_gmt":"2018-09-07T16:00:35","slug":"exchangedefender-smtp-headers","status":"publish","type":"post","link":"https:\/\/www.exchangedefender.com\/blog\/2018\/09\/exchangedefender-smtp-headers\/","title":{"rendered":"ExchangeDefender SMTP Headers"},"content":{"rendered":"

ExchangeDefender mail flow and email analysis troubleshooting is at times a long and difficult process that has been automated through our admin portal at\u00a0 https:\/\/admin.exchangedefender.com<\/strong><\/a>. We realize that it’s not an option for some of our end users and new MSPs<\/strong> so we often get tickets in our support portal asking us why a certain message got delayed, rejected, classified as SPAM or allowed to get through if it had SPAM content, etc.<\/p>\n

In order to troubleshoot an issue with a specific message we always ask for SMTP<\/strong> headers. The following blog post will help you find them in Outlook Web App, Outlook 2013 and Outlook 2016.<\/p>\n

Outlook Web App<\/h3>\n

From the message listing, right click on the message and select “View Message Details”:<\/strong>
\n\"\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

You will see Message details screen. Copy and paste it in the ticket and we can help you with the rest.<\/strong><\/p>\n

\"\"<\/a><\/p>\n

<\/h3>\n

<\/h3>\n

<\/h3>\n

<\/h3>\n

<\/h3>\n

<\/h3>\n

<\/h3>\n

<\/h3>\n

<\/h3>\n

<\/h3>\n

<\/h3>\n

<\/h3>\n

<\/h3>\n

<\/h3>\n

<\/h3>\n

<\/h3>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

Outlook 2013 \/ Outlook 2016<\/strong><\/h3>\n

From the message listing double click on the message so it pops up in it’s own Outlook window.<\/strong><\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

Then click on File and you will be shown the message file options:<\/strong><\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

Click on Properties and you will see the SMTP headers. Copy and paste it in the ticket and we can help you with the rest.<\/strong><\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

<\/h3>\n

<\/h3>\n

<\/h3>\n

<\/h3>\n

<\/h3>\n

<\/h3>\n

<\/h3>\n

<\/h3>\n

<\/h3>\n

<\/h3>\n

<\/h3>\n

<\/h3>\n

<\/h3>\n

 <\/p>\n

 <\/p>\n

Important: Please copy and paste the contents of the screen into our support ticket instead of taking a screenshot. Sometimes the SMTP headers contain characters that are very similar (qf9mfIlI1IlI) and it can take a lot longer to locate the message rather than having a specific text search.<\/strong><\/p>\n

What happens next is that our team is able to locate the specific message in our database and then with that data do further analysis using the node that processed the message and look at all the logs generated by hundreds of different services that are analyzing every message for dangerous content.<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

[…]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,48],"tags":[98,100,99,26,40],"class_list":["post-2054","post","type-post","status-publish","format-standard","hentry","category-exchangedefender","category-security","tag-deployment","tag-guide","tag-how-to","tag-outlook","tag-security"],"_links":{"self":[{"href":"https:\/\/www.exchangedefender.com\/blog\/wp-json\/wp\/v2\/posts\/2054","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.exchangedefender.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.exchangedefender.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.exchangedefender.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.exchangedefender.com\/blog\/wp-json\/wp\/v2\/comments?post=2054"}],"version-history":[{"count":39,"href":"https:\/\/www.exchangedefender.com\/blog\/wp-json\/wp\/v2\/posts\/2054\/revisions"}],"predecessor-version":[{"id":2098,"href":"https:\/\/www.exchangedefender.com\/blog\/wp-json\/wp\/v2\/posts\/2054\/revisions\/2098"}],"wp:attachment":[{"href":"https:\/\/www.exchangedefender.com\/blog\/wp-json\/wp\/v2\/media?parent=2054"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.exchangedefender.com\/blog\/wp-json\/wp\/v2\/categories?post=2054"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.exchangedefender.com\/blog\/wp-json\/wp\/v2\/tags?post=2054"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}