Exchange 2007 cropping headers on inbound messages   

We are noticing that after moving to Exchange 2007 from Exchange 2003 that 
2007 appears to be cropping header information instead of displaying the full 
header on inbound messages.  We are a spam fighting company with specific 
needs to see the whole header so we know where the spam is coming from.  
However these messages are forwarded to us and it appears that Exchange 2007 
is configured to show some, but not all of the header.  I've read about 
Exchange 2007 "Header Firewall" but didn't find any GUI or command line 
statements to configure it.  Any help would be greatly appreciated.  Header 
examples below:

What they look like going through Exchange 2003 (What is should look like):
____________________________________________________________________
Microsoft Mail Internet Headers Version 2.0
Received: from p02c11m082.myspamproxy.net ([208.65.144.245]) by my2003server 
over TLS secured channel with Microsoft SMTPSVC(5.0.2195.6713);
             Thu, 27 Mar 2008 18:25:46 -0600
Received: from unknown [65.54.246.138] (EHLO bay0-omc2-s2.bay0.hotmail.com)
            by p02c11m082.myspamproxy.net (mxl_mta-5.4.0-3)
            with ESMTP id 
05b3ce74.3208674224.11844.00-077.p02c11m082.myspamproxy.net (envelope-from 
);
            Thu, 27 Mar 2008 18:26:56 -0600 (MDT)
Received: from BAY0-JMR-DB01 ([10.1.194.126]) by 
bay0-omc2-s2.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
             Thu, 27 Mar 2008 17:26:56 -0700
Date: Thu, 27 Mar 08 17:26:56 -0700
From: staff@hotmail.com
Subject: complaint about message from 208.65.144.69
To: email@mycompany.com
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="9901056F-A244-4714-888A-29FEB42199B9"
Return-Path: staff@hotmail.com
Message-ID: 
X-OriginalArrivalTime: 28 Mar 2008 00:26:56.0543 (UTC) 
FILETIME=[6DEFE2F0:01C8906A]
X-Spam: 
X-MAIL-FROM: 
X-SOURCE-IP: [65.54.246.138]

--9901056F-A244-4714-888A-29FEB42199B9
Content-Type: message/rfc822
Content-Disposition: inline

X-HmXmrOriginalRecipient: mollybrown3@hotmail.com
X-Reporter-IP: 69.148.246.129
X-Message-Delivery: Vj0zLjQuMDt1cz0wO2k9MDtsPTA7YT0x
X-Message-Status: n:0
X-SID-PRA: Katherine.Davied 
X-Message-Info: 
R00BdL5giqp+ASWiiiiklVqDulyHVe4Lk4Padq669f4i8x5FNVmH0qwvY8M53EndCeg/BGdAKG3A+rZXrQ4YKzWTkSdxW8lg
Received: from p01c11o146.myspamproxy.net ([208.65.144.69]) by 
bay0-mc2-f21.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668);
             Thu, 27 Mar 2008 15:58:09 -0700
Received: from unknown [216.166.12.31]
            by p01c11o146.myspamproxy.net (mxl_mta-5.4.0-3)
            with SMTP id 
1862ce74.3031940016.6626.01-002.p01c11o146.mxlogic.net (envelope-from 
);
            Thu, 27 Mar 2008 16:58:09 -0600 (MDT)
Received: from AUSP01VMBX02.collaborationhost.net ([10.2.8.8]) by
 AUSP01MHUB01.collaborationhost.net ([10.2.8.25]) with mapi; Thu, 27 Mar 2008
 17:57:54 -0500
From: Katherine.Davied 
To: "mollybrown3@hotmail.com" 
Importance: high
Date: Thu, 27 Mar 2008 17:59:06 -0500
Subject: RE: Confirm Shopping Cart Order--Margaret Seah
Thread-Topic: Confirm Shopping Cart Order--Margaret Seah
Thread-Index: AciPv1uVnKueMjvSQlmE/4JYIdZVJgAnqFSw
Message-ID: 

In-Reply-To: 
<CHILKAT-MID-acc36c91-cb8c-48d0-8f8e-872e24d343ec@massrv.easycare.local>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Spam: [F=0.0100000000; S=0.010(2008031701)]
X-MAIL-FROM: 
X-SOURCE-IP: [(unknown)]
Return-Path: kdavied@easycareinc.com
X-OriginalArrivalTime: 27 Mar 2008 22:58:09.0627 (UTC) 
FILETIME=[06D902B0:01C8905E]


--9901056F-A244-4714-888A-29FEB42199B9--
___________________________________________________________________
What it looks like after we started sending mail through our Exchange 2007 
server:

Received: from p02c11m046.myspamproxy.net (208.65.144.245) by
 my2007server (10.30.0.50) with Microsoft SMTP Server (TLS)
 id 8.1.240.5; Tue, 1 Apr 2008 15:14:56 -0600
Received: from unknown [65.54.246.162] (EHLO bay0-omc2-s26.bay0.hotmail.com)
            by p02c11m046.mxlogic.net (mxl_mta-5.4.0-3)     with ESMTP id
 f16a2f74.3470101424.47868.00-071.p02c11m046.mxlogic.net (envelope-from
 );  Tue, 01 Apr 2008 15:16:15 -0600 (MDT)
Received: from BAY0-JMR-DB01 ([10.1.194.126]) by
 bay0-omc2-s26.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);       
  Tue, 1
 Apr 2008 14:16:14 -0700
Date: Tue, 1 Apr 2008 14:16:13 -0700
From: 
Subject: complaint about message from 208.65.144.85
To: email@mycompany.com
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="=_reb-r71B34239-t47F2A61F"
Return-Path: staff@hotmail.com
Message-ID: 
X-OriginalArrivalTime: 01 Apr 2008 21:16:14.0796 (UTC) 
FILETIME=[9E3098C0:01C8943D]
X-Processed-By: Rebuild v2.0-0
X-Spam: exempt
X-MAIL-FROM: 
X-SOURCE-IP: [65.54.246.162]
X-Auto-Response-Suppress: DR, OOF, AutoReply

As you can see, there's a whole lot of needed information missing.

Any help would be greatly appreciated!
-Rob

date: Wed, 2 Apr 2008 14:49:37 -0700   author:   rhug2000

RE: Exchange 2007 cropping headers on inbound messages   

Anyone?

"rhug2000" wrote:

> We are noticing that after moving to Exchange 2007 from Exchange 2003 that 
> 2007 appears to be cropping header information instead of displaying the full 
> header on inbound messages.  We are a spam fighting company with specific 
> needs to see the whole header so we know where the spam is coming from.  
> However these messages are forwarded to us and it appears that Exchange 2007 
> is configured to show some, but not all of the header.  I've read about 
> Exchange 2007 "Header Firewall" but didn't find any GUI or command line 
> statements to configure it.  Any help would be greatly appreciated.  Header 
> examples below:
> 
> What they look like going through Exchange 2003 (What is should look like):
> ____________________________________________________________________
> Microsoft Mail Internet Headers Version 2.0
> Received: from p02c11m082.myspamproxy.net ([208.65.144.245]) by my2003server 
> over TLS secured channel with Microsoft SMTPSVC(5.0.2195.6713);
>              Thu, 27 Mar 2008 18:25:46 -0600
> Received: from unknown [65.54.246.138] (EHLO bay0-omc2-s2.bay0.hotmail.com)
>             by p02c11m082.myspamproxy.net (mxl_mta-5.4.0-3)
>             with ESMTP id 
> 05b3ce74.3208674224.11844.00-077.p02c11m082.myspamproxy.net (envelope-from 
> );
>             Thu, 27 Mar 2008 18:26:56 -0600 (MDT)
> Received: from BAY0-JMR-DB01 ([10.1.194.126]) by 
> bay0-omc2-s2.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
>              Thu, 27 Mar 2008 17:26:56 -0700
> Date: Thu, 27 Mar 08 17:26:56 -0700
> From: staff@hotmail.com
> Subject: complaint about message from 208.65.144.69
> To: email@mycompany.com
> MIME-Version: 1.0
> Content-Type: multipart/mixed; boundary="9901056F-A244-4714-888A-29FEB42199B9"
> Return-Path: staff@hotmail.com
> Message-ID: 
> X-OriginalArrivalTime: 28 Mar 2008 00:26:56.0543 (UTC) 
> FILETIME=[6DEFE2F0:01C8906A]
> X-Spam: 
> X-MAIL-FROM: 
> X-SOURCE-IP: [65.54.246.138]
> 
> --9901056F-A244-4714-888A-29FEB42199B9
> Content-Type: message/rfc822
> Content-Disposition: inline
> 
> X-HmXmrOriginalRecipient: mollybrown3@hotmail.com
> X-Reporter-IP: 69.148.246.129
> X-Message-Delivery: Vj0zLjQuMDt1cz0wO2k9MDtsPTA7YT0x
> X-Message-Status: n:0
> X-SID-PRA: Katherine.Davied 
> X-Message-Info: 
> R00BdL5giqp+ASWiiiiklVqDulyHVe4Lk4Padq669f4i8x5FNVmH0qwvY8M53EndCeg/BGdAKG3A+rZXrQ4YKzWTkSdxW8lg
> Received: from p01c11o146.myspamproxy.net ([208.65.144.69]) by 
> bay0-mc2-f21.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668);
>              Thu, 27 Mar 2008 15:58:09 -0700
> Received: from unknown [216.166.12.31]
>             by p01c11o146.myspamproxy.net (mxl_mta-5.4.0-3)
>             with SMTP id 
> 1862ce74.3031940016.6626.01-002.p01c11o146.mxlogic.net (envelope-from 
> );
>             Thu, 27 Mar 2008 16:58:09 -0600 (MDT)
> Received: from AUSP01VMBX02.collaborationhost.net ([10.2.8.8]) by
>  AUSP01MHUB01.collaborationhost.net ([10.2.8.25]) with mapi; Thu, 27 Mar 2008
>  17:57:54 -0500
> From: Katherine.Davied 
> To: "mollybrown3@hotmail.com" 
> Importance: high
> Date: Thu, 27 Mar 2008 17:59:06 -0500
> Subject: RE: Confirm Shopping Cart Order--Margaret Seah
> Thread-Topic: Confirm Shopping Cart Order--Margaret Seah
> Thread-Index: AciPv1uVnKueMjvSQlmE/4JYIdZVJgAnqFSw
> Message-ID: 
> 
> In-Reply-To: 
> <CHILKAT-MID-acc36c91-cb8c-48d0-8f8e-872e24d343ec@massrv.easycare.local>
> Accept-Language: en-US
> Content-Language: en-US
> X-MS-Has-Attach:
> X-MS-TNEF-Correlator:
> acceptlanguage: en-US
> Content-Type: text/plain; charset="us-ascii"
> Content-Transfer-Encoding: quoted-printable
> MIME-Version: 1.0
> X-Spam: [F=0.0100000000; S=0.010(2008031701)]
> X-MAIL-FROM: 
> X-SOURCE-IP: [(unknown)]
> Return-Path: kdavied@easycareinc.com
> X-OriginalArrivalTime: 27 Mar 2008 22:58:09.0627 (UTC) 
> FILETIME=[06D902B0:01C8905E]
> 
> 
> --9901056F-A244-4714-888A-29FEB42199B9--
> ___________________________________________________________________
> What it looks like after we started sending mail through our Exchange 2007 
> server:
> 
> Received: from p02c11m046.myspamproxy.net (208.65.144.245) by
>  my2007server (10.30.0.50) with Microsoft SMTP Server (TLS)
>  id 8.1.240.5; Tue, 1 Apr 2008 15:14:56 -0600
> Received: from unknown [65.54.246.162] (EHLO bay0-omc2-s26.bay0.hotmail.com)
>             by p02c11m046.mxlogic.net (mxl_mta-5.4.0-3)     with ESMTP id
>  f16a2f74.3470101424.47868.00-071.p02c11m046.mxlogic.net (envelope-from
>  );  Tue, 01 Apr 2008 15:16:15 -0600 (MDT)
> Received: from BAY0-JMR-DB01 ([10.1.194.126]) by
>  bay0-omc2-s26.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);       
>   Tue, 1
>  Apr 2008 14:16:14 -0700
> Date: Tue, 1 Apr 2008 14:16:13 -0700
> From: 
> Subject: complaint about message from 208.65.144.85
> To: email@mycompany.com
> MIME-Version: 1.0
> Content-Type: multipart/mixed; boundary="=_reb-r71B34239-t47F2A61F"
> Return-Path: staff@hotmail.com
> Message-ID: 
> X-OriginalArrivalTime: 01 Apr 2008 21:16:14.0796 (UTC) 
> FILETIME=[9E3098C0:01C8943D]
> X-Processed-By: Rebuild v2.0-0
> X-Spam: exempt
> X-MAIL-FROM: 
> X-SOURCE-IP: [65.54.246.162]
> X-Auto-Response-Suppress: DR, OOF, AutoReply
> 
> As you can see, there's a whole lot of needed information missing.
> 
> Any help would be greatly appreciated!
> -Rob

date: Mon, 7 Apr 2008 09:41:01 -0700   author:   rhug2000