Exchange 2000 lost X-Tag in header informations   

We are migrating our multi-sites organisation from Exch 5.5 to Exchange 2000
and are experimenting a problem with the way Exch 2000 is handling some
external smtp messages received across our current Exch 5.5 bridgehead.

Setup:

smtp antispam relay ---> SMTP AV Gateway ---> Exch 5.5 IMC ----> Exch 5.5
mailboxes and Exch 2000 mailboxes

The smtp antispam server job is to evaluate each e-mail for it's < spam
level > and block everything above some level (150) and put an X-Tag in the
header of the other msg with the level it calculate. The tag is X-pstn-spam

A custom filter in Outlook 2002 will look for those TAG and if found,
transfert the e-mail to a spam folder where the end user select what is good
or not.

The Exch 5.5. Bridgehead transfert smtp messages to both Exch 5.5 mailboxes
on a second server and to Exch 2000 mailboxes on a third server. The
bridgehead is also used for journaling all e-mail coming from/going across
the IMC connector.

Since the start of the migration from mailboxes from 5.5 to 2000, we have
started receiving complaints from some end users migrated to Exch 2000 about
a high level of spam not catch by our custom rule in Outlook 2002. Not all
users seem to have the problem.

What we can see is that Exch 2000 seem to rewrite the SMTP Header of some
e-mail and drop part of the header, including our X-Tag. Here is the header
of the same message, as seen in the Exch 5.5 Journaling mailbox and in my
Exch 2000 Mailbox. The missing X-tag is X-pstn-spam

The Exchange 2000 server is at level SP3 with the August 2004 Rollup Post
SP3 (870540) and patch 894549 and 883914. It is running on W2K adv, SP4 with
all security fixes.

Why is the Microsoft Mail Internet Headers Version 2.0 active some of the
time?



Exchange 5.5 Header:

Received: from sdns50001p.loto-quebec.com. (alpha.loto-quebec.com

[192.197.135.2]) by smai50001p.le500.loto-quebec.com with SMTP (Microsoft
Exchange Internet Mail Service Version 5.5.2658.3) id J2SA2122; Tue, 24 May
2005 04:54:55 -0400

Received: from smtp2.loto-quebec.com ([IP=192.197.135.59]) by eSafe SMTP
Relay 1116771897; Tue May 24 04:54:54 2005

Received: from ([222.116.58.192]) by smtp2.loto-quebec.com with SMTP id
KP-KY922.13986118; Tue, 24 May 2005 04:54:08 -0400

Received: from vU0q@localhost by Z4j9.int (8.11.6/8.11.6); Tue, 24 May 2005
10:56:42 +0100

Message-ID: 

From: "Ingrid Odom" 

Reply-To: "Ingrid Odom" 

To: daniel.bourque@loto-quebec.com

Subject: Photoshop CS 8.0 $59.95 Win XP

Date: Tue, 24 May 2005 03:53:42 -0600

MIME-Version: 1.0

X-MimeOLE: Produced By Microsoft MimeOLE V4.71.2730.2

X-Sender: WinnieHagan@apello.co.uk

Content-Type: multipart/mixed;

boundary="--EuIPn6WNn6AXZm9VgE"

X-esp: ESP<107>=RBL:<15> RDNS:<5> SHA:<4> UHA:<0> SLS:<20>
BAYES:<47>SenderID:<0> CAN-SPAM Compliance Dictionary
(TRU7a):<0>NigeriaScamDictionary (TRU7a):<0> Obscenities
Dictionary(TRU7a):<0> Spam Dictionary (TRU7a):<0> Porn Dictionary(TRU7a):<0>
Embed HTML Dictionary

(TRU7a):<0> URL Dictionary(TRU7a):<0> HTML Dictionary (TRU7a):<16>

X-pstn-spam

zEFX

----EuIPn6WNn6AXZm9VgE

Content-Type: text/html;

Content-Transfer-Encoding: quoted-printable

----EuIPn6WNn6AXZm9VgE--









Exchange 2000 Header:

Microsoft Mail Internet Headers Version 2.0

Received: from sdns50001p.loto-quebec.com. (alpha.loto-quebec.com

[192.197.135.2]) by smai50001p.le500.loto-quebec.com with SMTP (Microsoft
Exchange Internet Mail Service Version 5.5.2658.3) id J2SA2122; Tue, 24 May
2005 04:54:55 -0400

Received: from smtp2.loto-quebec.com ([IP=192.197.135.59]) by eSafe SMTP
Relay 1116771897; Tue May 24 04:54:54 2005

Received: from ([222.116.58.192]) by smtp2.loto-quebec.com with SMTP id
KP-KY922.13986118; Tue, 24 May 2005 04:54:08 -0400

Received: from vU0q@localhost by Z4j9.int (8.11.6/8.11.6); Tue, 24 May 2005
10:56:42 +0100

X-MimeOLE: Produced By Microsoft Exchange V6.0.6603.0

x-esp: ESP<107>=RBL:<15> RDNS:<5> SHA:<4> UHA:<0> SLS:<20>
BAYES:<47>SenderID:<0> CAN-SPAM Compliance Dictionary
(TRU7a):<0>NigeriaScamDictionary (TRU7a):<0> Obscenities
Dictionary(TRU7a):<0> Spam Dictionary (TRU7a):<0> Porn Dictionary(TRU7a):<0>
Embed HTML Dictionary (TRU7a):<0> URL Dictionary(TRU7a):<0> HTML Dictionary
(TRU7a):<16>

MIME-Version: 1.0

Content-Type: application/ms-tnef;

name="winmail.dat"

Content-Transfer-Encoding: binary

x-sender: WinnieHagan@apello.co.uk

content-class: urn:content-classes:message

Subject: Photoshop CS 8.0 $59.95 Win XP

Date: Tue, 24 May 2005 05:53:42 -0400

Message-ID: 

X-MS-Has-Attach:

X-MS-TNEF-Correlator: 

Thread-Topic: Photoshop CS 8.0 $59.95 Win XP

Thread-Index: AcVgPkGiDWykzMJqTWi6aOwfgIqluw==

From: "Ingrid Odom" 

To: 

Reply-To: "Ingrid Odom" WinnieHagan@apello.co.uk

date: Thu, 26 May 2005 23:12:55 -0400   author:   Daniel Bourque