I would guess that the Resent-From header is causing the problem. If you can determine that the Resent-From address for a given subscriber is the same on every message, I would take Rich's advice: add that address as a subscriber and set it to NOMAIL. -- Paul Russell, Senior Systems Administrator OIT Messaging Services Team University of Notre Dame [log in to unmask] On 2/26/2009 5:35 PM, Randy Klumph wrote: > This is from one sent directly to me... > > Return-path: <[log in to unmask]> > Received: from cougar.WOU.EDU ([140.211.127.100]) > by sundown.wou.edu (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 > 2007)) with ESMTPS id <[log in to unmask]> for > [log in to unmask]; Wed, 25 Feb 2009 14:00:07 -0800 (PST) > Received: from scarface.wou.edu (scarface.wou.edu [140.211.127.107]) > by cougar.WOU.EDU (8.14.2/8.14.2) with ESMTP id n1PLxwrR006004 for > <[log in to unmask]>; Wed, 25 Feb 2009 14:00:02 -0800 > Received: from scarface.wou.edu (localhost.localdomain [127.0.0.1]) > by localhost (Email Security Appliance) with SMTP id C07A58512AE_9A5C01FB for > <[log in to unmask]>; Wed, 25 Feb 2009 22:03:11 +0000 (GMT) > Received: from sniper25.usinternet.com > (sniper25a.usinternet.com [216.17.3.247]) by scarface.wou.edu > (Sophos Email Appliance) with ESMTP id 59F308512A0_9A5C01FF for > <[log in to unmask]>; Wed, 25 Feb 2009 22:03:11 +0000 (GMT) > Received: from smtp-out-02.usinternet.com. (216.17.3.61) > by sniper25.usinternet.com (Securence); Wed, 25 Feb 2009 15:59:55 -0600 (CST) > Received: from localhost (localhost [127.0.0.1]) by smtp-out-02.usinternet.com > (Postfix) with ESMTP id 5DBF12327D for <[log in to unmask]>; Wed, > 25 Feb 2009 15:59:58 -0600 (CST) > Received: from smtp-out-02.usinternet.com ([127.0.0.1]) > by localhost (smtp-out-02.usinternet.com [127.0.0.1]) > (amavisd-new, port 10024) with ESMTP id 04576-03 for <[log in to unmask]>; Wed, > 25 Feb 2009 15:59:58 -0600 (CST) > Received: from SONY (206-55-189-204.usiwireless.com [206.55.189.204]) > by smtp-out-02.usinternet.com (Postfix) with ESMTP id 3A0AC23275 for > <[log in to unmask]>; Wed, 25 Feb 2009 15:59:52 -0600 (CST) > Date: Wed, 25 Feb 2009 15:59:53 -0600 > Resent-from: [log in to unmask] > From: Leslie Peterson <[log in to unmask]> > Subject: RE: PLS CK DBM?? Re: My emails can not access DBM > In-reply-to: <[log in to unmask]> > To: 'Randy Klumph' <[log in to unmask]> > Resent-message-id: <[log in to unmask]> > Message-id: <78726E959B33403EBE46147227211C16@SONY> > MIME-version: 1.0 > X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 > X-Mailer: Microsoft Outlook, Build 10.0.6838 > Content-type: text/plain; charset=US-ASCII > Content-transfer-encoding: 7bit > Importance: Normal > X-Priority: 3 (Normal) > X-MSMail-priority: Normal > Thread-index: AcmWCB3D5GkLmBcES0Opw3Zc8cRhfQBisMNg > X-Virus-Scanned: amavisd-new at usinternet.com > X-Securence-ID: 1235599195582-025-007602 > X-Securence-Country-Code: US - UNITED STATES > X-Securence-odset: main.outbound.usinternet.com > X-Securence-RFC2821-MAIL-FROM: [log in to unmask] > X-Securence-RFC2821-RCPT-TO: [log in to unmask] > X-Securence-REMOTE-HOST: smtp-out-02.usinternet.com. > X-Securence-REMOTE-ADDR: 216.17.3.61 > X-Securence-Orig-To-Header: To: "'Randy Klumph'" <[log in to unmask]> > X-Securence-pp1t: 8 > X-Securence-trat: 96 > X-Securence-omc: 0 > X-Securence-tsist: 104 > X-Securence-urt: 73 > X-Securence-art: 0 > X-Securence-drt: 177 > X-Securence-Info: > d-116;otrpq-0;otrp-1;opp1q-102;opp1-1;osrbq-3;osrb-0;ous1q-0;ous1-84;ovxrq-102;ovxr-44;oclmq-60;oclm-104;ovrcq-23;ovrc-0;ophcq-88;ophc-0;isdq-100;isd-0;vacq-105;vac-0;fsdq-19;fsd-2;dddq-101;ddd-0;cldq-95;cld-3;lrdq-106;lrd-1;dspq-62;dsp-0;ddrq-19;ddr-3;dmqq-2;s-956;t-1072 > X-Sophos-ESA: [scarface.wou.edu] 3.0.6.0, Antispam-Engine: 2.6.1.350677, > Antispam-Data: 2009.2.25.214330 > Original-recipient: rfc822;[log in to unmask] > > > > ----- Original Message ----- > From: Jacob Haller <[log in to unmask]> > >> Hmm, this seems strange. Can you share the full headers from a >> message that has gone through Securence? >