Office365 hosted email always reports to the same place

[jdseymour 0]

This has been a problem for me for months now - possibly every since we switched our mail hosting to Office 365.

Every time I report a spam that came through Office 365, Spamcop identifies an IPv6 address as the source and wants to send the report to "report_spam@hotmail.com".  I've seen other reports on this forum about similar problems.

As far as I can tell, my mailhost is set up properly.

Is there a workaround or solution to this problem?

Thanks.

[Lking 0]

A tracking URL would help others see the problem and what the parser is doing with your submission.

[jdseymour 0]

Here's a report from a couple months ago that shows the problem:

https://www.spamcop.net/mcgi?action=gettrack&reportid=6804849594

 

[Lking 0]

Unfortunately that is a spam Report id not a Tracking URL The rest of us can not see the data. Tracking URL should look like:

Quote

SpamCop v 4.9.0 © 2018 Cisco Systems, Inc. All rights reserved.
Here is your TRACKING URL - it may be saved for future reference:
https://www.spamcop.net/sc?id=z6460902591ze58866bb7d3b017ceab1bc1dc060e36az

 

[jdseymour 0]

Sorry.  I mistakenly assumed I'd need to submit a report in order to get a tracking URL - and I didn't want to do that since it'd go to the wrong place...

Here's a new tracking URL from one of this morning's spam messages:

https://www.spamcop.net/sc?id=z6467687408z7a4c3f67b7bdfa3058acf6e24fcf17f1z

 

[Dave_L 0]

Do you have Mailhosts configured?

https://www.spamcop.net/fom-serve/cache/397.html

[jdseymour 0]

Yes, I have mailhosts configured.  The relevant one shows in my list as "Hotmail/MSN".

When I first discovered this problem, I deleted that configuration and re-created it.  But the problem remained.

 

[Dave_L 0]

I now see that you mentioned Mailhosts in your original post. Sorry 😳

[jdseymour 0]

For those playing along at home...

I found a workaround to this issue - though it's not 100% kosher.

If I trim out the two or three "Received" lines at the top of these messages, Spamcop will parse it properly.

The problem appears to be that Microsoft adds some Received lines with IPv6 headers - but the chain doesn't add up.  Specifically, in a message received this morning, the Received lines show the following paths:

Quote

MWHPR14MB1597.namprd14.prod.outlook.com (2603:10b6:300:ae::25) -> CY4PR14MB1590.namprd14.prod.outlook.com
CY1PR14CA0018.namprd14.prod.outlook.com (2a01:111:e400:5282::28) -> MWHPR14MB1597.namprd14.prod.outlook.com (2603:10b6:300:b4::23)
CO1NAM03FT006.eop-NAM03.prod.protection.outlook.com (2a01:111:f400:7e48::208) -> CY1PR14CA0018.outlook.office365.com (2a01:111:e400:5282::28)
edm.speechuuspeech.info (150.109.43.48) -> CO1NAM03FT006.mail.protection.outlook.com (10.152.80.75)

 

As you can see, the top line doesn't have an IP address and doesn't link with the second line.  If I trim just the one line out, though, it still fails and wants to report to hotmail.  I need to trim the first two (or three) lines to get a good parse.