NULL messages in held mail???

[craigt]

I've been getting NULL messages in my held mail file for a couple of weeks now -- normally only 1 or 2 per day but fairly consistent. Example of one from just now:

=======================================================================

Previewing raw email. Use your browser's back button to return to menu.

=======================================================================

error:Cannot find 16647

Any relation to the other email problems appearing lately?

[agsteele]

Not sure this is a reporting issue (more appropriately a SC Mail issue) but you'll need to provide a tracking URL so we have a better idea of what MAY be happening.

Andrew

[craigt]

...provide a tracking URL...

Unfortunately since the mail system can't find the message the ones that I have ticked off to send for reporting don't generate any report (there is a placeholder and a report number but accompanied only with a "no reports files" message and no link).

[Farelf]

Craig, if you search the forum for "error:Cannot find" you will find previous discussions and any resolutions. Quick check, vague recollections, it may be something to do with "missing body" or otherwise malformed spam. Apparently it can still be forwarded but will usually result in parsing errors. Missing body's no great problem (you're allowed to add "no body" as a dummy body and submit via web page if you really want to report) but some of the other malformations can be killers.

If it is "killer" malformed spam, it generally goes away after a short while (maybe just one individual spammer, even more than usually unsuccessful) - these things have their own life cycle and they're generally not very long.

[craigt]

Thanks for the responses but I guess I didn't elaborate quite enough on why I was posting. I'm not having a problem with these NULL messages but thought I'd let the powers that be know that there may be a problem with the mail system. Since I don't know the internal interactions of the mail and reporting systems I thought that this issue could have some bearing on the recent mail submission issues.

What is occurring is receipt of something via my spamcop box that winds up in the held mail folder -- what I see on the held mail page is (note the empty "()" indicating that there really isn't anything to preview):

[16668] ( Preview )

()

If I click on the "Preview" link I wind up with:

=======================================================================

Previewing raw email. Use your browser's back button to return to menu.

=======================================================================

error:Cannot find 16668

And if I click the button to report this I wind up with the following in the "Past Reports" list:

Submitted: Monday, August 23, 2010 7:54:49 AM -0700:

No reports filed

So apparently what is listed as my spam # 16668 is NULL and doesn't contain anything???

[agsteele]

Thanks for the responses but I guess I didn't elaborate quite enough on why I was posting. I'm not having a problem with these NULL messages but thought I'd let the powers that be know that there may be a problem with the mail system.

OK, thanks for the clarification.

I do think that the posting in this forum area has confused stuff. If it had appeared in the Flat-Rate Email forum then I think you'd have got different responses.

Hopefully an admin will shift it over and we can take another try

Andrew

[Farelf]

Sounds good to me. Done. Well, not to Flate-rate setup, that's supposed to be for setup with different clients. But "here".

This problem, not having a SC mail account myself but from quick survey of previous occurrences, seems to be the system response to malformed headers and no body content.

Craig, can you view the headers for one of these in your held mail? I think there will be something there. I'm not sure how that is done in the webmail interface but trust there is a way. If anything is found, can you copy and paste them in as a webform submission (add a blank line and a dummy "no body" after you paste it in, before submitting) and see if you can get a tracking URL? Even if there's errors and "No report filed" you can copy the URL from the parse page, while you still have it on screen, below the line

Here is your TRACKING URL - it may be saved for future reference:

like: -

http://www.spamcop.net/sc?id=z4415868291z9...63f21365e9f9fbz

(that seems to work even though there are no reports and even though it will not be available in your "Past Reports").

Then we can see exactly what is in there if anything. In previous discussions it seems there were some munched up headers, as I have been trying to say in my previous post. If you have a quick look at some of that discussion as I suggested, you will see what I mean. Of course you may not have time but if you can do it, that would be great. If there is something in the mail system that can be tweaked as a result of what we find out that might solve this thing that has been recurrent virtually since "day one". Otherwise, as I said, if malformed headers are the problem, they apparently come and go.

[michaelanglo]

This problem, not having a SC mail account myself but from quick survey of previous occurrences, seems to be the system response to malformed headers and no body content.

Craig, can you view the headers for one of these in your held mail? I think there will be something there. I'm not sure how that is done in the webmail interface but trust there is a way. If anything is found, can you copy and paste them in as a webform submission (add a blank line and a dummy "no body" after you paste it in, before submitting) and see if you can get a tracking URL? Even if there's errors and "No report filed" you can copy the URL from the parse page, while you still have it on screen, below the line

Here is your TRACKING URL - it may be saved for future reference:

The error quoted it from VER or course. Either go into webmail, choose the 'held' folder and open the spam email then click 'original message' which can be copy/ pasted to the submit page as normal.

OR do a VER "release but don't whitelist" which puts it in your inbox whence it can be reported in the normal way.

The usual problem is not malformed headers as such but that From: and/or Subject: are missing (I don't mean blank) a long running series always has a '[' in the message-id.

[Farelf]

The error quoted it from VER or course. Either go into webmail, choose the 'held' folder and open the spam email then click 'original message' which can be copy/ pasted to the submit page as normal.

OR do a VER "release but don't whitelist" which puts it in your inbox whence it can be reported in the normal way.

The usual problem is not malformed headers as such but that From: and/or Subject: are missing (I don't mean blank) a long running series always has a '[' in the message-id.

Thanks for the information - I don't have a SC mail account so I didn't know any of the detail of reporting through that interface.

Description sure sounds like "malformed" to me. An e-mail without "From:" and/or "Subject:" header field(s) is seriously outside of the "standards". Or am I misunderstanding you?

Does the "Message-id:" thing cause problems with parsing? It's a certain sign of a dodgy mass-mailer at work but the SC processing tries to munge it if it is there and I'm not sure how it copes with unexpected garbage. I'm guessing it's OK - but (for instance) the parser used fall over if the colon in a header field had a space in front of it once upon a time (another unexpected garbage thing).

Anyway, you've provided enough detail now presumably to pass on to JT and the deputies for someone to look at the mail system functions and the effect on reporting. Thanks.

[rconner]

Fairly often I get spams that show the same info when you try to "preview" them. I have no trouble however bringing them up for parsing (and using the links on the parsing page to show the full packet).

I think this probably correlates to blank or malformed messages such as those sent by directory harvesters who are looking for new addresses to spam. Many probe messages are missing most or all of the "visible" header fields (subject, date, from, to, etc.).

-- rick

[craigt]

I think the relevant issue here is the error message received when I click on the message:

error:Cannot find 16647

The mail system seems to know that something was received but can't pull it up.

[rconner]

I think the relevant issue here is the error message received when I click on the message:

error:Cannot find 16647

The mail system seems to know that something was received but can't pull it up.

I think when you say "click on the message" you mean to press the "preview" link, yes?

As I said, the same thing happens to me from time to time. I find, however, that I can still report the message by ticking the box, picking the correct popup menu item, and pressing the button to put it in the reporting queue. When I get to this message in the queue, I am able to see the packet by clicking on the appropriate link on the parser page. Have you tried this? Or do these messages never get seen in the reporting queue?

Point being that perhaps the message isn't really lost, it is simply unviewable at that point in the process.

-- rick

[craigt]

...Point being that perhaps the message isn't really lost, it is simply unviewable at that point in the process...

I spent a little time playing around with the selections and managed to get the thing released into the mail queue and was able to retrieve it via POP from there. The really is an email but it has all sorts of problems with missing items; not sure why the "preview" item won't pull it up but either way it doesn't make it into the reported list so I can't post a link.

At least it's not really a NULL message which is what I had thought....

[Farelf]

...I spent a little time playing around with the selections and managed to get the thing released into the mail queue and was able to retrieve it via POP from there. The really is an email but it has all sorts of problems with missing items; not sure why the "preview" item won't pull it up but either way it doesn't make it into the reported list so I can't post a link. ...

If you can see those headers you can also copy and paste them (with any body or with a dummy 'no body' body) into the webpage reporting interface and submit it for parsing - then note the tracking url from the (failed) parse before you quit the page. That's what I was trying to describe in 76348[/snapback]. It records what you are trying to describe in terms of "all sorts of problems with missing items" in precise detail, together with the parser messages, if any.

If you review previous discussions (topics) about this problem as suggested in 76342[/snapback] they will probably make much more sense to you now - but you needn't do that (except for interest maybe) because you're seeing for yourself exactly what they were talking about.