Jump to content

[Resolved] Spamcop identifying originating IP for Outlook365 Exchange headers as "internal source" (mine)


Recommended Posts

After using Spamcop for years, I've changed my email setup and now can't get it to work.

A few months ago, I switched from hosted POP mail on a VPS to Outlook365 Exchange email. I know how to get the full headers - which are HUGE, but the originating IP is easy to find - but when I paste them with the email body into a Spamcop report, I get a message saying that it has identified the spam as having an "internal IP source", and "no source IP found". Screenshot below.

The issue appears to be that the first line of the Exchange header does NOT include the originating IP. It's further down. I'm attaching the beginning of the headers for a recent spam, and you can see that the originating IP is, but that's found further down.

Received: from SY3AUS01FT014.eop-AUS01.prod.protection.outlook.com
 ( by SY3AUS01HT005.eop-AUS01.prod.protection.outlook.com
 ( with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.803.8; Fri, 27 Jan
 2017 20:33:38 +0000
Received: from AUS01-ME1-obe.outbound.protection.outlook.com ( by
 SY3AUS01FT014.mail.protection.outlook.com ( with Microsoft
 SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.803.8 via Frontend
 Transport; Fri, 27 Jan 2017 20:33:37 +0000
Received: from ME1PR01CA0089.ausprd01.prod.outlook.com ( by
 ME1PR01MB1860.ausprd01.prod.outlook.com ( with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
 15.1.874.12; Fri, 27 Jan 2017 20:33:35 +0000
Received: from ME1AUS01FT011.eop-AUS01.prod.protection.outlook.com
 (2a01:111:f400:7eb4::204) by ME1PR01CA0089.outlook.office365.com
 (2603:10c6:200:18::22) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.874.12 via
 Frontend Transport; Fri, 27 Jan 2017 20:33:35 +0000
Authentication-Results: spf=none (sender IP is
 smtp.mailfrom=halwaaameat.com; mungeddomain.com; dkim=pass (signature was
 verified) header.d=halwaaameat.com;mungeddomain.com; dmarc=bestguesspass
 action=none header.from=halwaaameat.com;mungeddomain.com; dkim=pass
 (signature was verified) header.d=halwaaameat.com;
Received-SPF: None (protection.outlook.com: halwaaameat.com does not designate
 permitted sender hosts)
Received: from halwaaameat.com ( by
 ME1AUS01FT011.mail.protection.outlook.com ( with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
 15.1.803.8 via Frontend Transport; Fri, 27 Jan 2017 20:33:34 +0000

SO... I still want to use Spamcop, but how do I do it when the start of my headers look like this^^??




Edited by Cutsnake88
Title was unclear
Link to comment
Share on other sites

1 hour ago, lisati said:


Have you updated your mailhost configuration for your Spamcop reporting account?

Yay! That was the problem. Stupidly didn't even think of it, as I had thought it was my email addresses (not server) that needed to be registered, and those hadn't changed. 

Thank you very much!

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Create New...