NDR or read receipt messages are looping until subject name is too long and quarantined

Versions / Builds Affected

GFI MailEssentials 2015

Status

Resolved

Problem Summary

NDR or read receipt messages are looping until subject name is too long and quarantined. Other symptoms include high CPU usage of the Transport service (either Edge or Exchange), issues with the Quarantine such as emails landing back in the quarantine.

TT / JIRAID

2563

How to Identify

The Dashboard shows same emails at regular intervals being blocked by the same filter. When checking the header of such emails, the X-GFI-METKTSID and X-GFI-METKTSIG headers are present multiple times, like in the example below. x-sender:<> x-receiver:@domain.org x-endofinjectedxheaders:957313 X-GFI-METKTSID:2c783288-b3ea-48d9-95b8-df136bab6b14 X-GFI-METKTSIG:Hy4npL5ze7kaAaKSghlWgPDxuJ88t9lxDZWyBjkzV40Ntro80Hr3b2qMv488/zQFKF4TRJIVfvvmMqMlVAHg+aAliVnU/FVONu30C9ls/AhFRKqGlovcfntR7+w/JGuP6JLoMAxCsQ/XnJm21TC+5aGvNIzD8FSrltXz+XmNeu4= MIME-Version: 1.0 x-gfi-rh: from Pickup by EXCHANGE.domain.com with Microsoft SMTP Server id 15.0.995.29; Wed, 18 Mar 2015 10:41:30 +0000 X-GFI-METKTSID: 2c783288-b3ea-48d9-95b8-df136bab6b14 X-GFI-METKTSIG: O1QBoZkWOVPDGdeLEh8lnQoRXsA0ImhpOsihLJKtIXsFXsdqupz+mMc8jUJNacMxFki70I9capGI4bzZuAFvtC06xqyLdgrpezEm7+erv+nkI5HrfOwWwgBAY8xsFC0dSZ8qKMW0CMgbBOFnSR1hWh9xGA+wtle4WcGjeDHdeFc= x-gfi-rh: from Pickup by EXCHANGE.domain.com with Microsoft SMTP Server id 15.0.995.29; Wed, 18 Mar 2015 10:36:03 +0000 X-GFI-METKTSID: 2c783288-b3ea-48d9-95b8-df136bab6b14 X-GFI-METKTSIG: XUk5BdSOwVlj+soYShAVuOIVNQsm5+Bq41WpLLQvw/0MXFMXmPCcyWUltk8S50mrSujcDrnQAkC+uC7zwyGqwPTnjDmAWmpAzTivXqSdLq+yXU76XdVB9IqGIKde19WDo7jHRgPu8NcnQ2rRuOuUJB56Xjpkdel2MhSajo0IT+k= x-gfi-rh: from Pickup by EXCHANGE.domain.com with Microsoft SMTP Server id 15.0.995.29; Wed, 18 Mar 2015 10:22:31 +0000 X-GFI-METKTSID: 2c783288-b3ea-48d9-95b8-df136bab6b14 X-GFI-METKTSIG: b+ik4oFEVpJ0rA7AbKh8EurYVA6tf6CZyP6EYYbuTCxDTTEvAScCIosz9K6EER0Ey0Gw2ZJyvm9jxG2vVrWzi/drpyF2YUdrb0D8vEFN2zLt4nCF/mdvMQwzkxHMX6jVzqJDeWv+rLcj1kzJ9cDZx8j3/N6okiL1rVgo6zNnuY8= x-gfi-rh: from Pickup by EXCHANGE.domain.com with Microsoft SMTP Server id 15.0.995.29; Wed, 18 Mar 2015 10:21:18 +0000 X-GFI-METKTSID: 2c783288-b3ea-48d9-95b8-df136bab6b14 X-GFI-METKTSIG: dLa6+4n8ZQl/+9n/NI2u8vJtK+b0xu6fWiHpcQiVtonc9c/LTvv21l/kSo6FvuAVo2fpnwV5gT8jk8N7kBbW61zAzXe3WI9/VZnbEAKio/icHZRspvlLC6/12xlvjHn2mrTtAk/7TYeZQrFPrve879zLMOCov0+eFI33J4JZ2Jc= x-gfi-rh: from Pickup by EXCHANGE.domain.comS with Microsoft SMTP Server id 15.0.995.29; Wed, 18 Mar 2015 10:19:52 +0000 X-GFI-METKTSID: 2c783288-b3ea-48d9-95b8-df136bab6b14 X-GFI-METKTSIG: fICc4Kj853SrWvFQxsgP2DXJFVjOSgITcMKAra0xrh4TeskVfg9j5U7zGjLuUGjzwfx98Rk2Z3+pgjWUBGVwF5quKQMAwTkJPWS6rBn12kNEm/NFVKbAU5vJPX/Wm8vuWVRP67P5i1y+C6EZCajFzkYRleFqnYFDAUz1xZDfLBs= x-gfi-rh: from Pickup by EXCHANGE.domain.com with Microsoft SMTP Server id 15.0.995.29; Wed, 18 Mar 2015 08:39:47 +0000 X-GFI-METKTSID: 2c783288-b3ea-48d9-95b8-df136bab6b14 X-GFI-METKTSIG: U2rPGWLz+0RRBA6sPbyU7A74JkqHnpi6p5O09K6ZxytPmF7SY+TB3AAAIr1Cy2Dcm00WAToyX1UX1ObGMHny+gqWWRyLLPK17QiWRFnsl4o/V1ykOJmXaLNJJ/uXQJ9tza9ehVL+izsC+/GE0r8eU7sy0NpYCUuDZ2hYc82K3fw= x-gfi-rh: from Pickup by EXCHANGE.domain.com with Microsoft SMTP Server id 15.0.995.29; Wed, 18 Mar 2015 08:37:51 +0000

Workaround / Fix Details

Send customer the following patch http://ftp.gfisoftware.com/temp/PSG/ME/Patches/2015/ME2015_PATCH_20150413_2563.zip Make sure customer right clicks> properties > Unblocks the zip before running the patch as Administrator

Required Actions

Attach article to case, change action to quarantine. Send customer the following patch http://ftp.gfisoftware.com/temp/PSG/ME/Patches/2015/ME2015_PATCH_20150413_2563.zip Make sure customer right clicks> properties > Unblocks the zip before running the patch as Administrator If issue persists, upgrade to latest version. Patch has been included in them.