Hi,
Thank you very much for your answer.
Here is the server information.
osTicket-Version v1.18 (724de45) — Up to date
Server-Software Apache/2.4.53 (AlmaLinux) OpenSSL/3.0.7
MySQL-Version 10.5.16
PHP-Version 8.1.14
This information I can't find in the mail header.
Do you see in the header what the cause could be or do you have another idea?
Thanks for the help.
Best
MIME-Version: 1.0
Received: from .eurprd09.prod.outlook.com
by .eurprd09.prod.outlook.com with HTTPS; Wed, 20 Sep 2023
15:33:57 +0000
Received: from .PROD.OUTLOOK.COM (
by .eurprd09.prod.outlook.com with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 1.2.3.4; Wed, 20 Sep
2023 15:33:56 +0000
Received: from .eop-che01.prod.protection.outlook.com
by .outlook.office365.com
with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 1.2.3.4 via Frontend
Transport; Wed, 20 Sep 2023 15:33:55 +0000
Authentication-Results: spf=softfail (sender IP is 1.2.3.4)
smtp.mailfrom=domain.com; dkim=pass (signature was verified)
header.d=domain.com;dmarc=pass action=none header.from=domain.com;compauth=pass
reason=100
Received-SPF: SoftFail (protection.outlook.com: domain of transitioning
domain.com discourages use of 1.2.3.4 as permitted sender)
Received: from pmg.domain2.com (1.2.3.4) by
.mail.protection.outlook.com (1.2.3.4) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
1.2.3.4 via Frontend Transport; Wed, 20 Sep 2023 15:33:55 +0000
Received: from pmg.domain2.com (localhost.localdomain [1.2.3.4])
by pmg.domain2.com (Proxmox) with ESMTP id
for ticket@domain2.com; Wed, 20 Sep 2023 17:33:55 +0200 (CEST)
Received-SPF: pass (domain.com ... spf.google.com: Sender is authorized to use 'z@domain.com' in 'mfrom' identity (mechanism 'include:netblocks.google.com' matched)) receiver=pmg.domain2.com; identity=mailfrom; envelope-from="z@domain.com"; helo=mail-ed1-f45.google.com; client-ip= 1.2.3.4
Received: from .google.com (.google.com [1.2.3.4])
(using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)
(No client certificate requested)
by pmg.domain2.com (Proxmox) with ESMTPS
for ticket@domain2.com; Wed, 20 Sep 2023 17:33:54 +0200 (CEST)
Received: by .google.com with SMTP id
for ticket@domain2.com; Wed, 20 Sep 2023 08:33:54 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=domain.com; s=20230601; t=1695224028; x=1695828828; darn=domain2.com;
h=message-id:to:cc:references:date:subject:mime-version:from:from:to
:cc:subject:date:message-id:reply-to;
bh=fRY/LDZcpCw3Mqln0uOPh91V5DQWXq2SpRUaV68xnMs=;
b=nmHkCZeWYzFTUlQQMj8M6tiw+ZtuGpBGpsyMcwIMoMWkT+1sedyk31xmX6eRAnB9yo
PZ09gj4Kkcn/RhdNJOCd9bfGqsn3QQiMdFyJ+iM0fmgKQF8mwQlzu0ocdZM8KQR+U88h
HaeW71ZaqK94m55yNRQ6L/Voe/S7Mz/oC61TW+hwwNNwv7qbhqe1joTONcxqfRIfbagg
T/ohPcyukGOrxVqyGvrBrDDjVZanqBZYrOCkRkcIEnoh5DZQ5CL2eAoAJQU3Jpvz7NER
xzdNOu/XJUmJhTO3bG7AY7p36rFXuiD5EyYWaXw8w56qB8zzWCv+NAaq4F2Qk9VaH5C8
U5rA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1695224028; x=1695828828;
h=message-id:to:cc:references:date:subject:mime-version:from
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=fRY/LDZcpCw3Mqln0uOPh91V5DQWXq2SpRUaV68xnMs=;
b=ovV3bOXycjC3HbtcXDMiQzqihavl7JQv+uKMEYKoymI8NvDbCPAx+vGSgbeoZsLTM9
INzAaYK+9dwGlxkjzSzRLjTuMLCYFwK0hopLGBNHHMpTYgXkxkCvg4apeHZbJM9s+X0w
UKYYEFD50V5KmzU6T8fD4ZYc2qIc6rV6Z+H1U2eNA35502C6jygHOZzysI9sr1tyJoir
VCyzyBK2nDp87ZkHLFYTPS48hOJCHxrQp97ZjX6sLrQJd19kHOlAYfD6OmY+LEd0B+Ye
EQFZ8QC/zax8xIVGpaYY40XCKfJBEqG6IGQlcwQW1BcPT8x6FG+Tx0Xo+qo/AraADPyk
s2hw==
X-Gm-Message-State: AOJu0YzpqC8js3y0E9kMtjylOFP4aZQe0bzKZEgvqThQ6I6faL0qB/AR
2tOM7H0MX44KJJGIrNBJW80=
X-Google-Smtp-Source: AGHT+IHx1tKZwAayXEtKPEnDQen0VTGGdjZrR7vB4ZNt1rm/1H6UaUDVJxZwfiz0R9GVBhKwP3JLmg==
X-Received: by 2002:a05:6402:caf:b0:533:288e:a078 with SMTP id;
Wed, 20 Sep 2023 08:33:48 -0700 (PDT)
Received: from smtpclient.apple ([2a04:ee41:4:c18f:25de:c069:13fe:3012])
by smtp.domain.com with ESMTPSA id
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Wed, 20 Sep 2023 08:33:48 -0700 (PDT)
From: User Z z@domain.com
Content-Type: multipart/alternative;
boundary="Apple-Mail=1E69F59C-640D-4B29-93E9-E022DDFA5115"
Subject: Fwd: new message - [#2316264] Test Ticket - status: Open
Date: Wed, 20 Sep 2023 17:33:47 +0200
References: <.eurprd03.prod.outlook.com>
Cc: SSN IT Support ticket@domain2.com
To: z user z@domain.com
Message-Id: <@domain.com>
X-Mailer: Apple Mail (1.2.3.4)
X-SPAM-LEVEL: Spam detection results: 0
AWL -0.259 Adjusted score from AWL reputation of From: address
BAYES_00 -1.9 Bayes spam probability is 0 to 1%
DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid
DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature
DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain
DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain
DMARC_PASS -0.1 DMARC pass policy
FREEMAIL_FROM 0.001 Sender email is commonly abused enduser mail provider
FREEMAIL_REPLY 1 From and body contain different freemails
HTML_MESSAGE 0.001 HTML included in message
RCVD_IN_DNSWL_NONE -0.0001 Sender listed at https://www.dnswl.org/, no trust
RCVD_IN_MSPIKE_H2 -0.001 Average reputation (+2)
SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record
SPF_PASS -0.001 SPF: sender matches SPF record
Return-Path: z@domain.com
X-MS-Exchange-Organization-ExpirationStartTime: 20 Sep 2023
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id:
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage:
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic:
ZR0CHE01FT013:EE|AS8PR09MB5435:EE|VI1PR09MB6904:EE
X-MS-Exchange-Organization-AuthSource:
.eop-che01.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Office365-Filtering-Correlation-Id:
X-MS-Exchange-Organization-SCL: -1
X-Microsoft-Antispam: BCL:0;
X-Forefront-Antispam-Report:
CIP:1.2.3.4;CTRY:CH;LANG:en;SCL:-1;SRV:;IPV:CAL;SFV:SKN;H:pmg.domain2.com;PTR:pmg-i7.domain2.com;CAT:NONE;SFS🙁13230031)(451199024)(336012)(36756003)(6200100001)(53546011)(7636003)(356005)(166002)(84300400001)(33656002)(86362001)(83380400001)(2616005)(16799955002)(55446002)(73392003)(426003)(82202003)(26005)(15650500001)(37006003)(76482006)(5660300002)(4326008)(8676002)(19627405001)(1096003)(6862004)(45080400002)(58800400005);DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Sep 2023
X-MS-Exchange-CrossTenant-Network-Message-Id:
X-MS-Exchange-CrossTenant-Id:
X-MS-Exchange-CrossTenant-AuthSource:
.eop-che01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR09MB5435
X-MS-Exchange-Transport-EndToEndLatency: 00:00:02.1084318
X-MS-Exchange-Processed-By-BccFoldering:
X-Microsoft-Antispam-Mailbox-Delivery:
ucf:0;jmr:0;auth:0;dest:I;ENG(910001)(944506478)(944626604)(920097)(930097)(140003);
X-Microsoft-Antispam-Message-Info:
=?us-ascii?Q?1c9D4VnRi/UCbKhrXX4Pd8CIIz8GRlQ7ytMrfXMhVK1AnQGRhWUCTn+8jP2U?=
=?us-ascii?Q?OZKH3mY7Dw4sKwGRFQRbwEca3be9r25DN4eHvMSR7WVBW76Gd9nxmM/oJKAm?=
=?us-ascii?Q?FaArspSodVEgDVqNCFqrt2Fo2XcDxr449Ngd+2p//z9z4XaOGZHrRGTYFAQ4?=
=?us-ascii?Q?8C0LIMTi7Q8Un/DpDOBBoC8U4kKdFAfxd/fTSM2fHeT5mo3O+pZm8AUF5sfl?=
=?us-ascii?Q?Y+CBJOHm+R9638aNSLiki+fh+gIYoSePbPcglUfcOwf5VxKcxQfQo2XzrKMa?=
=?us-ascii?Q?9nT4CM30uGewM/gdW4zYTtzpoX5IOzhD6mTJR1k7EmcLBnxxCSt713ipMZIM?=
=?us-ascii?Q?aCfbI7LwP5E2Gy/SHkAGUR5QPd+F5kPSP62UWoZgh37Y5NonRbBZqRXKufTE?=
=?us-ascii?Q?laftkwU0Nx2vIO9bSuXPI14FxJEcljJJlZXDJTWhRWNiXeTEaBXVhBltxAOR?=
=?us-ascii?Q?WRBRFHPjxnWIeFTbWJgPqNqfrPobx76ARRlX8+0Mrggz64f9pAeyr0DVAYvD?=
=?us-ascii?Q?Y/EDxNIjxLB+RYJOiFlw1Ork14UN+F4WrztVjJhas5TExTjUjD7VSCkjtuzu?=
=?us-ascii?Q?y79wbXFWY3qRsINqJ6hkIiJAif2ZVBVF59hQAJ5LIrvOyQRdo8bIooVXwhgy?=
=?us-ascii?Q?hwIhy3ezAX92+YaTQvESJSmSmqO2OVrAgB6E+d6Nl4IH9ojx/qEkp5DiigJO?=
=?us-ascii?Q?Lzz7m7fQtdfJf8hnAZaxNlyUOBA2vI2pcwsMh4VzJNqHirJgwLDAJV3G3MTy?=
=?us-ascii?Q?zGY59OP/+Mhtk7RYw7pAol+xZUWHTJD14AAIM4uH9+2J+k5Nfzk0LlK9DM+Y?=
=?us-ascii?Q?9RIthKiBRgVHfYLA7/QTiAHYLfs20J5khjBX2ieqgPHkVwDKm4D38GN5AySD?=
=?us-ascii?Q?rXFdka0eZwDButbnNEt2ywRntPk4rUbFR0UzHvC3ddVGg5jMfIlNHcgl/HxX?=
=?us-ascii?Q?x+PjYfxhhksCxTjWxWJUvv6WZ/3Wm/HXiKj0t9KeSd2+E9tm6OwT7m/tUQl+?=
=?us-ascii?Q?Bz4EVKxEEnVN38oZ2TVBujGT5VCWiMd7leObzAo5/WqKs9nzvkbAShX5AaM1?=
=?us-ascii?Q?vvFYyJLAlHM9poSktKwl0miD2thcjkyxXaOsdjeiymupUVjFDgpyFI4IXyBz?=
=?us-ascii?Q?9KGOswfpeqvtMrOsfuM0lIUtRKzvDwxSwLg4AE9zoqJFvW3DYo4F1J5WXepZ?=
=?us-ascii?Q?qzV37ljYCoei4MwoDiBWHCBhOJe4F12j3lemLriTIlub1gi+K7SjU0MCpS6D?=
=?us-ascii?Q?B3yeuzbPXxBRypZk6+xaOF8QfmyOTm0eiVwtixRuBw84h9Z876LZt87jE+XS?=
=?us-ascii?Q?VU2vlU/tXx0Ooud2BRyM9rcjMgADRZceW8/27keakCdbBIHXt9Z5I/6FB1Lt?=
=?us-ascii?Q?Lki3k2SQZw27XDZKWM3+TWauadns9b4Izck9HGQY92heAI5t5iDO6TvWh06P?=
=?us-ascii?Q?09Pd3EK1QdTmCR4OnWGhktT/04TMQ/a4IgYL6ia/6wLQXD2WjtZz9xiDxChU?=
=?us-ascii?Q?dTL57i5vQhS3GfpWa7ZGFmwc4pOIsIrknWMzIhaPi1ov8eGizooooBSTIKQr?=
=?us-ascii?Q?QsgjKJWm6aldTiBgBaHs6MaPoKRRIQnhRRqEsNFGX/Nh9EkEqKeRNWQ5cmJY?=
=?us-ascii?Q?YhdTswIZwFiYJdYbI/ANAuq1mtNzB+qN13IM4jIcK7lFCXzKzPPvB+WtLupk?=
=?us-ascii?Q?EgX/M4LsH/elFbj0MegUmL11FuyA4SzQ7Hx+ZCmvnlCTPT1GfnH6CXSuQVbd?=
=?us-ascii?Q?ZU+uqY3q1hz6ebBfQW9JD54pFepYNnwnnxcMzylN3memPk4AIr2H?=