User and Email address don't match

ColorFlakes

We are receiving tickets via email only. Users are not entering their tickets via a login. We are experiencing issues where the User and the Email address are not matching.

There are multiple instances of this. In all instances the user is using a cloud based accounting system (Intuit or NetSuite) to submit emails to us. Users of Intuit are being lumped with other users of Intuit. The same goes for NetSuite users.

As an example, an email header contains -
From: "Kathy (Kathy@Company1.com)" system@sent-via.netsuite.com
Reply-To: Kathy messages.XXXXX.XXXXX.XXXXXXXXXXX@7718063.email.netsuite.com
To: service@ourcompany.com

However in osTicket, the "From" field shows the email coming from Charlie (Charlie@Company2.com)

A header from Company2 emails contains -
From: "Charlie (Charlie@Company2.com)" system@sent-via.netsuite.com
Reply-To: Penntek transactions.XXXXXXX.XXXXXXXX_msg_2222068.a5e52f99cb@7243430.email.netsuite.com
To: service@ourcompany.com

It should be noted, the Reply-To addresses is always different. Any suggestions on how to handle this?

KevinTheJedi

ColorFlakes

Correct, the User is always the From address. In this case the From is the same so both would go to a single User. You really need to create a Ticket Filter that has whatever criteria you want and then set the action to Use Reply-To Email. This way the system will use the Reply-To address as the User instead of the From address.

Cheers.

ColorFlakes

Ok I think I got it. In that case, what is the proper way to setup the filter?

The header contains:

From: "Kathy (Kathy@company.com)" system@sent-via.netsuite.com

Will this then work?

Or do I need to set up a filter for everyone at the company that emails us?

KevinTheJedi

ColorFlakes

No, it doesn't read the raw header like that. User / Email Address is the actual address within the header. So in your case you can do User / Email Address > equals > system@sent-via.netsuite.com and that should suffice for all mail sent from said address.

Cheers.

ColorFlakes

This hasn't solved the issue. We are still getting emails with incorrect user names. Do you have any other suggestions?

KevinTheJedi

ColorFlakes

Can you show me screenshots of the Ticket Filter in its entirety?

Cheers.

ColorFlakes

Gladly.

KevinTheJedi

ColorFlakes

Can you share an example email header?

Cheers.

ColorFlakes

Here is one example:

Received: from CO1PR10MB4547.namprd10.prod.outlook.com (2603:10b6:303:96::18)
 by CH0PR10MB4907.namprd10.prod.outlook.com with HTTPS; Wed, 13 Nov 2024
 20:06:21 +0000
Received: from CH5P223CA0014.NAMP223.PROD.OUTLOOK.COM (2603:10b6:610:1f3::16)
 by CO1PR10MB4547.namprd10.prod.outlook.com (2603:10b6:303:96::18) with
 Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8137.29; Wed, 13 Nov
 2024 20:06:19 +0000
Received: from CH3PEPF0000000A.namprd04.prod.outlook.com
 (2603:10b6:610:1f3:cafe::77) by CH5P223CA0014.outlook.office365.com
 (2603:10b6:610:1f3::16) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8158.16 via Frontend
 Transport; Wed, 13 Nov 2024 20:06:19 +0000
Authentication-Results: spf=pass (sender IP is 167.89.000.000)
 smtp.mailfrom=e.notification.intuit.com; dkim=pass (signature was verified)
 header.d=notification.intuit.com;dmarc=pass action=none
 header.from=notification.intuit.com;compauth=pass reason=100
Received-SPF: Pass (protection.outlook.com: domain of
 e.notification.intuit.com designates 167.89.58.138 as permitted sender)
 receiver=protection.outlook.com; client-ip=167.89.58.138;
 helo=o1.e.notification.intuit.com; pr=C
Received: from o1.e.notification.intuit.com (167.89.000.000) by
 CH3PEPF0000000A.mail.protection.outlook.com (10.167.000.000) with Microsoft
 SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8158.14
 via Frontend Transport; Wed, 13 Nov 2024 20:06:18 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=notification.intuit.com;
	h=content-type:from:list-unsubscribe:mime-version:subject:reply-to:to:
	cc:content-type:from:subject:to;
	s=s1; bh=NAHAV6+MqKzezlE6cTCFJXDz7yx0FeWTC8jPu6WEKoQ=;
	b=zo3LrgiHfy62pknf8/GOh5hC0v8M2Tsx0cSudAuuS8uUuQ9jh5CTcihZk+bPEcKm+Tri
	1yOlo3x3SpkpAj5e6ku1p1p5qQK5QcBi1H9Ekk+HAz9HbmFe01kFZZvfSwndaIgT1xuxUs
	Yw7vRJ9e6fryncLXbSG6Ix68jbmzf7cCUCio1l4M0FgGaob9FOjXRNOOtkDwG8pX1SvQfg
	NfE65CeILCvOhMNKSzHrSsUaD3JHiX4iL2CZ2m+Q0I8VEAjed/B0WPhQtEdc5fRr4GoSYe
	zK2ZS/+ybw5S+sfu2D/QxKCLWjbplHbbRhRqfnE2okrecZtrGK4fsIabeCYwqrXQ==
Received: by recvd-7449bcf784-n22pp with SMTP id recvd-7449bcf784-n22pp-1-673506B8-13
	2024-11-13 20:06:16.359216692 +0000 UTC m=+5364541.024657324
Received: from MjMyNzEzNQ (unknown)
	by geopod-ismtpd-13 (SG) with HTTP
	id ILNd7wPpRCmV1yYXaqCUJg
	Wed, 13 Nov 2024 20:06:16.281 +0000 (UTC)
Content-Type: multipart/mixed; boundary=9303abcc49b11db66eff1e54b9479365a48ae28a37bc365379c6aff1241b
Date: Wed, 13 Nov 2024 20:06:16 +0000 (UTC)
From: Customer 1 of Minnesota <quickbooks@notification.intuit.com>
List-Unsubscribe:
 =?us-ascii?Q?=3Chttps=3A=2F=2Fqbo=2Eintuit=2Ecom=2Funsubscribe=2Fpage=2Ehtm=3Fuid=3Dbd2d8e30-a1fa?=
 =?us-ascii?Q?-11ef-b5bc-fb9a009aa616=3E=2C=3Cmailto=3Abd2d8e?=
 =?us-ascii?Q?30-a1fa-11ef-b5bc-fb9a009aa616-www=2Eqbo=2E?=
 =?us-ascii?Q?intuit=2Ecom=2Funsubscribe=3E?=
Mime-Version: 1.0
Subject: Purchase Order from Customer 1 of Minnesota
X-Accept-Language: en
X-SenderName-ClientID: bd2d8e30-a1fa-11ef-b5bc-fb9a009aa616
Message-ID: <ILNd7wPpRCmV1yYXaqCUJg@geopod-ismtpd-13>
Reply-To: bob.jones@customer1domain.com
X-SG-EID:
 =?us-ascii?Q?u001=2EIluwaCuEnhLVNx6bEoeRtqapA5XaATpeBBAHlQrBkkgUCztERohcKAWdt?=
 =?us-ascii?Q?FySRbYD+xAeLCbFiyOb4NKUqMQNLcvnIqu7JQVn?=
 =?us-ascii?Q?Ark256gnEGJ6fALcfAnKbnMtQXQW8Vn+eioodpK?=
 =?us-ascii?Q?gI90Gm1jUGg5nsjF1A173ahzpNL4fIlfll+hrl0?=
 =?us-ascii?Q?zmUlEqRO9GW93ZTYkimWv6FIZSOySWme0UYgtd5?=
 =?us-ascii?Q?S9tJ2zZ5+osOmpON+3pKvLvIPqdGFR1rMwvI2e7?=
 =?us-ascii?Q?0mQ=2FOtQlYlRbJeAM1Zkq3bBSMQ=3D=3D?=
X-SG-ID:
 =?us-ascii?Q?u001=2ESdBcvi+Evd=2FbQef8eZF3BuC9tSviz1XiqwH7KmTTvosMv8qxqsj5y2Vx9?=
 =?us-ascii?Q?2vtBZGnYsH7=2FodLDyIwgBkTCgqs0ib7RK1exZSy?=
 =?us-ascii?Q?9Q=2F=2FK1WG=2FHQ5o0sqbq2y2RFk7y1On=2FKzTgf=2FaR=2F?=
 =?us-ascii?Q?J90RV7FU7rJF+RpxNEHP870DEzfODJZ3KJldQkg?=
 =?us-ascii?Q?IdS2GRybzcy1uWl=2FGDAhBgT6lUNAWShBcPo4gJz?=
 =?us-ascii?Q?BcODt=2FpXm6LHWkuwz9EZ3S8Dh8E5nHFqF9eTi4H?=
 =?us-ascii?Q?EVu1mWmn22ghhx1SqW2qc0CbGBk2rM2xUqJu=2Ffr?=
 =?us-ascii?Q?TuDRJ96j07L=2FJmzbR+3d7GRMLUS=2FUYGxRoXhrgj?=
 =?us-ascii?Q?MsnI9s5J5++8gHIp6KhELBf6Z4H8LHLkNb3PTx5?=
 =?us-ascii?Q?Ou6O80eISAI6xWLc61NY4la0QrVCdzhUODkCM+=2F?=
 =?us-ascii?Q?pz86r3+VOeRveLEmGRrKXVuJ3NZ4rDaxSHHFL9z?=
 =?us-ascii?Q?qf=2FOaH8=2FiMa8Pmnef9QqeCoQrwmJaV5nRhgwpio?=
 =?us-ascii?Q?37ChzbhQG1KjfN209HeB3ppi633WSgGk89HokBs?=
 =?us-ascii?Q?aiBhFrIy=2FhcDagqXDuAQpcE0Ieejzj4fDp2f5ex?=
 =?us-ascii?Q?vxntHWCHp9QvRyqCXSp83ItIZI8WinFqSKmf=2FlG?=
 =?us-ascii?Q?WQkQsQ90=2FeJqY+xcUg3hmkovRWpcJxGMMmg4ehV?=
 =?us-ascii?Q?SKI7RI6ffP40Wt+WtYgWgSKb+7VHHHQ4jgc2asz?=
 =?us-ascii?Q?YdiXdRgWaCPw=2FYjVJJJeoe=2FJw=2FzgU93VimeXvsP?=
 =?us-ascii?Q?C68Qsg+jiUbgfLRqhhMRQEjuvjdAO=2F5FlXxluh=2F?=
 =?us-ascii?Q?hOZameDjKtJFxOX8c8l=2F8ojy+eeXXPZ+DhzKbmS?=
 =?us-ascii?Q?Wfbk6Lzirmj1TbPFT2MKLVD3Nbua=2FPvlM4jCmWi?=
 =?us-ascii?Q?IuS9akxvUH0su1s=2FtYy=2FxzYTgbHzlHkvW0DVSnh?=
 =?us-ascii?Q?haYIhNjNCdqycQBqmFnDpIXoC95a+uJC9i7sWwa?=
 =?us-ascii?Q?JWVLPnSZl8rfS8Yajyzo+q6OVi15PTEtJIF=2FQan?=
 =?us-ascii?Q?+ITsrbz1yPPA+4sjKGaZICAEBye3riZy6SAFtjW?=
 =?us-ascii?Q?CoaFGzT0WZcTv7ni91p7arh8UfFACUubkYYUa3G?=
 =?us-ascii?Q?JNwK7TfmohYSyyNEjd+2TE8gs9wAO3aNdBk6hej?=
 =?us-ascii?Q?p3CXYvxxIDxIW3Y=2FceoRKMQyQu=2Fm87nNrL0veDb?=
 =?us-ascii?Q?bZmcLCLefEWZYp7W5wUQIm9olMkYPOmp+V+VrDr?=
 =?us-ascii?Q?POy9vz7oYG7dB8e4RzNtFmUEj6cduicJN1IjSD7?=
 =?us-ascii?Q?VNXUyUDN4y+i8WvvHR8ao=2F+AfbCnWSIv5KvdA6h?=
 =?us-ascii?Q?j2KcFaNwexMoZiHj7KPyXY5357f0zqmlVHuGhui?=
 =?us-ascii?Q?3Dtt6sZZHJrb7zfe9kh+L6TQfBXC1E+QIFVg=3D=3D?=
To: service@ourdomain.com, user@ourdomain.com
X-Entity-ID: u001.fXpxriuEUg7tew6Rema50w==
Return-Path:
 bounces+2327135-f0c0-service=ourdomain.com@e.notification.intuit.com
X-MS-Exchange-Organization-ExpirationStartTime: 13 Nov 2024 20:06:19.0502
 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id:
 40eb1b40-66d9-4774-1b3b-08dd041ea33a
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 7245e1dd-7e24-4add-bb14-7721d11112b0:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic:
 CH3PEPF0000000A:EE_|CO1PR10MB4547:EE_|CH0PR10MB4907:EE_
X-MS-Exchange-Organization-AuthSource:
 CH3PEPF0000000A.namprd04.prod.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Office365-Filtering-Correlation-Id: 40eb1b40-66d9-4774-1b3b-08dd041ea33a
X-MS-Exchange-Organization-SCL: 1
X-Microsoft-Antispam:
 BCL:0;ARA:13230040|13012899012|2092899012|5062899012|29132699027|3092899012|12012899012|13102899012|3072899012|4092899012|69100299015|6062899009|4022899009|5082899009|4076899003|8096899003;
X-Forefront-Antispam-Report:
 CIP:167.89.58.138;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:o1.e.notification.intuit.com;PTR:o1.e.notification.intuit.com;CAT:NONE;SFS:(13230040)(13012899012)(2092899012)(5062899012)(29132699027)(3092899012)(12012899012)(13102899012)(3072899012)(4092899012)(69100299015)(6062899009)(4022899009)(5082899009)(4076899003)(8096899003);DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Nov 2024 20:06:18.2221
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 40eb1b40-66d9-4774-1b3b-08dd041ea33a
X-MS-Exchange-CrossTenant-Id: 7245e1dd-7e24-4add-bb14-7721d11112b0
X-MS-Exchange-CrossTenant-AuthSource:
 CH3PEPF0000000A.namprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO1PR10MB4547
X-MS-Exchange-Transport-EndToEndLatency: 00:00:03.0383628
X-MS-Exchange-Processed-By-BccFoldering: 15.20.8158.013
X-Microsoft-Antispam-Mailbox-Delivery:
	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
X-Microsoft-Antispam-Message-Info:
	=?us-ascii?Q?5R+wcHfvYFE1AfncXrCSxxZ1vPQBpZviwEY1UiIZWYEozLkggLU/SI9hgzAF?=

ColorFlakes

Here is another:

Received: from DS0PR10MB7512.namprd10.prod.outlook.com (2603:10b6:8:165::19)
 by CH0PR10MB4907.namprd10.prod.outlook.com with HTTPS; Wed, 13 Nov 2024
 19:47:08 +0000
Received: from BL1PR13CA0243.namprd13.prod.outlook.com (2603:10b6:208:2ba::8)
 by DS0PR10MB7512.namprd10.prod.outlook.com (2603:10b6:8:165::19) with
 Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8137.29; Wed, 13 Nov
 2024 19:47:06 +0000
Received: from BN3PEPF0000B36D.namprd21.prod.outlook.com
 (2603:10b6:208:2ba:cafe::7) by BL1PR13CA0243.outlook.office365.com
 (2603:10b6:208:2ba::8) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8158.15 via Frontend
 Transport; Wed, 13 Nov 2024 19:47:06 +0000
Authentication-Results: spf=pass (sender IP is 167.89.82.160)
 smtp.mailfrom=e.notification.intuit.com; dkim=pass (signature was verified)
 header.d=notification.intuit.com;dmarc=pass action=none
 header.from=notification.intuit.com;compauth=pass reason=100
Received-SPF: Pass (protection.outlook.com: domain of
 e.notification.intuit.com designates 167.89.000.160 as permitted sender)
 receiver=protection.outlook.com; client-ip=167.89.82.160;
 helo=o4.e.notification.intuit.com; pr=C
Received: from o4.e.notification.intuit.com (167.89.82.160) by
 BN3PEPF0000B36D.mail.protection.outlook.com (10.167.000.164) with Microsoft
 SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8182.1
 via Frontend Transport; Wed, 13 Nov 2024 19:47:06 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=notification.intuit.com;
	h=content-type:from:list-unsubscribe:mime-version:subject:reply-to:to:
	cc:cc:content-type:from:subject:to;
	s=s1; bh=TGlx82pwxr0eF6Xun8/YgIH+2FhtTOEevC0Jtd2ZYHE=;
	b=eykNDA+4vaWeQwT2RsWRA5Uop8Jj3sI0b2I22UIsHgXi5jBCBe112jycmP/+LkXQGhJf
	/TC/3FhmQmTUarrztFwm/Sl9gO5wEtXmLT990Z7hUWaSWapwAQ3R2cgoIXNAl0doZBhJVC
	4jqJfDnt31UYrxMKY/WNfPnxW/1MjMN9SIWnwVbjmzV6q6BTP/umYCkTEnEh/7FLHIzOqu
	zjBzOoRMS9TjP0IByPl+tYdP8mkJvQo91CARQGvzvNMqUDnVa34WhjoWMTbjJS6lwpQWNE
	VF3b1E6MCTlfi5BOAgHZZ1BT71KfDHmdKMljQn1jVjCetE8cusK5dXhky53mGalg==
Received: by recvd-8587f46d74-5l72l with SMTP id recvd-8587f46d74-5l72l-1-67350239-2A
	2024-11-13 19:47:05.921502818 +0000 UTC m=+1300142.368477665
Received: from Mjg3ODI2MTU (unknown)
	by geopod-ismtpd-canary-0 (SG)
	with HTTP
	id 9D5SZioaQ4Sc0lv28jES8g
	Wed, 13 Nov 2024 19:47:05.869 +0000 (UTC)
Content-Type: multipart/mixed; boundary=de77ca105c9d4403536369c0bff58845359cdfe7ad81cc39bb9db131e6ec
Date: Wed, 13 Nov 2024 19:47:05 +0000 (UTC)
From: Customer 2 -   Charlotte <quickbooks@notification.intuit.com>
List-Unsubscribe:
 =?us-ascii?Q?=3Chttps=3A=2F=2Fqbo=2Eintuit=2Ecom=2Funsubscribe=2Fpage=2Ehtm=3Fuid=3D0f710080-a1f8?=
 =?us-ascii?Q?-11ef-8def-d1284e01df22=3E=2C=3Cmailto=3A0f7100?=
 =?us-ascii?Q?80-a1f8-11ef-8def-d1284e01df22-www=2Eqbo=2E?=
 =?us-ascii?Q?intuit=2Ecom=2Funsubscribe=3E?=
Mime-Version: 1.0
Subject: Purchase Order from Customer 2 -   Charlotte
X-Accept-Language: en
X-SenderName-ClientID: 0f710080-a1f8-11ef-8def-d1284e01df22
Message-ID: <9D5SZioaQ4Sc0lv28jES8g@geopod-ismtpd-canary-0>
Reply-To: user@customer2.com
X-SG-EID:
 =?us-ascii?Q?u001=2Epk2I=2FyD4JlMUFIQYwoT0bKKht9auGxyf6GH=2FkyQYsfb5ipB2qzh3ZMVPR?=
 =?us-ascii?Q?RoruM6kb4asJKGb3lRmpnUKdGGTjU3V=2Fh9QtFWS?=
 =?us-ascii?Q?iffIZP+n=2FJ6getem18P1I4kJqOMV5SN4VuKiWiA?=
 =?us-ascii?Q?I7MrbNJJ940qwgd=2FMJGx0i9Arr72Cphtf+NJmEE?=
 =?us-ascii?Q?Hb5otGD4W3Pk0hPUC=2FikkQhxBToeC=2FP+AoH=2FJLT?=
 =?us-ascii?Q?H+D2CfrlrGqyl+Jrt8iYaczSwFbzgo7htXvFADV?=
 =?us-ascii?Q?duC9k68EzX2lRLPYJHiCrMgqBrHg2u7oih7xGkv?=
 =?us-ascii?Q?X4DT0euM=3D?=

KevinTheJedi

ColorFlakes

I don't see why it's not working then.. maybe try Contains instead of Equals in the Rule?

Cheers.

ColorFlakes

I tried. No dice.

KevinTheJedi

ColorFlakes

So it's still making the Ticket Owner "quickbooks@notification.intuit.com"? Even with the Filter created and Active and Target Channel set to "Any"?

Cheers.

ColorFlakes

This is an example of what we're seeing. The User does not match the From.

Within the ticket :
User : Bob's Used Cars
Email : edward@lawnmowersrus.com

Within the email header :
From: Lawn Mowers R Us quickbooks@notification.intuit.com
Reply to : edward@lawnmowersrus.com

KevinTheJedi

ColorFlakes

So that outcome is expected with the filter you have enabled. This email came in, the From (User / Email Address) contained "quickbooks@notification.intuit.com", so the system set the user to the email in the Reply-To which should be the actual sender. Am I missing something or misinterpreting what you are saying?

Cheers.

ColorFlakes

Bob's Used Cars (user) is not Lawn Mowers R Us. (From the header)

KevinTheJedi

ColorFlakes

Then remove the filter and the user will then be "Lawn Mowers R Us quickbooks@notification.intuit.com".

Cheers.

KevinTheJedi

ColorFlakes

If you are simply talking about the User's name then that would come from the first time the user is created. It does not change afterwards unless someone manually updates it.

Cheers.