SOLVED
Home

Mail from internal user moved to junk and can not move back

%3CLINGO-SUB%20id%3D%22lingo-sub-479306%22%20slang%3D%22zh-CN%22%3EMail%20from%20internal%20user%20moved%20to%20junk%20and%20can%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-479306%22%20slang%3D%22zh-CN%22%3E%3CP%3EProblem%20mailbox%20always%20move%20mail%20(from%20internal%20user%20A)%20and%20(was%20carbon%20copy%20or%20BCC%20to%20problem%20mailbox)%20to%20junk%20box.%20Not%20only%20newly%20received%20and%20also%20mails%20manually%20moved%20to%20Inbox%20from%20junk.%3C%2FP%3E%3CP%3EHave%20checked%3C%2FP%3E%3COL%3E%3CLI%3EOWA%20rules%3C%2FLI%3E%3CLI%3EOWA%20blacklist%3C%2FLI%3E%3CLI%3EOutlook%20rules%3C%2FLI%3E%3CLI%3ESet%20spam%20filter%20to%20off%20or%20high%20or%20low%20in%20both%20OWA%20and%20Outlook%20on%20Windows.%3C%2FLI%3E%3C%2FOL%3E%3CP%3EBut%20nothing%20found.%20Tried%20to%20check%20audit%20log%20for%20problem%20mailbox%20which%20LogonTypes%20was%20Owner%20and%20Operation%20was%20move%2C%20shows%20nothing%20(Maybe%20som%20Ething%20wrong%20here%20cause%20manually%20moves%20mail%20from%20junk%20to%20Inbox%20and%20is%20logged%20but%20no).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOn%20Exchange%20server%2C%20and%20Outlook%202013.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ELooking%20forward%20to%20all%20idea%20for%20debugging.%3C%2FP%3E%3CP%3EAnd%20also%20apologize%20to%20my%20poor%20English.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-479306%22%20slang%3D%22zh-CN%22%3E%3CLINGO-LABEL%3E2013%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EJunk%20box%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ERules%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-482319%22%20slang%3D%22en-US%22%3ERe%3A%20Mail%20from%20internal%20user%20moved%20to%20junk%20and%20can%20not%20move%20back%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-482319%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F324741%22%20target%3D%22_blank%22%3E%40whyou%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%3E%3CDIV%3ECopy%20and%20Paste%20the%20email%20headers%20for%20investigation..%3C%2FDIV%3E%3CDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CDIV%3ESpecially%20%22X-Forefront-Antispam-Report%22%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fanti-spam-message-headers%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fanti-spam-message-headers%3C%2FA%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3ERegards%2C%3C%2FDIV%3E%3CDIV%3EAkshay%3C%2FDIV%3E%3CDIV%3ESystem%20Admin%20-%20Apps4Rent%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FDIV%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-482428%22%20slang%3D%22en-US%22%3ERe%3A%20Mail%20from%20internal%20user%20moved%20to%20junk%20and%20can%20not%20move%20back%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-482428%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F318732%22%20target%3D%22_blank%22%3E%40Akshay_Mane%3C%2FA%3E%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3CP%3EModified%20the%20original%20topic%20for%20proper%20information.%3C%2FP%3E%3CP%3EHere's%20a%20problem%20mail%20header%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EReceived%3A%20from%20MBX.%5BOur%20domain%5D%20(192.168.1.206)%20by%20MBX.%5BOur%20domain%5D%20(192.168.1.206)%20with%3CBR%20%2F%3EMicrosoft%20SMTP%20Server%20(TLS)%20id%2015.0.1293.2%20via%20Mailbox%20Transport%3B%20Thu%2C%2025%20Apr%3CBR%20%2F%3E2019%2010%3A53%3A04%20%2B0800%3CBR%20%2F%3EReceived%3A%20from%20MBX.%5BOur%20domain%5D%20(192.168.1.206)%20by%20MBX.%5BOur%20domain%5D%20(192.168.1.206)%20with%3CBR%20%2F%3EMicrosoft%20SMTP%20Server%20(TLS)%20id%2015.0.1293.2%3B%20Thu%2C%2025%20Apr%202019%2010%3A53%3A04%20%2B0800%3CBR%20%2F%3EReceived%3A%20from%20MBX.%5BOur%20domain%5D%20(%5B%3A%3A1%5D)%20by%20MBX.%5BOur%20domain%5D%20(%5B%3A%3A1%5D)%20with%20mapi%20id%3CBR%20%2F%3E15.00.1293.006%3B%20Thu%2C%2025%20Apr%202019%2010%3A53%3A04%20%2B0800%3CBR%20%2F%3EContent-Type%3A%20application%2Fms-tnef%3B%20name%3D%22winmail.dat%22%3CBR%20%2F%3EContent-Transfer-Encoding%3A%20binary%3CBR%20%2F%3EFrom%3A%20%26lt%3B%5BInternal%20user%20A%5D%40%5BOur%20domain%5D%26gt%3B%3CBR%20%2F%3ETo%3A%20%26lt%3B%5Bsomeone%20else%5D%40%5BOur%20domain%5D%26gt%3B%3CBR%20%2F%3ECC%3A%20%26lt%3B%5BProblem%20mailbox%5D%40%5BOur%20domain%5D%26gt%3B%3CBR%20%2F%3ESubject%3A%20%3D%3Fgb2312%3FB%3FsuLK1A%3D%3D%3F%3D%3CBR%20%2F%3EThread-Topic%3A%20%3D%3Fgb2312%3FB%3FsuLK1A%3D%3D%3F%3D%3CBR%20%2F%3EThread-Index%3A%20AdT7EilzQrnSPbf3Q5y3XFXB5g17Iw%3D%3D%3CBR%20%2F%3EDate%3A%20Thu%2C%2025%20Apr%202019%2010%3A53%3A03%20%2B0800%3CBR%20%2F%3EMessage-ID%3A%20%26lt%3B522197462de04a7f8d700faad6120266%40MBX.%5BOur%20domain%5D%26gt%3B%3CBR%20%2F%3EAccept-Language%3A%20zh-CN%2C%20en-US%3CBR%20%2F%3EContent-Language%3A%20zh-CN%3CBR%20%2F%3EX-MS-Has-Attach%3A%20yes%3CBR%20%2F%3EX-MS-Exchange-Organization-SCL%3A%20-1%3CBR%20%2F%3EX-MS-TNEF-Correlator%3A%20%26lt%3B522197462de04a7f8d700faad6120266%40MBX.%5BOur%20domain%5D%26gt%3B%3CBR%20%2F%3EMIME-Version%3A%201.0%3CBR%20%2F%3EX-MS-Exchange-Transport-FromEntityHeader%3A%20Hosted%3CBR%20%2F%3EX-MS-Exchange-Organization-MessageDirectionality%3A%20Originating%3CBR%20%2F%3EX-MS-Exchange-Organization-AuthSource%3A%20MBX.%5BOur%20domain%5D%3CBR%20%2F%3EX-MS-Exchange-Organization-AuthAs%3A%20Internal%3CBR%20%2F%3EX-MS-Exchange-Organization-AuthMechanism%3A%2004%3CBR%20%2F%3EX-Originating-IP%3A%20%5B192.168.1.245%5D%3CBR%20%2F%3EX-MS-Exchange-Organization-Network-Message-Id%3A%20f216c941-2249-4ace-f9d0-08d6c929234d%3CBR%20%2F%3EReturn-Path%3A%20%5BInternal%20user%20A%5D%40%5BOur%20domain%5D%3CBR%20%2F%3EX-MS-Exchange-Organization-AVStamp-Enterprise%3A%201.0%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-484367%22%20slang%3D%22en-US%22%3ERe%3A%20Mail%20from%20internal%20user%20moved%20to%20junk%20and%20can%20not%20move%20back%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-484367%22%20slang%3D%22en-US%22%3E%3CP%3EGot%20the%20answer!%3C%2FP%3E%3CP%3EProblem%20solved%20by%20deny%20access%20of%20a%20mobile%20app%20called%20MyMail.%20Still%20don't%20know%20this%20is%20a%20bug%20or%20wrong%20configuration.%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20484px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F110566iE6C5808BD4EE0417%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22exchange.png%22%20title%3D%22exchange.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
whyou
New Contributor

Problem mailbox always almost move mail  ( from internal user A to(to, CC or BCC) problem mailbox ) to junk box. Not only newly received but also mails manually moved to inbox from junk.

Have checked

  1. OWA rules
  2. OWA blacklist
  3. Outlook rules
  4. Set spam filter to off or high or low in both OWA and Outlook on windows.

But nothing found. Tried to check audit log for problem mailbox which LogonTypes is Owner and  Operation is Move but shows nothing (Maybe something wrong here cause manually move mail from junk to inbox should be logged but no).

 

On Exchange server 2013 and Outlook 2013.

 

Looking forward to all idea for debugging.

And also apologize for my poor English.

3 Replies

@whyou

 

Copy and Paste the email headers for investigation..
 
 
Regards,
Akshay
System Admin - Apps4Rent

 

@Akshay_Mane  

Modified the original topic for proper information.

Here's a problem mail header:

 

Received: from MBX.[Our domain] (192.168.1.206) by MBX.[Our domain] (192.168.1.206) with
Microsoft SMTP Server (TLS) id 15.0.1293.2 via Mailbox Transport; Thu, 25 Apr
2019 10:53:04 +0800
Received: from MBX.[Our domain] (192.168.1.206) by MBX.[Our domain] (192.168.1.206) with
Microsoft SMTP Server (TLS) id 15.0.1293.2; Thu, 25 Apr 2019 10:53:04 +0800
Received: from MBX.[Our domain] ([::1]) by MBX.[Our domain] ([::1]) with mapi id
15.00.1293.006; Thu, 25 Apr 2019 10:53:04 +0800
Content-Type: application/ms-tnef; name="winmail.dat"
Content-Transfer-Encoding: binary
From: <[Internal user A]@[Our domain]>
To: <[someone else]@[Our domain]>
CC: <[Problem mailbox]@[Our domain]>
Subject: =?gb2312?B?suLK1A==?=
Thread-Topic: =?gb2312?B?suLK1A==?=
Thread-Index: AdT7EilzQrnSPbf3Q5y3XFXB5g17Iw==
Date: Thu, 25 Apr 2019 10:53:03 +0800
Message-ID: <522197462de04a7f8d700faad6120266@MBX.[Our domain]>
Accept-Language: zh-CN, en-US
Content-Language: zh-CN
X-MS-Has-Attach: yes
X-MS-Exchange-Organization-SCL: -1
X-MS-TNEF-Correlator: <522197462de04a7f8d700faad6120266@MBX.[Our domain]>
MIME-Version: 1.0
X-MS-Exchange-Transport-FromEntityHeader: Hosted
X-MS-Exchange-Organization-MessageDirectionality: Originating
X-MS-Exchange-Organization-AuthSource: MBX.[Our domain]
X-MS-Exchange-Organization-AuthAs: Internal
X-MS-Exchange-Organization-AuthMechanism: 04
X-Originating-IP: [192.168.1.245]
X-MS-Exchange-Organization-Network-Message-Id: f216c941-2249-4ace-f9d0-08d6c929234d
Return-Path: [Internal user A]@[Our domain]
X-MS-Exchange-Organization-AVStamp-Enterprise: 1.0

Solution

Got the answer!

Problem solved by deny access of a mobile app called MyMail. Still don't know this is a bug or wrong configuration.

exchange.png

Related Conversations
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
Tabs and Dark Mode
cjc2112 in Discussions on
30 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
29 Replies