Identify FROM bouce+randomstring-user=test01.sudosys.com@example.com

[Phan Cường]

Hello Everyone,
I have a problem with identify who sent this email via PMG like the image:

May 10 11:40:24

bounce+11e67d.d68ad-admin=test01.sudosys.com@example.com

admin@test01.sudosys.com

accepted/delivered

I check mailbox of user admin@test01.sudosys.com and saw it came from some_username1@example.com instead bounce+11e67d.d68ad-admin=test01.sudosys.com@example.com.
And only that domain have problem. Other domain working perfection.

So could anyone help me explaint why does PMG show me bounce+11e67d.d68ad-admin=test01.sudosys.com instead some_username1? It would look more pretty to read.

May 10 11:40:18 pve postfix/smtpd[23233]: connect from relay2.example.com[69.72.37.12]
May 10 11:40:19 pve postfix/smtpd[23233]: 3B43A1C10AF: client=relay2.example.com[69.72.37.12]
May 10 11:40:19 pve postfix/cleanup[23335]: 3B43A1C10AF: message-id=<emc51e3d9f-d0f2-4516-821d-595aa0770f5d@8740b153.com>
May 10 11:40:20 pve postfix/qmgr[2922]: 3B43A1C10AF: from=<bounce+11e67d.d68ad-admin=test01.sudosys.com@example.com>, size=60424, nrcpt=1 (queue active)
May 10 11:40:20 pve pmg-smtp-filter[13462]: 1C10B56279ECB42790B: new mail message-id=<emc51e3d9f-d0f2-4516-821d-595aa0770f5d@8740b153.com>#012
May 10 11:40:24 pve pmg-smtp-filter[13462]: 1C10B56279ECB42790B: SA score=1/5 time=4.179 bayes=undefined autolearn=no autolearn_force=no hits=AWL(0.413),DKIM_SIGNED(0.1),DKIM_VALID(-0.1),DKIM_VALID_AU(-0.1),DKIM_VALID_EF(-0.1),HTML_MESSAGE(0.001),KAM_SHORT(0.001),SCC_5_SHORT_WORD_LINES(1),SPF_HELO_NONE(0.001),SPF_PASS(-0.001),T_SCC_BODY_TEXT_LINE(-0.01),URIBL_BLOCKED(0.001)
May 10 11:40:24 pve postfix/smtpd[23344]: connect from localhost.localdomain[127.0.0.1]
May 10 11:40:24 pve postfix/smtpd[23344]: 707631C10B6: client=localhost.localdomain[127.0.0.1], orig_client=relay2.example.com[69.72.37.12]
May 10 11:40:24 pve postfix/cleanup[23335]: 707631C10B6: message-id=<emc51e3d9f-d0f2-4516-821d-595aa0770f5d@8740b153.com>
May 10 11:40:24 pve postfix/qmgr[2922]: 707631C10B6: from=<bounce+11e67d.d68ad-admin=test01.sudosys.com@example.com>, size=61684, nrcpt=1 (queue active)
May 10 11:40:24 pve pmg-smtp-filter[13462]: 1C10B56279ECB42790B: accept mail to <admin@test01.sudosys.com> (707631C10B6) (rule: default-accept)
May 10 11:40:24 pve postfix/smtpd[23344]: disconnect from localhost.localdomain[127.0.0.1] ehlo=1 xforward=1 mail=1 rcpt=1 data=1 commands=5
May 10 11:40:24 pve pmg-smtp-filter[13462]: 1C10B56279ECB42790B: processing time: 4.363 seconds (4.179, 0.066, 0)
May 10 11:40:24 pve postfix/lmtp[23336]: 3B43A1C10AF: to=<admin@test01.sudosys.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=5.7, delays=1.4/0.01/0/4.4, dsn=2.5.0, status=sent (250 2.5.0 OK (1C10B56279ECB42790B))
May 10 11:40:24 pve postfix/qmgr[2922]: 3B43A1C10AF: removed
May 10 11:40:27 pve postfix/smtp[23345]: 707631C10B6: to=<admin@test01.sudosys.com>, relay=210.2.86.188[210.2.86.188]:25, delay=2.8, delays=0.07/0.01/2.3/0.44, dsn=2.0.0, status=sent (250 OK id=1noHff-0007mz-4B)
May 10 11:40:27 pve postfix/qmgr[2922]: 707631C10B6: removed
May 10 11:42:41 pve postfix/smtpd[23233]: disconnect from relay2.example.com[69.72.37.12] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5

 

[Stoiko Ivanov]

the 'bounce+11e67d.d68ad-admin=test01.sudosys.com@example.com.' is the envelope-from address of the mail - this does not need to have anything to do with the address in the From header of the mail - see:
https://de.wikipedia.org/wiki/Envelope_Sender
https://medium.com/@fabianterh/diving-deep-into-emails-smtp-envelopes-and-headers-a2367d1ad92

it depends on the configuration of the sending system, which address it uses.

I hope this explains it