On 27 Oct 2015, at 12:40, Marco Stoecker wrote:
[...]
I do need some assistance, as this is very new for me.
Thx in advance.
So this is the "Received" header of 5 out of 5 messages. I can't see
where the duplication happend :-(
Maybe this abridgment will help, reducing each to the first & second
Received headers:
message1:
[...]
Received: from mout.web.de ([212.227.15.3]) by mx.kundenserver.de
(mxeue002)
with ESMTPS (Nemesis) id 0MVE1V-1a1cd42azt-00YP1m for
<ak-lei...@waldorfkindergarten-erlangen.de>; Thu, 22 Oct 2015 10:37:47
+0200
Received: from Klamotten ([84.168.195.183]) by smtp.web.de (mrweb003)
with
ESMTPSA (Nemesis) id 0MTh7A-1Zy14E1g36-00QRsw; Thu, 22 Oct 2015
10:37:47
+0200
message2:
[...]
Received: from mout.web.de ([212.227.15.3]) by mx.kundenserver.de
(mxeue002)
with ESMTPS (Nemesis) id 0M4zk6-1ajnCX2Rpe-00zFbN for
<vorst...@waldorfkindergarten-erlangen.de>; Thu, 22 Oct 2015 10:37:47
+0200
Received: from Klamotten ([84.168.195.183]) by smtp.web.de (mrweb003)
with
ESMTPSA (Nemesis) id 0MTh7A-1Zy14E1g36-00QRsw; Thu, 22 Oct 2015
10:37:47
+0200
message3:
[...]
Received: from mout.web.de ([212.227.15.3]) by mx.kundenserver.de
(mxeue002)
with ESMTPS (Nemesis) id 0MIWPn-1ZovKO2jl9-004F6W for
<kolleg...@waldorfkindergarten-erlangen.de>; Thu, 22 Oct 2015 10:37:47
+0200
Received: from Klamotten ([84.168.195.183]) by smtp.web.de (mrweb003)
with
ESMTPSA (Nemesis) id 0MTh7A-1Zy14E1g36-00QRsw; Thu, 22 Oct 2015
10:37:47
+0200
message4:
[...]
Received: from mout.web.de ([212.227.15.3]) by mx.kundenserver.de
(mxeue002)
with ESMTPS (Nemesis) id 0M1Oy9-1adzmM2xGD-00tS34 for
<gruppensprec...@waldorfkindergarten-erlangen.de>; Thu, 22 Oct 2015
10:37:47
+0200
Received: from Klamotten ([84.168.195.183]) by smtp.web.de (mrweb003)
with
ESMTPSA (Nemesis) id 0MTh7A-1Zy14E1g36-00QRsw; Thu, 22 Oct 2015
10:37:47
+0200
message5:
[...]
Received: from mout.web.de ([212.227.15.3]) by mx.kundenserver.de
(mxeue002)
with ESMTPS (Nemesis) id 0MKz7Q-1ZpBNb35bE-0006Vb for
<beis...@waldorfkindergarten-erlangen.de>; Thu, 22 Oct 2015 10:37:47
+0200
Received: from Klamotten ([84.168.195.183]) by smtp.web.de (mrweb003)
with
ESMTPSA (Nemesis) id 0MTh7A-1Zy14E1g36-00QRsw; Thu, 22 Oct 2015
10:37:47
+0200
In short: a machine using the IP address 84.168.195.183 and claiming to
have the bogus name 'Klamotten ' passed a single message to a mail
server calling itself both 'smtp.web.de' and 'mrweb003' for which the
server used the id '0MTh7A-1Zy14E1g36-00QRsw' and which was then passed
to to the mail server mx.kundenserver.de by a mail system claiming to be
mout.web.de *FIVE DIFFERENT TIMES*, each time with one of *FIVE
DIFFERENT RECIPIENTS*
This gives the impression that the user of "Klamotten" (apparently a
DTAG residential customer) addressed that single message to 5 different
recipients and the *.web.de mail complex split the single message into 5
discrete but mostly identical messages (except for the ensuing Receives
headers) for onward transport. That's inefficient, but not formally
wrong. It may be that the server mx.kundenserver.de refuses to accept
multi-recipient messages and so the split was imposed upon, rather than
being chosen by, the mout.web.de server.
