Lately I'm getting reports of duplicate emails in a shared mailbox. I've compared the headers of the two and they are originating from 2 different exchange servers internally which is just bizarre:
First email:
Received: from BL2PR03MB257.namprd03.prod.outlook.com (10.255.231.13) by
BY2PR03MB270.namprd03.prod.outlook.com (10.242.37.12) with Microsoft SMTP
Server (TLS) id 15.0.820.5 via Mailbox Transport; Tue, 3 Dec 2013 17:26:12
+0000
Received: from BL2PR03MB452.namprd03.prod.outlook.com (10.141.92.21) by
BL2PR03MB257.namprd03.prod.outlook.com (10.255.231.13) with Microsoft SMTP
Server (TLS) id 15.0.820.5; Tue, 3 Dec 2013 17:26:10 +0000
Received: from BL2PR03MB452.namprd03.prod.outlook.com ([10.141.92.21]) by
BL2PR03MB452.namprd03.prod.outlook.com ([10.141.92.21]) with mapi id
15.00.0820.005; Tue, 3 Dec 2013 17:26:10 +0000
Second email:
Received: from BLUPR03MB034.namprd03.prod.outlook.com (10.255.209.146) by
BLUPR03MB035.namprd03.prod.outlook.com (10.255.209.147) with Microsoft SMTP
Server (TLS) id 15.0.820.5 via Mailbox Transport; Tue, 3 Dec 2013 17:26:12
+0000
Received: from BL2PR03MB257.namprd03.prod.outlook.com (10.255.231.13) by
BLUPR03MB034.namprd03.prod.outlook.com (10.255.209.146) with Microsoft SMTP
Server (TLS) id 15.0.820.5; Tue, 3 Dec 2013 17:26:11 +0000
Received: from BL2PR03MB452.namprd03.prod.outlook.com (10.141.92.21) by
BL2PR03MB257.namprd03.prod.outlook.com (10.255.231.13) with Microsoft SMTP
Server (TLS) id 15.0.820.5; Tue, 3 Dec 2013 17:26:10 +0000
Received: from BL2PR03MB452.namprd03.prod.outlook.com ([10.141.92.21]) by
BL2PR03MB452.namprd03.prod.outlook.com ([10.141.92.21]) with mapi id
15.00.0820.005; Tue, 3 Dec 2013 17:26:10 +0000
First email:
X-Forefront-Antispam-Report: SFV:SKI;SFS:;DIR:INB;SFP:;SCL:-1;SRVR:BL2PR03MB257;H:BL2PR03MB452.namprd03.prod.outlook.com;CLIP:86.xxx.209.185;FPR:;LANG:en;
Second email:
X-Forefront-Antispam-Report: SFV:SKI;SFS:;DIR:INB;SFP:;SCL:-1;SRVR:BL2PR03MB257;H:BL2PR03MB452.namprd03.prod.outlook.com;CLIP:86.xxx.209.185;FPR:;LANG:en;;SKIP:1;
It looks like the server at 10.255.231.13 is receiving the duplicate emails (once from 10.255.209.146 and another by 10.242.37.12). Is there an issue going on internally?