Re: "proving" a user received an email (good gosh)

From: D. Stussy (kd6lvw@bde-arc.ampr.org)
Date: 06/24/02 

From: "D. Stussy" <kd6lvw@bde-arc.ampr.org>
Date: Mon, 24 Jun 2002 19:15:59 GMT

On 23 Jun 2002, gaius.petronius wrote:
>"proving" a user received an email (good gosh)
>
>boss calls me in
>manager X is a liar, says he never received this damn email.
>
>i check the logs
>
>i see an entry about the time sender claims it was sent:
>
>exhibit A
>maillog:
>Jun 22 23:47:31 swm sendmail[5517]: g5MFlUu05517:
>from=<sender@address>, size=5988, class=0, nrcpts=2,
>msgid=<4778858448D8547D4A54BCC6118467D@>, proto=ESMTP, daemon=MTA
>
>i also see in
>exhibit B
>maillog:
>Jun 22 23:47:31 swm sendmail[5518]: g5MFlUu05517: to=<BigLiar>,
>delay=00:00:00, xdelay=00:00:00, mailer=local, pri=65536, dsn=2.0.0,
>stat=Sent
>maillog:Jun 22 23:47:31 swm sendmail[5518]: g5MFlUu05517:
>to=<AngryBOSS>, delay=00:00:00, xdelay=00:00:00, mailer=local,
>pri=65536, dsn=2.0.0, stat=Sent
>
>i see that the user also checked his email without errors
>
>exhibit C
>maillog:Jun 23 23:31:48 swm ipop3d[12224]: Login user=BigLiar
>host=4.unknown.com [227.1.0.n] nmsgs=2/2
>
>
>My question is, although i know that this 22:23:47:31 is most probably
>the mail in question, how can i link it to the message id
>78858448D8547D4A54BCC6118467D@ ??
>
>This is probably more a security or forensics question.
>is there a way to tune the logs to report the message id of the email
>when the user logs in and receives?
>
>in exhibit C there is no apparent way i can say that he is receiving
>this particular message; all i can say is that the server is
>functioning properly and that there is no reason to doubt that when he
>logged in he did not receive all his email messages.
>
>is there a method to log the received message id?

Next time, use the DSN (Delivery Status Notification) extensions to e-mail.

Relevant Pages

  • Re: "proving" a user received an email (good gosh)
    ... >This is probably more a security or forensics question. ... >is there a way to tune the logs to report the message id of the email ... >in exhibit C there is no apparent way i can say that he is receiving ...
    (comp.security.unix)
  • "proving" a user received an email (good gosh)
    ... This is probably more a security or forensics question. ... is there a way to tune the logs to report the message id of the email ... in exhibit C there is no apparent way i can say that he is receiving ...
    (comp.security.unix)
  • "proving" a user received an email (good gosh)
    ... This is probably more a security or forensics question. ... is there a way to tune the logs to report the message id of the email ... in exhibit C there is no apparent way i can say that he is receiving ...
    (comp.security.unix)
  • Re: "proving" a user received an email (good gosh)
    ... | is there a way to tune the logs to report the message id of the email ... | in exhibit C there is no apparent way i can say that he is receiving ...
    (comp.security.unix)
  • Re: "proving" a user received an email (good gosh)
    ... | is there a way to tune the logs to report the message id of the email ... | in exhibit C there is no apparent way i can say that he is receiving ...
    (comp.security.unix)