cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
HolmPC
Aspiring Contributor
436 Views
Message 1 of 2

"Mailbox full" bounce messages when it's not

Go to solution

I have a customer who is having a problem receiving email to his btinternet address. The problem seems intermittent. The sender is getting a bounce message with the following content which appears to be from postmaster@outlook.com. Is the btinternet address using a Microsoft backend? 

The mailbox is not full. Some mail continues to get through. Why is he getting this behaviour when his mailbox is not full? Why is the behaviour intermittent? BT chat support were wholly unhelpful.

The content of the bounce message I get when I send mail to him from a gmail address is:

 

Diagnostic information for administrators:

Generating server: DM6NAM10HT025.mail.protection.outlook.com

removed@btinternet.com
Remote Server returned '554 5.2.2 mailbox full; STOREDRV.Deliver.Exception:QuotaExceededException.MapiExceptionShutoffQuotaExceeded; Failed to process message due to a permanent exception with message The process failed to get the correct properties. 0.35250:DE020000, 1.36674:01000000, 1.61250:00000000, 1.45378:02000000, 1.44866:00000000, 1.36674:02000000, 1.61250:00000000, 1.45378:05000000, 1.44866:14000000, 1.36674:06000000, 1.61250:00000000, 1.45378:12000000, 1.44866:0B000000, 1.36674:A1000000, 1.61250:00000000, 1.45378:21000000, 1.44866:3D000000, 1.36674:09000000, 1.61250:00000000, 1.45378:61000000, 1.44866:00010000, 1.36674:08000000, 1.61250:00000000, 1.45378:64000000, 1.44866:00100000, 16.55847:00010000, 17.43559:00000000C6030000000000000000000000000000, 20.52176:140F488F1B0010101F000000, 20.50032:140F488F8B1700004B000000, 0.35180:38000000, 255.23226:03000136, 255.27962:02000000, 255.27962:06000000, 255.17082:DD040000, 0.24929:55000000, 4.21921:DD040000, 255.27962:FA000000, 255.1494:66000000, 0.38698:05000780, 7.36354:010000000000010C00000000, 7.36354:010000000000010C0F010480, 5.29818:0000000030303033343030312D313733322D663736362D303030302D30303030303030303030303000306263, 1.29920:03000000, 7.29828:04EF48C0030000002D396664, 7.29832:000000C00300000032363332, 4.45884:DD040000, 4.29880:DD040000, 4.59420:DD040000, 7.49544:010000000000010CA4000000, 8.45434:01400300321766F7000000000000000012000000, 1.46798:04000000, 5.10786:0000000031352E32302E333931322E3032373A504158505231304D42343831363A30626363666236302D333735352D346566332D626139632D3966643037363664653633333A32313236333200D320100F010480, 7.51330:A554398639E3D808AA468141, 0.39570:0F010480, 1.64146:02000000, 1.33010:02000000, 2.54258:00000000, 0.58802:12000000, 1.64146:06000000, 1.33010:06000000, 2.54258:DD040000, 255.1750:0A005D36, 255.27962:A1000000, 255.17082:B9040000, 0.27745:0A00F565, 4.21921:B9040000, 255.27962:09000000, 0.26881:0A005636, 255.21817:B9040000, 0.60978:B3000000, 0.36402:0A006136, 4.38450:DD040000, 0.47602:B8000000, 4.63986:DD040000, 0.22945:C2000000, 4.31137:DD040000, 0.26529:03000336, 4.29953:DD040000, 0.32768:C2000000, 4.33024:DD040000 [Stage: CreateMessage]'

Original message headers:

Received: from DM6NAM10FT013.eop-nam10.prod.protection.outlook.com
 (2a01:111:e400:7e86::53) by
 DM6NAM10HT025.eop-nam10.prod.protection.outlook.com (2a01:111:e400:7e86::274)
 with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3912.25; Tue, 9 Mar
 2021 15:42:21 +0000
Authentication-Results: spf=softfail (sender IP is 213.120.69.18)
 smtp.mailfrom=removed.co.uk; outlook.com; dkim=pass (signature was verified)
 header.d=removed.co.uk;outlook.com; dmarc=bestguesspass action=none
 header.from=removed.co.uk;compauth=pass reason=109
Received-SPF: SoftFail (protection.outlook.com: domain of transitioning
 removed.co.uk discourages use of 213.120.69.18 as permitted sender)
Received: from sa-prd-fep-070.btinternet.com (213.120.69.18) by
 DM6NAM10FT013.mail.protection.outlook.com (10.13.152.142) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
 15.20.3912.25 via Frontend Transport; Tue, 9 Mar 2021 15:42:21 +0000
X-IncomingTopHeaderMarker: OriginalChecksum:6BC891FEDF754B41D1E73621F053E60C6F95DEBFBADE67FF9E17251CCFB58B8C;UpperCasedChecksum:FEC90ACBBF3B67598FBEC58E4E61F1F2A184CF2DB57573AC0DB9CA09A69EF25A;SizeAsReceived:4892;Count:33
Received: from sa-prd-rgin-008.btmx-prd.synchronoss.net ([10.2.38.16])
          by sa-prd-fep-070.mx.internal with ESMTP
          id <20210309154220.PDYR6513.sa-prd-fep-070.mx.internal@sa-prd-rgin-008.btmx-prd.synchronoss.net>
          for <removed@btinternet.com>; Tue, 9 Mar 2021 15:42:20 +0000
Authentication-Results-Original: btinternet.com;    dkim=pass;    spf=none
 smtp.helo=mail-wm1-f44.google.com;    spf=none smtp.mailfrom=removed.co.uk
X-OWM-SPF: 2
Received-SPF: none (sa-prd-rgin-008.btmx-prd.synchronoss.net: domain
 mail-wm1-f44.google.com does not designate permitted sender hosts)
 identity=helo; receiver=sa-prd-rgin-008.btmx-prd.synchronoss.net;
 client-ip=209.85.128.44; helo=mail-wm1-f44.google.com;
Received-SPF: none (sa-prd-rgin-008.btmx-prd.synchronoss.net: domain
 removed.co.uk does not designate permitted sender hosts) identity=mailfrom;
 receiver=sa-prd-rgin-008.btmx-prd.synchronoss.net; client-ip=209.85.128.44;
 envelope-from=removed; helo=mail-wm1-f44.google.com;
X-Originating-IP: [209.85.128.44]
X-OWM-Source-IP: 209.85.128.44 (US)
X-OWM-Env-Sender: removed
X-SNCR-Rigid: 60346D6E02C39F7E
X-OWM-DMARC: spf 100 dkim 100
X-OWM-DKIM: 1
X-VadeSecure-score: verdict=clean score=0/300, class=clean
X-SNCR-VADESECURE: CLEAN
X-RazorGate-Vade: gggruggvucftvghtrhhoucdtuddrgeduledrudduiedgkedtucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecuueftkffvkffujffvgffngfevqffonecuuegrihhlohhuthemuceftddunecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenucfjughrpefhvffufffkrhgfgggtsegrtderredtreejnecuhfhrohhmpedfofgrthhtucffvghusggvrhhtucdqucfjohhlmhfrvedfuceomhgusehhohhlmhhptgdrtghordhukheqnecuggftrfgrthhtvghrnhepteetudevueeffeeggeeutdfhheekueduiedvgfekieevtefhudekheevgfdthfdunecuffhomhgrihhnpehhohhlmhhptgdrtghordhukhdpthifihhtthgvrhdrtghomhdpfhgrtggvsghoohhkrdgtohhmpdhgrdhprghgvgdphigvlhhlrdgtohhmnecukfhppedvtdelrdekhedruddvkedrgeegpdekvddrieelrdefledrvdeknecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehhvghlohepmhgrihhlqdifmhduqdhfgeegrdhgohhoghhlvgdrtghomhdpihhnvghtpedvtdelrdekhedruddvkedrgeegpdhmrghilhhfrhhomhepoehmugeshhholhhmphgtrdgtohdruhhkqedprhgtphhtthhopeeoughrrhhoghgvrhhhohhougessghtihhnthgvrhhnvghtrdgtohhmqecuqfftvefrvfeprhhftgekvddvnegurhhrohhgvghrhhhoohgusegsthhinhhtvghrnhgvthdrtghomh
X-RazorGate-Vade-Verdict: clean 0
X-RazorGate-Vade-Classification: clean
Received: from mail-wm1-f44.google.com (209.85.128.44) by sa-prd-rgin-008.btmx-prd.synchronoss.net (5.8.340)
        id 60346D6E02C39F7E for removed@btinternet.com; Tue, 9 Mar 2021 15:42:20 +0000
Received: by mail-wm1-f44.google.com with SMTP id i9so2447509wml.0
        for <removed@btinternet.com>; Tue, 09 Mar 2021 07:42:20 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=removed.co.uk; s=google;
        h=from:to:subject:date:message-id:reply-to:user-agent:mime-version;
        bh=jVBXK3WeuQyaa10DOZ+tDZMf78x2ESowcYze54HYbkY=;
        b=GY4NWnQ37cHz93HfsWhBkCfkpy0tjo08IxWQ+3eGhFKdcRJvAhKTAeggSZhWYN8Rt2
         16PpM2KKJK4vJrCs8UJreEgnXkl4zGtOVIbYh4qDDBcYxMSqD6Zg8h9HoxpsN9tDRAIO
         +UXRzWRQQY3npH6PZq5J2+4EgH9uELrHtCRIA=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20161025;
        h=x-gm-message-state:from:to:subject:date:message-id:reply-to
         :user-agent:mime-version;
        bh=jVBXK3WeuQyaa10DOZ+tDZMf78x2ESowcYze54HYbkY=;
        b=AylZGRPo1ABcN2bO0Xz6UMQPk+HracISNL/WW5RWO7hNSx6vfMMbSjzkzOvvNMyA61
         XSbjwm5xGwEDaONaeNPwTueN1ENtDwRokwiUEHeaNxnFIv/V7yJ7dH/D5T2ulRjE8geb
         NlFoF+79T/1RiZVwWJTnngecRQkxUfOdg/moqmKcVUSY/wPM0v9Rom6SylQtgqxYM3TI
         dHCIE/1pVfCnXzhOOtFJeymxwy8/vjWuX9a+jBW58m5OZBZYIz3g0d4veTuJUl8FXJz8
         drELp+E7IgMD1xX9OKLBVfrOusPsNmJsFR/fsaTiiqfKi4EYwpqi59DWpST91Hgc4ZjY
         mHaA==
X-Gm-Message-State: AOAM532gA3icSWpFX0YqubEhNOppVAUDviOHp+fTiSvv5GazFSWsbTPR
	SDusou1Bpw2TlvdYJgoDNp1AzxENoXXmIseq
X-Google-Smtp-Source: ABdhPJw81PucGcYHxFHAQsanop1a/g5uenl67wiir/CdVTtpN8zUSmm2wZR1bfoPx64E7fX2CzYQCw==
X-Received: by 2002:a1c:2017:: with SMTP id g23mr4695033wmg.126.1615304540332;
        Tue, 09 Mar 2021 07:42:20 -0800 (PST)
Received: from [192.168.200.67] (82-69-39-28.dsl.in-addr.zen.co.uk. [82.69.39.28])
        by smtp.gmail.com with ESMTPSA id i3sm24590292wra.66.2021.03.09.07.42.19
        for <removed@btinternet.com>
        (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
        Tue, 09 Mar 2021 07:42:19 -0800 (PST)
From: <removed address>
To: "Removed" <removed@btinternet.com>
Subject: test
Date: Tue, 09 Mar 2021 15:42:18 +0000
Message-ID: <em81640dad-54ec-4cd3-b367-609208c22eac@pegasus2>
Reply-To: <removed address>
User-Agent: eM_Client/8.1.1054.0
MIME-Version: 1.0
Content-Type: multipart/alternative;
 boundary="------=_MB7594A2F3-7096-41E5-9E10-A221F5A5F6C0"
X-IncomingHeaderCount: 33
Return-Path: removed address
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-PublicTrafficType: Email
X-MS-UserLastLogonTime: 3/26/2019 11:16:44 AM
X-MS-Office365-Filtering-Correlation-Id: 70db9276-19d7-475e-a498-08d8e311edde
X-MS-DelayedDelivery: true
X-MS-TrafficTypeDiagnostic: DM6NAM10HT025:
X-MS-Exchange-EOPDirect: true
X-Sender-IP: 213.120.69.18
X-SID-PRA: removed address
X-SID-Result: PASS
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
	=?us-ascii?Q?1pFwgXu7Yp2FEel88kEkJSEYeA2s7b0KbHup3vY0ufFLn9ud9Thvq883Dbml?=
 =?us-ascii?Q?cAyabRzAer3dLPQL1Six0uRqwlunKQGLEIeQx9CNCmisBXYyAl0yT7m8DZ0N?=
 =?us-ascii?Q?soWJrxAONYob2zVZiuwVPkA6vHITD5VtjvrvEc/bRsCVicrckLEeohHAm5ON?=
 =?us-ascii?Q?TDoKI9z3Mk6u856s0x0xJaK1BDak2RgpvqsanHatqV/tyANzIUSBl6xT4sUO?=
 =?us-ascii?Q?4MDHpFtAtFbQVk6X8DriOBgSeAMOdXX9BmRn0diCZGd4nCdUkuohkFqga/yX?=
 =?us-ascii?Q?XPvSXB3yu+Hzmt2pwllS+ptL1oLvTEkhL1XZTwpwH4MDesah9zizxF35wvF4?=
 =?us-ascii?Q?Bi1csJUg/NvvynErI5Rg/fDr5p/1C/3OIHRP1g/puiQedhLg4eroyXjA5qsr?=
 =?us-ascii?Q?dUNhLVJi8S/rfEygrZvSqrmnbJkUkpT/hf4vE1rQ19KKyQ3EwvZe/qF1GTV4?=
 =?us-ascii?Q?Lf1gmJhEAM0x57APnslzuj7/dGKDVY9btLZpEMu9P8L+4Cpa8WssMaxRTGmX?=
 =?us-ascii?Q?OrQyYs3bwF3YfOxaxGHpDaQS1xIjbFD9Q1WZ7sVwCxbFwf0IYFoag7f7GiQF?=
 =?us-ascii?Q?hiNy+ZCIWx82HWoUtoKywuhHttFS2S3lmN8XF+320jka/zN4rb98unwabUik?=
 =?us-ascii?Q?OwvwnAO/PuGURROEzVjYiFxcf+E02ksUTI/yEtOA7TTkICICTyDafOxSIhKq?=
 =?us-ascii?Q?NBIcXYiOMQMjnhInWLrxtQHfIhXEvLr0uOMc0toQf7AuEYmK/Z9ClVWs7/7U?=
 =?us-ascii?Q?Wk+KtLo2Gm2dxlcLAtEEx63iQpSBmpW2OpoNExob3aqMgeL1w3HTfKJVQ81C?=
 =?us-ascii?Q?KhaBvJDs3EyKJZV4usZ7yzi9Q8QmJfXFownzJLDJBaY7BQ4Prhgeen9KQW+Z?=
 =?us-ascii?Q?vK8QMRntmURCWj9uRF0BKoXctb4Nnh9iYaUbM1Szu22pD7wvHOGrZxu+L5ED?=
 =?us-ascii?Q?85ueft1HMMEk54vUZu0Rm/lajx2w8PP284Sn9eXSzaWN6ealW/4WF7tEFmg7?=
 =?us-ascii?Q?J1ZvfXBNevGbvaOMXZcxSPFo7Q=3D=3D?=
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Mar 2021 15:42:21.4407
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 70db9276-19d7-475e-a498-08d8e311edde
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-AuthSource: DM6NAM10FT013.eop-nam10.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:
	00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6NAM10HT025

 

Tags (2)
0 Ratings
Reply
1 REPLY 1
HolmPC
Aspiring Contributor
415 Views
Message 2 of 2

Re: "Mailbox full" bounce messages when it's not

Go to solution
I've identified this as the result of an account hack. The hacker had set all email to be forwarded to an outlook.com address and it was this mailbox that was full and producing the bounce messages.
0 Ratings
Reply