To: Line

Discussion in 'Help Desk' started by Tim Terrell, Jun 18, 2016.

  1. Tim Terrell

    Tim Terrell New Email

    Jun 18, 2016
    Likes Received:
    I receive emails from a club with news in them. Not long ago I began receiving these emails with a To: line that has my full name and a prodigy server and along with a JR heading with my real email address. I have never had a prodigy email account so the To: line looks very strange to me. I only have email addresses that are similar to I asked about this strange looking To: line and the club "provider" responded that it was SBCGLOBAL's fault. I asked AT&T and they claim the emails are SPAM. It may be because the DKIM failed. AT&T refused to tell me why they thought it was spam nor give me any more information. I do understand that the To: line is a part of the body of the email and can look anyway someone wants it to look. Everytime I get another email the server changes. Here are some examples. There have been many more.
    It is interesting that when the email is formed up or modified whatever is doing it knows the server name.

    I have run header analyses and the results do not shed much light on the situation. There seem to be a number of players some of which are
    various prodigy servers (some kind of mail manager)

    Can someone tell me the sequence of events from the header below. There are multiple Receivers and Originators and I cannot tell who is doing what to whom although email header analyzers do provide me a simplified path. I have run five so far.


    From: 45 2016 <>
    X-Account-Key: account6
    X-UIDL: AG52w0MAFvv+V1hHWAKzaHTvj04
    X-Mozilla-Status: 1001
    X-Mozilla-Status2: 00000000
    X-Apparently-To:; Wed, 08 Jun 2016 16:27:03 +0000
    Received-SPF: pass (domain of designates as permitted sender)
    X-YMailISG: vuMRW.8WLDuXcFvowgOy397Bdhd4gkMwB5EA_eK46T0h1AZL g3X6M4ad4yr4GiFrsAdxlNAOZJDZlABo0Zyx3buO1jDfQ_1iZqhsjUAlpl97 ZG86IGQcUTexnuP_EXZac9zn7mS5a7gDEauUG_bwyIFSk8FrD7oGph0PTa8v dZy72qzfgTBt7DjlTjpqpkQ8aQ9oo9gqqpftYJ_vgOAQzUblMQl3KenLh14V KQMKbZhIQPXbwUTt5yw.ldr66rymlVCjr8TBwu9Z.LvLmp96QGSe0kXHLZfe D1zXK6eT2GgF7DhUMHpSFpPtYkq8ZGX5Vrb7ZVO6XAvjnWEBeHu2xYbpD62d T8m40B4cSgNvgBq8c.fjcww6LVxVn8Q.gsgZ2UnXL5vm89nHlkK.Pr7mhB22 vRkUqJzSyB72t3pTakLlmlbDj_dTybmHowmFbgNj8E77V9fHyUsOcloDvew_ yCWggfBz2OXqkXpgQdgtQRPnmtmkXlquEhTCXhghRhpzbISdIM6GvR4D8n_U 9pa4i1OJunHIRKt1gDudRnC9ZeNoNumRGGSo9REen7zdDtNKNtm0qN4kHZ1S CHKQzAjBdh3CzQz3Fy0n2WDjY7McINtkPoYcDt8BM6riyNwzthKAMo6srJIX LU7HmekH5qIliJqVGkkZ2xPe2orBqZBcyEYAziwZCBClJYblsdMj0f.IY7LB K23s_6mpkKenboEb3M8NZOqMf8LBDc1.LJRy96JRRb6yGIr2HaO3dcMKREbK FRhGK4J5b7IuhOamM9jLmIVtOvaOiDtw2gSEcw1uKPnqz6hNvDkMoDPiT033 MltBwq15H3pj8O1fc2ggalYe.rMx0xoVG300ltK3YVpvZcG3tdd1qFkljVwd PlmgdqXYi_r.Cidoh1fxJem8dc9Zxbsr1_rubYixURNP7oikLnMwt1dyUdFk WuMEzjBcMttO.phtPiI5xim4elxb3wWo59ymeWJ6CLGdxXH0Y2cDlXu8w3fF v7AOGFbt8s8MxSFxUkWxBe.yysycxYVBpsFQPRG2lRwK9z54tLWc7b3wxECP LVBJ0I_5OlGWzWOwwS6GJzmgrFaWEHiGkUKHjZx4v5exg.OHVOEoZBnMdkj8 dv7HbIbMc7NXvVibYCaNBpdoIsor2sHASRZ1hGtypSVAYmM7g_v_dnqebZwJ 3_2lHAvFG67wrB7fYcExABBQhEyXEm3rIozny1byhCXrN.mGesCBIktWmb1c zcu0EVnT4Qt8rg5fkg3KfbTvxPq0yIRn7PnJXf5egj.0zRGTlv6Uh5X.HtOp KspyJFmUZckKS0H7TLDidVZFOPr28k.A9ZKF2Pbw.ckrZAOUAuVKSd1XYwwf nr_p.2z1jpWPpf0fZg2GeoGkXhQqP_B7tWjpdvwi0aQDFbLknMbbGsxrizxE cqTxAD4D5htR9L0VAWLwN4xoYQxsSil79FLN6f592kBvlt_ecJlUwYif.nVx HA--
    X-Originating-IP: []
    Authentication-Results:; domainkeys=neutral (no sig);; dkim=permerror (bad sig)
    Received: from (EHLO ( by with SMTP; Wed, 08 Jun 2016 16:27:03 +0000
    X-Originating-IP: []
    Received: from ( []) by (8.14.4 IN nd2 TLS/8.14.4) with ESMTP id u58GQxop022418 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for <>; Wed, 8 Jun 2016 11:27:02 -0500
    DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=em;; h=Message-ID[​IMG]ate:List-Unsubscribe:Subject:To:From:Reply-To:MIME-Version:Content-Type; bh=TqFV5tRhRotctVqPXYXXupH7XMY=; b=Y+Ih6ZaSU+CodvqAkc9aHzzEjlS0mbeBJwS8uHlHxsCR34i6LU0KVt+MO+NvZX3ydLmPFjDutyBe XnBLbwXuACGZkbh2htmOJCq/k2rc96m8D/ldGrJBefHsWGN4itCWfkX2GLQLktSDffRVkzdvXW0O Imi8kBanxJugxshfDXw=
    DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=campaigner;; h=Message-ID[​IMG]ate:List-Unsubscribe:Subject:To:From:Reply-To:MIME-Version:Content-Type; bh=TqFV5tRhRotctVqPXYXXupH7XMY=; b=wjEsmNqsihM+zFzU+2bT8F6ytnjFYGnNcGQGKe7Snx6EZuZlGZaNvKycp0xnKSAaPe/YSc/T4EPZ msuKS+4D4uNt19Q9VPkNitSX9kTCQx2b8K7VIwdNI2dnjB0IOuXs2A9IQHTnHBjzdnu4mDG+U24b KXrbrszNaiJWL1rnhMk=
    Received: by id hb13ku159ukl for <>; Wed, 8 Jun 2016 12:25:57 -0400 (envelope-from <>)
    Message-ID: <>
    Date: Wed, 8 Jun 2016 12:25:57 -0400
    X-Campaign: 14646264/18877059/4271503327
    List-Unsubscribe: <>
    Subject: CLUB Update 6-8-16
    To:, JR. <>
    From: CLUBNAME <>
    Reply-To: CLUBNAME <>
    MIME-Version: 1.0
    Content-Type: text/html;charset=UTF-8

  2. popowich

    popowich EQ Forum Admin Staff Member

    Aug 12, 2008
    Likes Received:
    It appears to be appending the server name used to send the email to the To: line, likely because when sending that To doesn't have an @domain on it which is causing the server to append it.

    The server name is changing since most "outgoing server names" for ISP's etc are really pools of many load balanced servers all behind the same name.

  3. Tim Terrell

    Tim Terrell New Email

    Jun 18, 2016
    Likes Received:
    So what is the sequence of events? If the To: line is a part of the email then why would the server see there is no @domain. It has my actual email address somewhere else and uses that to get the email to me. If is sending the email out then what is doing? "Campaigner® is an email service provider, and email sent from comes from our subscribers." I do not understand the flow or the players.

Want to reply or ask your own question?

It only takes a minute to sign up (and it's free!). Click the orange sign up button to choose a username and then you can ask your own questions on the forum.