Mails are ignored by the filter "Email ignored by 'Ignore sender' filter"

[Frans Brus - No]

Our customer tries to send replies to ServiceNow but the mails are ignored by the filter "Email ignored by 'Ignore sender' filter"

It basically says to ignore all emails if the have the words "mailer-daemon" or "postmaster" in it.

We informed the customer about this but the customer is not satisfied with our answer and urges us to remove this rule because we arre ignoring all international standards.

RFC 5321 and RFC 822. 

I don not have not enough knowledge about email standards to give real feedback to out customer so I hope you can.

Is the customer correct about not using these standards?

Here is a part of the email header which is ignored:

>>>>

Authentication-Results:mail1.customerl; spf=None smtp.pra=email@customer; spf=None smtp.mailfrom=email@customer; spf=None smtp.helo=postmaster@customer.local

Received-SPF:None (mail1.customer: no sender authenticity

  information available from domain of

  email@customer) identity=pra;

  client-ip=xxx.xxx.xxx.xxx; receiver=mail1.customer;

  envelope-from="email@customer";

  x-sender="email@customer";

  x-conformance=sidf_compatible

Received-SPF:None (mail1.customer: no sender authenticity

  information available from domain of

  email@customer) identity=mailfrom;

  client-ip=xxx.xxx.xxx.xxx; receiver=mail1.customer;

  envelope-from="email@customer";

  x-sender="email@customer";

  x-conformance=sidf_compatible

Received-SPF:None (mail1.customer: no sender authenticity

  information available from domain of

  postmaster@customer.local) identity=helo;

  client-ip=xxx.xxx.xxx.xxx; receiver=mail1.customer;

  envelope-from="email@customer";

  x-sender="postmaster@customer.local";

  x-conformance=sidf_compatible

From:Name <email@customer>

To:"'instance@service-now.com'" <instance@service-now.com>

Subject:Re:RITM0014114 - approve

Thread-Topic:Re:RITM0014114 - approve

Thread-Index:code==

Date:Tue, 30 Oct 2018 07:28:34 +0000

Message-ID:<c42b6446f3ce427c9b900161effe8c51@customer>

Accept-Language:nl-NL, en-US

Content-Language:nl-NL

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-originating-ip:[xxx.xxx.xxx.xxx]

x-tm-as-product-ver:SMEX-12.0.0.1220-8.200.1013-24188.005

x-tm-as-result:No--9.307800-0.000000-31

x-tm-as-matchedid:150567-152064-139704-113220-780058-111604-700362-705718-7

00345-701827-700264-702497-700450-700537-700732-701306-852490-709859-111605

-700074-700079-188093-148004-148050-11-10010-20020-42000

x-tm-as-user-approved-sender:Yes

x-tm-as-user-blocked-sender:No

Content-Type:multipart/alternative;

boundary="_000_c42b6446f3ce427c9b900161effe8c51customer_"

MIME-Version:1.0

X-ServiceNow-Source:EmailInbound

X-ServiceNow-SysEmail-Version:2

MultipartContentTypes:text/plain; charset="us-ascii";text/html; charset="us-ascii";

<<<<<

Can anyone help me to understand the issue and how to infom the customer, and how we can help him to change his email(system)?

Can you furthermore explain me about the risk/impact if we deactivate the filter?

[asifnoor]

As i understand, the customer wanted to disable this as they are using the mails which start with the postmaster and those are getting ignored by SN.

Are the sender names having postmaster or mailer-daemon? If yes, find out the reason why such names are being used instead of proper names like info or support or something else?

Also, You can tell them that you are fine to disable but if there is any email bounce or automatic system reply comes from their mailboxes, then SN by default will create incidents. And ask them if they are okay with this? 

If not, then ask them to configure a separate email for email bounces or automatic reply, so that you can configure those email addresses to be ignored, and that would save SN from creating unwanted incidents and saves a lot of clutter.

Kindly mark my answer as correct if this helps.

[asifnoor]

If I have answered your question, please mark my response as correct so that others can get benefitted from it. 

[asifnoor]

If I have answered your question, please mark my response as correct so that others can get benefitted from it. 

[Frans Brus - No · Accepted solution]

Only one of our (+350) customers who are working in the same instance has this issue.
We also have not activated the possibility to create tickets from email. We only allow approvals by email.

I also asked ServiceNow to look into this and they gave me the following answer:

What we found was the smtp helo clause. SMTP helo is a stage where the sending smtp server introduces itself.
The thing is, the receiving mail server accepts any name given by the smtp server.
In this case, the smtp server mail1.customer introduces itself as postmaster@customer.com

This is what triggers the condition of the email filter and sets the email record to received-ignored.
This could be related to the rfc.

A sensible workaround would be to create a new email filter that will ignore incoming emails with users that contain postmaster or mail-daemon instead of the headers.
Please carry out this workaround on your non production instance first.
I advise you keep the default ignore sender filter for good practice and deactivate it.

Currently we are testing this solution on non-prod.