blank email received - what is it ?

[PS56k]

This is not a TB email issue -
but thought I would ask the group for email headers help...

I received this from a friend,
and we can't determine how or why it was sent.

Normally I can tell if email is sent from Outlook or iOS,
as there is a X-Mailer header, but not here.

Also - what are these headers ?

--> X-Autoreply: yes
--> Auto-Submitted: auto-replied

tnx for any insights -

-----

From - Wed Jul 13 22:55:57 2016
X-Account-Key: account2
X-UIDL: 11e6-4976-38642834-91c3-00144fe1ed6c
X-Mozilla-Status: 0013
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:

Status: RO
Return-Path: <x...@gmail.com>
Received: from samuel.mail.atl.earthlink.net ([207.69.200.65])
by mdl-bizarre.atl.sa.earthlink.net (EarthLink SMTP Server) with SMTP
id 1BnxGe3we3Nl36I0; Wed, 13 Jul 2016 23:51:18 -0400 (EDT)
Received: from mail-oi0-f49.google.com ([209.85.218.49])
by samuel.mail.atl.earthlink.net (EarthLink SMTP Server) with ESMTP id
1BnxGd39B3Nl3pv0
for <psch...@interserv.com>; Wed, 13 Jul 2016 23:51:17 -0400 (EDT)
Received: by mail-oi0-f49.google.com with SMTP id r2so100068179oih.2
for <psch...@interserv.com>; Wed, 13 Jul 2016 20:51:17 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

{snipped}

X-Received: by 10.202.215.215 with SMTP id o206mr3516828oig.8.1468468277487;
Wed, 13 Jul 2016 20:51:17 -0700 (PDT)
To: xyz
From:xyz
Date: Wed, 13 Jul 2016 20:51:17 -0700
Message-ID:
<CAPCpxMozjVPn6YNkx8MZ4H_Y...@mail.gmail.com>
In-Reply-To: <hsidwvnx8hq2okv8wxl...@email.android.com>
References: <hsidwvnx8hq2okv8wxl...@email.android.com>
Subject: Re: Sched
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Precedence: bulk
X-Autoreply: yes
Auto-Submitted: auto-replied
X-ELNK-Received-Info: spv=0;
X-Authentication-Results: dkim="pass"; (0:no or failed dkim processing);
dmarc="none"; (1); dwl="miss"; den="not exempt"
X-ELNK-AV: 0
X-ELNK-Info: sbv=1; sbrc=-0; sbf=eb; sbw=000;

<div dir="ltr"><br></div>

[PS56k]

pretty sure it's going to turn out
to be this in Gmail - auto responder -
--

In GMail,
go to Settings --> General
and check your Vacation/Out of Office Responder,
which looks as if it is currently sending auto-responses to everyone who
emails your Gmail account -

See this line in the header: " X-Autoreply: yes "

[Mike Easter]

f/ups set to m.general

PS56k wrote:

> I received this from a friend,
> and we can't determine how or why it was sent.

It was sourced from a gmail webmail account. Gmail webmail sourced
doesn't provide a source IP, ie the IP that accessed the webmailer.

Some of the headers are stamped by EarthLink recipient's server and some
by the recipient's agent.

> Also - what are these headers ?
>
> --> X-Autoreply: yes
> --> Auto-Submitted: auto-replied

Gmail has an autoreply function called Vacation Responder. I haven't
seen or experimentally created any headers from that, but I'm guessing
it might be that.



--
Mike Easter

[Thee Chicago Wolf [MVP]]

This might have some info:
https://github.com/jpmckinney/multi_mail/wiki/Detecting-autoresponders

- Thee Chicago Wolf [MVP]

[VanguardLH]

PS56k wrote:

> Precedence: bulk

That is a client added header. Your "friend" is a spammer? Some
newsletters and bulk mailers will add that header as notice that it was
sent to many recipients (even if only a single recipient was specified
in each sent copy of the bulk mail).

Just HOW did your friend send this e-mail? What client did he use? Did
he use some bulk mailing service to send many copies to a list of his
recipients? Is he using some forum that lets him, as the owner of that
forum, send out notices to his subscribers (Yahoo Groups is like that)?
I've never bothered to investigate Google Groups to know if those forums
have a similar bulk mailing aka newsletter service. (Google Groups is
both Google's own privately-owned forums along with Usenet - yeah,
Google confused the two services by using a common name.)

> Content-Disposition: inline

The sender specified to include an attachment but put it inline.
Attachments can have a disposition of "inline" (inserted within the body
of the message) or "attached" (encoded into a long string to put within
a MIME part which the receiving client should have some means of
notifying the user of an attachment). The encoding is exactly the same
for either disposition but "inline" tells the receiving client to render
the attachment within the body while "attached" tells the receiving
client to show some flag or notice about the attachment (that attachment
is not inserted into the body).

Looks like your sender tried to attach (inline) some external file
perhaps called "ltr" but it failed. Your sender was sending a bulk mail
(the Precedence header) to many recipients and using some bulk mailer
program or service that failed to insert the template file ("ltr") into
the body of the message. If the sender was not using a bulk mailing
program or a bulk mailing service, maybe he was trying to use a
mailmerge feature of Word or another application. Mailmerge is a bulk
mailing feature but not very robust (they typically spew out a copy of
each message to each recipient to deluge the SMTP server and often smack
into anti-spam quotas at the e-mail provider).

Tis also possible you sent an e-mail to someone who configured their
account to automatically reply, like a vacation responder option. The
"X-Autoreply: yes" header usually identifies an auto-responder. You
sent them an e-mail and their auto-responder sends back something like
"On vacation, back after October", or "This account no longer monitored.
Resend your e-mail to my Gmail account", or "This person no longer
employed here" (although at businesses they really should be redirecting
e-mails to another employee that assumes the duties of the ex-employee).

RFC 3834 defines the Auto-Submitted header.
https://tools.ietf.org/html/rfc3834

So it looks like you e-mailed your friend and they use an auto-responder
that screwed up by not inserting their canned response string into the
message the auto-responder sent to you.

I'm not familiar with setting up auto-responders. Since they respond to
one sender at a time (you send them an e-mail, the auto-responder sends
just *one* copy of the canned response to only you), it doesn't seem a
bulk mailing service to warrant including the "Precedence: bulk" header.
Does your friend operate or manage a bulk mailing service, like
newsletters, and you sent his account a request to opt in or opt out?

If this is just a "vacation reply" auto-responder feature of the
sender's Gmail account, I would think Google wouldn't allow enabling
their auto-responder while leaving the response string empty. I just
tried to do that in my Gmail account: enable the vacation responder
option but leave blank the response string. I got a popup saying, "You
have enabled the vacation responder but you have not provided a response
message". I was able to trick their check, however, by enabling their
auto-responder, specify a string in the Subject and response message
(body) fields, save that setup, and then go back to empty out both the
Subjec the response message fields. The auto-responder was still
enabled but it had nothing to return (the fields were blank).

Tell your friend to check the auto-responder in their Google mail
account (gmail or googlemail). However, you sent a message to your
friend that triggered getting back the blank auto-response but maybe you
didn't review your e-mails until long after you had sent an e-mail to
your friend so there was a disconnect between you sending and then
getting back the auto-response.