| 
		
		
	 | 
	
	 Original Message Source (sanitized): 
Return-Path: <user@gmail.com> 
Received: from mail2.domain.com 
by mail2.domain.com (Dovecot) with LMTP id FA71B+cv31VaGAAA3OIF/Q 
; Thu, 27 Aug 2015 21:13:17 +0530 
Received: from mx2.domain.net (mx2.domain.net [74.xxx.xxx.xxx]) 
by mail2.domain.com (Postfix) with ESMTPS id D5A8FD180557 
for <user@domain.com>; Thu, 27 Aug 2015 21:13:16 +0530 (IST) 
Received: from mail-pa0-f45.google.com ([209.85.220.45]) 
by mx2.domain.net with esmtps (TLSv1.2:RC4-SHA:128) 
(Exim 4.85) 
(envelope-from <user@gmail.com>) 
id 1ZUzJ8-0003nv-9q 
for user@domain.com; Thu, 27 Aug 2015 11:41:48 -0400 
Received: by pacgr6 with SMTP id gr6so11678445pac.3 
for <user@domain.com>; Thu, 27 Aug 2015 08:41:41 -0700 (PDT) 
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; 
d=gmail.com; s=20120113; 
h=from:to:subject:date:message-id:mime-version:content-type 
:content-language:thread-index; 
bh=sSySlqHx9Vf/+MEV/Zo67nbPykHilOGwOlTJ45NwpOI=; 
b=rYuts5ibRTChNFSG7u1h2UyngP+/puL41m2fyCdtKNk59FkcrWTroZv7OTm0izAkf6 
nvk8rJWz997usAE3SY8Jaln5L+3YbA0gW9wDoQw+SgdKZjVGgrHfe8uexIMC4jw/GFxa 
EXGF74W4gjCGDCRdlydI1WqtW0h/UohSyUDy8d8XZgIMcf2PT+AoGBqVJ89dXF3GbScw 
fnwopZw44EOdvj2fuucxbf2tw/2FucCUOaw+ATrqW+Dfeh/ebMWZTat9alP0sajaZwO4 
qEBT27Gil6zEj7jNFhUAY6rs0BYGuOTrlUid5hvrUMMT+G7UgDKeq7eE1Z/Jcf3iFgEe 
IWAg== 
X-Received: by 10.69.12.33 with SMTP id en1mr7500821pbd.97.1440690100949; 
Thu, 27 Aug 2015 08:41:40 -0700 (PDT) 
Received: from Dell ([124.xxx.xxx.xxx]) 
by smtp.gmail.com with ESMTPSA id w6sm2832832pdn.46.2015.08.27.08.41.38 
for <user@domain.com> 
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); 
Thu, 27 Aug 2015 08:41:40 -0700 (PDT) 
From: "User" <user@gmail.com> 
To: <user@domain.com> 
Subject: Test 
Date: Thu, 27 Aug 2015 23:41:39 +0800 
Message-ID: <871d01d0e0de$dfb70720$9f251560$@gmail.com> 
MIME-Version: 1.0 
Content-Type: multipart/alternative; 
boundary="----=_NextPart_000_871E_01D0E121.EDDAE360" 
X-Mailer: Microsoft Outlook 15.0 
Content-Language: en-us 
Thread-Index: AdDg3tfggDDX/PkOS+WcITuEDRBEsQ== 
X-Antivirus: avast! (VPS 150827-0, 27/08/2015), Outbound message 
X-Antivirus-Status: Clean 
Received-SPF: pass (mx2.domain.net: domain of gmail.com designates 209.85.220.45 as permitted sender) client-ip=209.85.220.45; envelope-from=user@gmail.com; helo=mail-pa0-f45.google.com; 
X-SPF-Result: mx2.domain.net: domain of gmail.com designates 209.85.220.45 as permitted sender 
Authentication-Results: mx2.domain.net; dmarc=pass header.from=gmail.com 
X-Filter-ID: s0sct1PQhAABKnZB5plbIcmfyoaeJJA5U1wYGh1SeFbgqdjY83C8F3nyJIBATic1ZlPPEMQ1sApk 
7kcHVTPcfQ4nmWJKt/vt1/Gk+iJgp2ES1p4Y1RXkElkx0pKW4Xs0ERWeKKG4PAQYNyavp7c49JS5 
RagvVWAtx/zKdQ/6dt+ncmiK7Zco8MPBEpKMNy1clS3pcIM8/bcvSE3kQDC5Mqvgy/D14lSjIuYH 
FMoDHQQ8AJMaBatHnafPiKcKL4/BYiAGRFbuLCtSljQo8fbqDrBzuwIHCgNdbAV1uUpVVsRgVotb 
oCnB36SmCfkj8hz85YE5enyccp7RH4WQio3uGUphUOTCuwQEGihbqDh0KJ51gMljEk6Qcq6tXqK2 
7d+QcuhY9nYDlc78I3zsDk/+3Do6vZ0VzWcY+Mv3BrFZ0OoAU59dWkSYIxACD1p54eJk3N3mR7B+ 
tJwrUc6LIc0nTudnxqIWJb2VLgXRKBQlc7CWcRpN1+1Pwq6Xpmk2BKo08bczhdhMiuGc7RKtcaWB 
EsMjh2a9N+rSiVn95dKlohwIo/0CJiIFjM9L39GSltgFrQkqqQ1qQTTN7wbrTBAnbfY4ocfmWv3F 
e9Iziczdq+A= 
X-Report-Abuse-To: spam@mx1.domain.net 
X-Filter-Fingerprint: IFrWXGses7OKB5S5G8/dJSzJ+nIQaeys2NdRY49AYNRA3cTUQ1R++keuE7RDJ8Kg3RbMLUalw1oC 
mj99/u+Pol7jVop6A9jB5e0iklqxH6Kok1JBYnOLzfRIhlEHQynLUpndEJ0YoaLytXXo8BMTaX2p 
Mk7LBarWD9Fj4R3eIu6hRW81gsiK49JiuSr1ZvUvLXDeuFcjvKlYdwLNF4uyRJ6jB2zM4iaFfVNC 
PlXIN7PkWYsLPMmWrsjCizhiEGsW 
Authentication-Results: domain.net; spf=pass smtp.mailfrom=user@gmail.com 
Authentication-Results: domain.net; dkim=pass header.i=gmail.com 
X-SpamExperts-Class: ham 
X-SpamExperts-Evidence: Combined (0.15) 
X-Recommended-Action: accept 
This is a multipart message in MIME format. 
------=_NextPart_000_871E_01D0E121.EDDAE360 
Content-Type: text/plain; 
charset="US-ASCII" 
Content-Transfer-Encoding: 7bit 
Test 
 
This email has been checked for viruses by Avast antivirus software. 
https://www.avast.com/antivirus 
------=_NextPart_000_871E_01D0E121.EDDAE360 
Content-Type: text/html; 
charset="US-ASCII" 
Content-Transfer-Encoding: quoted-printable 
<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr= 
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" = 
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:= 
//www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV=3D"Content-Type" CONTENT= 
=3D"text/html; charset=3Dus-ascii"><meta name=3DGenerator content=3D"Micros= 
oft Word 15 (filtered medium)"><style><!-- 
/ Font Definitions / 
@font-face 
{font-family:"Cambria Math"; 
panose-1:2 4 5 3 5 4 6 3 2 4;} 
@font-face 
{font-family:Calibri; 
panose-1:2 15 5 2 2 2 4 3 2 4;} 
/ Style Definitions / 
p.MsoNormal, li.MsoNormal, div.MsoNormal 
{margin:0in; 
margin-bottom:.0001pt; 
font-size:11.0pt; 
font-family:"Calibri",sans-serif; 
mso-fareast-language:EN-US;} 
a:link, span.MsoHyperlink 
{mso-style-priority:99; 
color:#0563C1; 
text-decoration:underline;} 
a:visited, span.MsoHyperlinkFollowed 
{mso-style-priority:99; 
color:#954F72; 
text-decoration:underline;} 
span.EmailStyle17 
{mso-style-type:personal-compose; 
font-family:"Calibri",sans-serif; 
color:windowtext;} 
=2EMsoChpDefault 
{mso-style-type:export-only; 
font-family:"Calibri",sans-serif; 
mso-fareast-language:EN-US;} 
@page WordSection1 
{size:8.5in 11.0in; 
margin:1.0in 1.0in 1.0in 1.0in;} 
div.WordSection1 
{page:WordSection1;} 
--></style><!--[if gte mso 9]><xml> 
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> 
</xml><![endif]--><!--[if gte mso 9]><xml> 
<o:shapelayout v:ext=3D"edit"> 
<o:idmap v:ext=3D"edit" data=3D"1" /> 
</o:shapelayout></xml><![endif]--></head><body lang=3DEN-SG link=3D"#0563C1= 
" vlink=3D"#954F72"><div class=3DWordSection1><p class=3DMsoNormal><b><span= 
style=3D'font-size:14.0pt;color:red'>Test<o:p></o:p></span></b></p></div> 
<br /><br /> 
<hr style=3D'border:none; color:#909090; background-color:#B0B0B0; height: = 
1px; width: 99%;' /> 
<table style=3D'border-collapse:collapse;border:none;'> 
<tr> 
<td style=3D'border:none;padding:0px 15px 0px 8px'> 
<a href=3D"https://www.avast.com/antivirus"> 
<img border=3D0 src=3D"http://static.avast.com/emails/avast-mail-stamp.= 
png" alt=3D"Avast logo" /> 
</a> 
</td> 
<td> 
<p style=3D'color:#3d4d5a; font-family:"Calibri","Verdana","Arial","Helv= 
etica"; font-size:12pt;'> 
This email has been checked for viruses by Avast antivirus software. 
<br><a href=3D"https://www.avast.com/antivirus">www.avast.com</a> 
</p> 
</td> 
</tr> 
</table> 
<br /> 
</body></html> 
------=_NextPart_000_871E_01D0E121.EDDAE360-- 
Forwarded Email (Sanitized): 
Return-path: <user@gmail.com> 
Envelope-to: user@domain.net 
Delivery-date: Thu, 27 Aug 2015 10:46:57 -0500 
Received: from [74.119.146.184] (port=48949 helo=mx2.domain.net) 
by megami.domain.net with esmtps (TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256) 
(Exim 4.85) 
(envelope-from <user@gmail.com>) 
id 1ZUzOC-0005EB-PD 
for user@domain.net; Thu, 27 Aug 2015 10:46:56 -0500 
X-DKIM-Failure: bodyhash_mismatch 
Received: from mail2.domain.com ([199.xxx.xxx.xxx]) 
by mx2.domain.net with esmtps (TLSv1.2:DHE-RSA-AES256-SHA:256) 
(Exim 4.85) 
(envelope-from <user@gmail.com>) 
id 1ZUzOA-0004Bd-6V 
for user@domain.net; Thu, 27 Aug 2015 11:46:57 -0400 
Received: by mail2.domain.com (Postfix, from userid 1302) 
id 90359D1806E9; Thu, 27 Aug 2015 21:18:21 +0530 (IST) 
X-Sieve: Pigeonhole Sieve 0.4.2 
X-Sieve-Redirected-From: user@domain.com 
Received: from mail2.domain.com 
by mail2.domain.com (Dovecot) with LMTP id tW5hDUUx31V9GgAA3OIF/Q 
; Thu, 27 Aug 2015 21:18:21 +0530 
Received: from mx2.domain.net (mx2.domain.net [74.xxx.xxx.xxx]) 
by mail2.domain.com (Postfix) with ESMTPS id B6E64D1807BC 
for <user@domain.com>; Thu, 27 Aug 2015 21:18:20 +0530 (IST) 
Received: from mail-pa0-f44.google.com ([209.85.220.44]) 
by mx2.domain.net with esmtps (TLSv1.2:RC4-SHA:128) 
(Exim 4.85) 
(envelope-from <user@gmail.com>) 
id 1ZUzAQ-0002xN-As 
for user@domain.com; Thu, 27 Aug 2015 11:32:45 -0400 
Received: by pacdd16 with SMTP id dd16so29150191pac.2 
for <user@domain.com>; Thu, 27 Aug 2015 08:32:40 -0700 (PDT) 
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; 
d=gmail.com; s=20120113; 
h=from:to:subject:date:message-id:mime-version:content-type 
:content-language:thread-index; 
bh=eQgZqPWNsOhRQhdivlUhuMT550ey/H3ItJM++bDP2LA=; 
b=HbMrLpGZdLyL/tkF7YdNJKU2h65slG8olZiuoP6QIhMn3KhRpdRs76rZZESPsbAxgU 
Hyb8tq62fhXPnoaj3PD0sSaZx/dYwPKFPLtcvIMQF4Qk4JimryL0htOrmJU18HXDAbhN 
pCuKPcFpH4RyXZVuJQxblllzjMuxFQewLYBzbP3DEfMJaLZuWqPcLLr3bjiXEYzjrH2P 
UOSIOfJmaCs4Y56ow/Zl8L1n0UEWqeP0wF2BWUD1O3hDd5WoAgXMoRAoUbrZzeSjpDTm 
opmtYEJit9RtM6snj9n+EB+hIOZJh1wpNAqqk6UzrAlx42mps5buWkgsF7mraHjFACKh 
/uwQ== 
X-Received: by 10.68.98.5 with SMTP id ee5mr7419717pbb.95.1440689560712; 
Thu, 27 Aug 2015 08:32:40 -0700 (PDT) 
Received: from Dell ([124.xxx.xxx.xxx]) 
by smtp.gmail.com with ESMTPSA id rd8sm2823429pdb.10.2015.08.27.08.32.38 
for <user@domain.com> 
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); 
Thu, 27 Aug 2015 08:32:40 -0700 (PDT) 
From: "USER" <user@gmail.com> 
To: <user@domain.com> 
Subject: Test 
Date: Thu, 27 Aug 2015 23:32:38 +0800 
Message-ID: <86dc01d0e0dd$9dd1f000$d975d000$@gmail.com> 
MIME-Version: 1.0 
Content-Type: multipart/alternative; 
boundary="----=_NextPart_000_86DD_01D0E120.ABF5CC40" 
X-Mailer: Microsoft Outlook 15.0 
Content-Language: en-us 
Thread-Index: AdDg3Zk0+bePG3dXT9u5nTMHg6aGnw== 
X-Antivirus: avast! (VPS 150827-0, 27/08/2015), Outbound message 
X-Antivirus-Status: Clean 
Received-SPF: pass (mx2.domain.net: domain of gmail.com designates 209.85.220.44 as permitted sender) client-ip=209.85.220.44; envelope-from=user@gmail.com; helo=mail-pa0-f44.google.com; 
X-SPF-Result: mx2.domain.net: domain of gmail.com designates 209.85.220.44 as permitted sender 
Authentication-Results: mx2.domain.net; dmarc=pass header.from=gmail.com 
X-Filter-ID: s0sct1PQhAABKnZB5plbIcmfyoaeJJA5U1wYGh1SeFbgqdjY83C8F3nyJIBATic1ZlPPEMQ1sApk 
7kcHVTPcfQ4nmWJKt/vt1/Gk+iJgp2ES1p4Y1RXkElkx0pKW4Xs0ERWeKKG4PAQYNyavp7c49M6f 
1exnmC/gl/bRoVKXqhGncmiK7Zco8MPBEpKMNy1clS3pcIM8/bcvSE3kQDC5Mqvgy/D14lSjIuYH 
FMoDHQQk3DG7wkVtcuAJ29Lq8p6kJVFPpTUN0nA/BmovnlPTZ7BzuwIHCgNdbAV1uUpVVsQuePTo 
nd1m69N1XfSZssxS5YE5enyccp7RH4WQio3uGUphUOTCuwQEGihbqDh0KJ51gMljEk6Qcq6tXqK2 
7d+QcuhY9nYDlc78I3zsDk/+3IA/aFZgFs3xGoNy3Nh9J0kAU59dWkSYIxACD1p54eJk3N3mR7B+ 
tJwrUc6LIc0nTudnxqIWJb2VLgXRKBQlc7CWcRpN1+1Pwq6Xpmk2BKo08bczhdhMiuGc7RKtcaWB 
EsMjh2a9N+rSiVn95dKlohwIo/0CJiIFjM9L39GSltgFrQkqqQ1qQTTN7wbrTBAnbfY4ocfmWv3F 
e9Iziczdq+A= 
X-Report-Abuse-To: spam@mx1.domain.net 
X-Filter-Fingerprint: IFrWXGses7OKB5S5G8/dJSzJ+nIQaeys2NdRY49AYNRA3cTUQ1R++keuE7RDJ8Kg3RbMLUalw1oC 
mj99/u+Pol7jVop6A9jB5e0iklqxH6Kok1JBYnOLzfRIhlEHQynLUpndEJ0YoaLytXXo8BMTaX2p 
Mk7LBarWD9Fj4R3eIu6hRW81gsiK49JiuSr1ZvUvLXDeuFcjvKlYdwLNF4uyRJ6jB2zM4iaFfVNC 
PlXIN7PkWYsLPMmWrsjCizhiEGsW 
Authentication-Results: domain.net; spf=pass smtp.mailfrom=user@gmail.com 
Authentication-Results: domain.net; dkim=pass header.i=gmail.com 
X-SpamExperts-Class: ham 
X-SpamExperts-Evidence: Combined (0.15) 
X-Recommended-Action: accept 
Received-SPF: softfail (mx2.domain.net: transitioning domain of gmail.com does not designate 199.187.211.55 as permitted sender) client-ip=199.187.211.55; envelope-from=user@gmail.com; helo=mail2.domain.com; 
X-SPF-Result: mx2.domain.net: transitioning domain of gmail.com does not designate 199.187.211.55 as permitted sender 
Authentication-Results: mx2.domain.net; dmarc=none header.from=gmail.com 
X-Filter-ID: s0sct1PQhAABKnZB5plbIcmfyoaeJJA5U1wYGh1SeFbgqdjY83C8F3nyJIBATic10JuF70A4EJMc 
Wn6O/bsgoc0gb5wOIuckWcJmxxJEpDyjacp33byqPKI5IYpOXoggQD+cVCwnWlSw8F2WaMXc4g70 
3Z37EieN+1jpicnLcOBobIYg26mzt+LCaQT8afc0SmH4wpsItKy4au0tyWqItExGC0T0L1lRTwCx 
J0JxroJyQg6Mp/cPd7mHBF+73VohZuM7jUXIESohoO51xWmU8eb57Q0cSyvQOQztY9VHOK7TmvAY 
sxZGYJHt61yShXCvKjcneasDLIGpFcsGEtYlGaOAaM/9OU+HEBdy3qW+Ke405guNsa2Nl1J/2pvG 
Kzmaq53LmUSbKknfllg+p/kUIn8NWeTtD3WKlE6p8/9SYqjxCwhh7whrqKZoWBgzg0gKcUOHogKQ 
X2Lr1nbVams5RRuxM0nq89i/mBJqUmBvym1KesJRAGH4qOEbWLGKRGchCQcVs22l4m8r/IL7U5Rj 
C2iH1Wgh6RAenBR+licROGbXeuAdI0siBBXgJzZ5d5X7V9tVbc9d14ioOS9YyCzm2A== 
X-Report-Abuse-To: spam@mx1.domain.net 
X-Filter-Fingerprint: IFrWXGses7OKB5S5G8/dJdIz5bb8V0ykx8BnFBnunHBA3cTUQ1R++keuE7RDJ8Kg3RbMLUalw1oC 
mj99/u+Poh38tEMU4IgC4sNz49qn3HHnhRv/ZJ3kEy8bfiAr+Fb/UpndEJ0YoaLytXXo8BMTaVt0 
ARHRi6XGuAluI1udprGcAcorM8/TJ1ypXRjlFrYbeC3lsCtQmzfFO9m//bKdxR0S7D21SKiJOPcT 
2lX28Tnztq/ZOKeLCrsJVilNc2qvjtKlS9T1LZbChXPnSXRDMN3Yob//INnIFiQO35T9z2s= 
Authentication-Results: domain.net; spf=softfail smtp.mailfrom=user@gmail.com 
Authentication-Results: domain.net; dkim=fail (bodyhash_mismatch) header.i=gmail.com 
X-SpamExperts-Class: ham 
X-SpamExperts-Evidence: Combined (0.15) 
X-Recommended-Action: accept 
X-Antivirus: avast! (VPS 150827-0, 27/08/2015), Inbound message 
X-Antivirus-Status: Clean 
Content-Type: text/plain; 
charset="US-ASCII" 
Content-Transfer-Encoding: 7bit 
Test 
 
This email has been checked for viruses by Avast antivirus software. 
https://www.avast.com/antivirus 	 | 
		| 
		
		
	 | 
	
	 Hi. I am testing using Gmail as an example. This happens for all of the forwarded HTML emails. We are using the Managesieve built into Dovecot which processes the sieve script saved by SOGo in the user's home directories and forwards the emails as required.   
I did saw that thread earlier today, and was testing upgrading Postfix to see if that will solve the issue, but it broke other components of the setup, so had to revert back for now.  
Will test this further and report back. 	 |