Body of email breaks distribution list in exchange?

Question

I have a very odd problem that I'm not sure is a programming issue or a server issue :-p.

Basically I'm sending an email to an exchange distribution list that includes a PHP stack trace; during certain faults the trace includes really high level information such as the machine's environment variables (during file reads, etc.).

I went through a copy of the email line by line until the email sent and it appears the line:

[SUDO_COMMAND] => /etc/init.d/httpd restart

is the culprit. Adding a string replacement in before the email is sent allows a successful send. What I don't understand is WHY these stream of characters are causing the issue ONLY on the distribution email.

If I send the email to myself as well, i.e. "group@blah.com; me@blah.com", then I get the email fine. Re-ordering the list doesn't make a difference the group never gets the email.

Because the individual gets the email and not the group I'm assuming the fault is with exchange and some rogue filtering - I've gone through it with the sysadmins and there's no filtering of any sort on that group... so maybe it's a bug?

I can't find anyone else having recorded this specific fault so I figured I'd open it here. For now I'm just not using the distribution list but it'd be nice to eventually find the solution.

Many thanks, Chris

Answer 1

I'm not an Exchange admin (prefer Postfix), but are you positive it's that line and not the one prior or after it? Just a thought....

just to test it, I sent an email containing only that string to a DL on our Exchange server, and while I received it both times, the first time, the notification balloon was blank. The second & third time I saw no artifacts at all, so that first time may have been a red herring.

Answer 2

Is there malware filtering on the Exchange side, especially ones with heuristic checks? It could be something where it sees the message with "suspicious" content. Why it affects only the group could be related to differing routing, such as if the group expansion is set for a specific Exchange server with that filtering (or with it in the mail path to or from that server). Possibly if messages to you and the list address were split at some stage before group expansion, the differing number of recipients in the envelope combined with content could also have tripped some threshold.

Answer 3

Have you used Exchange's message tracking feature to find out what happens to the message? Is it bounced, or does it just never arrive? If the latter, check the system badmail directory to see if the messages are landing there.