Getting a hit on NOTLD but even weirder is why

[Mike From Markham]

I have been running zimbra with out any real issues for over 2 years. A few days ago the strangest thing took place a user received an email with the full EMAIL server name appended to the received FROM address.. The best way to explain this is with the headers below. ive edited the header server names so for this example My email server is called mail.emailserver.ca with 2 domains (company1) as below.


Im totally stumped on how this could take place... As this email went straight to users SPAM folder even though they receive email from this address regularly.


Return-Path: middleeasthub@p3nlh135.shr.prod.phx3.secureserver. net
Received: from mail.emailserver.ca (LHLO mail.emailserver.ca)
(123.123.123.123) by mail.emailserver.ca with LMTP; Wed, 5 Jan 2011
15:21:32 -0500 (EST)
Received: from localhost (localhost.localdomain [127.0.0.1])
by mail.emailserver.ca (Postfix) with ESMTP id 31B869F000A
for <user@company1.com>; Wed, 5 Jan 2011 15:21:32 -0500 (EST)
X-Virus-Scanned: amavisd-new at mail.emailserver.ca
X-Spam-Flag: YES
X-Spam-Score: 5.756
X-Spam-Level: *****
X-Spam-Status: Yes, score=5.756 tagged_above=-10 required=5
tests=[BAYES_40=-0.185, DNS_FROM_OPENWHOIS=1.13,
FH_FROMEML_NOTLD=2.696, HTML_MESSAGE=0.001,
HTML_MIME_NO_HTML_TAG=0.097, MIME_HEADER_CTYPE_ONLY=0.56,
MIME_HTML_ONLY=1.457]
Received: from mail.emailserver.ca ([127.0.0.1])
by localhost (mail.emailserver.ca [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id AgRfqCoAfuBp for <user@company1.com>;
Wed, 5 Jan 2011 15:21:20 -0500 (EST)
Received: from p3nlsmtp02.shr.prod.phx3.secureserver.net (p3nlsmtp02.shr.prod.phx3.secureserver.net [72.167.234.226])
by mail.emailserver.ca (Postfix) with SMTP id A92C69F0009
for <user@company1.com>; Wed, 5 Jan 2011 15:21:20 -0500 (EST)
Received: (qmail 22828 invoked from network); 5 Jan 2011 20:18:44 -0000
Received: from unknown (HELO p3nlh135.shr.prod.phx3.secureserver.net) ([97.74.144.135])
(envelope-sender <middleeasthub@p3nlh135.shr.prod.phx3.secureserver .net>)
by p3nlsmtp02.shr.prod.phx3.secureserver.net (qmail-ldap-1.03) with SMTP
for <user@company1.com>; 5 Jan 2011 20:18:44 -0000
Received: from p3nlh135.shr.prod.phx3.secureserver.net (localhost [127.0.0.1])
by p3nlh135.shr.prod.phx3.secureserver.net (8.13.8/8.12.11) with ESMTP id p05KIh9J028144
for <user@company1.com>; Wed, 5 Jan 2011 13:18:44 -0700
Received: (from middleeasthub@localhost)
by p3nlh135.shr.prod.phx3.secureserver.net (8.13.8/8.12.11/Submit) id p05KIhbU028137
for Reply-To:; Wed, 5 Jan 2011 13:18:43 -0700
Date: Wed, 5 Jan 2011 13:18:43 -0700
Message-Id: <201101052018.p05KIhbU028137@p3nlh135.shr.prod.phx 3.secureserver.net>
To: user@company1.com
Subject: ZIMBRA_CAUGHT_AS_SPAM_Order confirmation from indiamapstore.com
From: sales@indiamapstore.emailserver.ca
Content-type: text/html; charset=iso-8859-1

What would cause .emailserver.ca to be appended to the senders domain?