hi evie

here is the message i got with full headers.

From braintalk@gmail.com Sun Sep 24 18:10:08 2006
X-Apparently-To: address@yahoo.com via 66.163.178.119; Sun, 24 Sep 2006 18:10:17 -0700
X-Originating-IP: [199.201.145.187]
Return-Path: <www@localhost.localhost>
Authentication-Results: mta169.mail.mud.yahoo.com from=gmail.com; domainkeys=neutral (no sig)
Received: from 199.201.145.187 (EHLO localhost) (199.201.145.187) by mta169.mail.mud.yahoo.com with SMTP; Sun, 24 Sep 2006 18:10:16 -0700
Received: by localhost (Postfix, from userid 70) id 073361DE4804; Sun, 24 Sep 2006 21:10:08 -0400 (EDT)
To: address@yahoo.com
Subject: Braintalk Returns!
From: "braintalk@gmail.com" <braintalk@gmail.com> Add to Address Book Add Mobile Alert
Message-ID: <200609250108.77ae6d492632@brain.hastypastry.net >
MIME-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-Mailer: vBulletin Mail via PHP
Date: Sun, 24 Sep 2006 21:10:08 -0400 (EDT)
Content-Length: 331
Greetings. We had a bad software and hardware crash recently and about
a month of downtime, but Braintalk is returning! I'm in the middle of
restoring the server and installing brand new software. Thank you for
your patience, and please visit http://brain.hastypastry.net/forums in
the next few days.

Take care,
-John Lester

Hi Annie

Thank you. I deleted the mail info to keep the addresses from being harvested/collected by spammers.
I will assume that all headers are good unlike in spams where they are often faked.

X-headers are non-standard mail headers added by software on the way somewhere.
The above says that this mail was routed via the Yahoo internal mail system (66.163.178.119 is a Yahoo internal address). The originating IP points back to the IP no that is defined as belonging to brain.hastypastry.net. It could be the machine that crashed or another one that sits there in its place.

The Received: headers are the most interesting in a mail and the main reason why people who follow mails need the full headers.
Every place that receives a mail to pass on will add one received: header. Spammers often spoof them and put in fake nos, times, etc. but here I will assume that the information given is correct.

The above Received: header was added by Yahoo and says the following:
It got the mail from 199.201.145.187 which is the IP of brain.hastypastry.net.
This mail was most probably addressed to several people (for a single address, the receipients address would normally show up in that header).

The above points towards this mail having been generated programmatically; otherwise, it would have more information in it.

If the sending machine really did identify itself as localhost, I certainly would never see this mail. It would be rejected by our mail servers that insist on the sending mail servers identifying themselves with a proper name. "localhost" is, in this context, not a proper name, is very often used by spammers and therefore a mail server calling itself localhost, trying to send mail will be rejected at a lot of places.
To try and explain: you'll most probably be less likely to open the door and invite somebody inside if that somebody rings the door bell and says: "hi, my name is Smith and I have something for you", holding a weird looking package than if somebody rings the bell and says: "hi, my name is Jack Smith, here is my card clearly identifying me and the company I work for". And the same goes for mail servers.

Aha, the msg was generated by a machine calling itself brain.hastypastry.net which is defined to be the forum machine...
...and it was generated by the vBulletin software which is the forum software. So, it most probably was a mass mailing.

Again, the reminder: I assume that all headers are correct and none of them are spoofed like spammers would do it.

To summarise (with all assumptions :) ):
This was a mail generated by the forum software and it was sent via Postfix which is a mail server software. The mail we are looking at here is a mail that was sent to Yahoo mail addresses. There is no way of knowing how many people were addressed in it.

So, to answer your question, mrsd, it does seem as though the addresses either survived or were recovered. It also seems that the functionality of the forum software is at least back to a state that it can send mails again.

This mail would have been rejected at many places if hastypastry.net really did identifiy itself as localhost. At many of the places where it did arrive that have automatic spam filters, it would have ended up in the spam folder.

Curiosity won out :) ...I just went to have a look to see whether hastypastry.net attempted to send mail to me and it did. And it did try to identify itself as localhost which resulted in an automatic rejection from our end...but what I can also see is that it is taking a long time; assuming Sat. was the start of this mass mailing, the mail to me was attempted on Mon. morning (my time)/Sun. evening (local time)...it could still be at it.

cheers
eve

**Major** round of applause (stamping of feet, rolling of drums...) Eve.
What more can I say?
all the best :)

WOW! I acutally understand that! THANK YOU!!
 

Ditto WOW...
 

Thank you so much for this clarification Evie...

Not that I could do this myself, again in the future! <cough cough>

But I checked my full header too..and my mail is very similar.
My local host is somewhat different, but Yahoo has several hubs I believe.
and mine came just before annie's... and also says vBulletin mail via PHP.
( Sun, 24 Sep 2006 21:09:29 -0400 (EDT))

So perhaps JL sent the mails off, then took the server down and hence
we see that MacOS server page now.

So at least we know some of the data was okay on that server before
he took it down.

I have had some Braintalk messages from my PM box go into the spam folder, in the past.
They were not blocked, but just sent there by mistake. It was the typical
overflow automated message, that someone was trying to contact me, etc.
I can't recall if I reset my filter, I may have, because another place was having trouble too. It has been a while since that happened, so I really don't recall exactly.

This has been a real education for me! and also illustrates the complexity of the internet, and "making assumptions" about things --motives-- when in
reality it is just hardware/software complexities!

Thanks so much for walking us thru the "maze of email"!:D

AWESOME Evie!
Thanks!

evie, that has got to be the clearest explanation of anything involving a computer that i have ever seen. i hope they pay you what you are worth.

i edited out my e mail address, fortunately the edit button is now working longer. i did know better than to do it, but i wasn't sure if you needed it in there so i just posted the whole thing.

thanks very much for figuring this out and for that very clear explanation.

Translation from Computereese to Human
 

Evie,
Thank you so much for your clear explanation..though I do admit that my mind dropped off halfway through your excellent translation.

Thank you all for the compliments. :)

I work with this and other Internet related stuff every day so this is just a variation of a never ending subject :)

Annie, I have my own company and I wish I made lots of money with it :) But life interfered and while the big Internet balloon was blown up until it burst, I spent 6 months per year in hospital having surgeries and other things. I did profit from the bubble though as with any other type of company I would have had to close down whereas working in this area allowed me to stay in business :D

cheers
eve

Well I have just got in and did not have to reregister. I tried that yesterday and had no reply. When I tried again this morning I got straight in and read reregistering was unnecessary. You go in using the password and name that you had before. I have just done a post in the complementary forum and it has come up.
Val