tesco.net email

[wickham]

I received an email last night from a tesco.net address and clicked reply and sent a reply which bounced. I checked the headers and the from and reply to addresses were the same tesco.net address.

I then discovered that the person had changed his email address from dsl.pipex.com to tesco.net a few years ago and thought that my reply had swapped the tesco.net address to my old contacts address, although I don't think that should happen.

I deleted the old pipex email address and replied again to tesco.net but it failed.

I tried the dsl.pipex.com address but that bounced too.

I used an email verification website which said that tesco.net was bad so I tried tesco.com which said the address was good, so I tried that but it still bounced.

I now know that teco.net email has stopped in June 2018, but why should I get an email from it last night?

Should tesco.com work? It verified as good but bounced.

[wickham]

I managed to get his phone number from a friend and phoned him. He said that tesco.net had stopped and his new email address was shown in the email sent to me last night - but it wasn't! The tesco.net address was shown. How did this happen?

[JonE]

I now know that teco.net email has stopped in June 2018, but why should I get an email from it last night?

Should tesco.com work? It verified as good but bounced.

Tesco.com is for emails to Tesco itself and is a valid destination - but, unsurprisingly, the precise address to which you sent email doesn't exist there.

The tesco.net email service closed on 27th June: an account-holder couldn't send or receive or even access the account from then BUT if forwarding had already been set up on an account then incoming emails would have been forwarded to the address specified by the account-holder until 10th October.

Where an email purports to come from is not necessarily where it actually comes from. Delete references to the tesco.net email address in your address books.

Cheers!

[wickham]

It's still a bit of a mystery. Although I now know his new email address, someone else might get a similar email from him and be unable to reply so I would like to warn him.

You said "BUT if forwarding had already been set up on an account then incoming emails would have been forwarded to the address specified by the account-holder until 10th October." There wasn't any incoming email to him or forwarding by him and the email was sent on 27th October.

He said he sent me a new email from his new gmail account. I've looked at the email headers closely and gmail isn't shown at all. The From and Reply To addresses are all tesco.net, so if he sent from gmail did it pass through tesco.net which forwarded it to me?

Either that or he sent it from tesco.net by mistake, but that should have bounced back to him.

[JonE]

You said "BUT if forwarding had already been set up on an account then incoming emails would have been forwarded to the address specified by the account-holder until 10th October." There wasn't any incoming email to him or forwarding by him and the email was sent on 27th October.

I wrote that to fill out the picture regarding tesco.net rather than because I thought it somehow applied to this specific email. That snippet of info may help explain how a sub=set of tesco.net account holders might have continued to see emails sent to them at that address despite tesco.net having formally closed back in June.

He said he sent me a new email from his new gmail account. I've looked at the email headers closely and gmail isn't shown at all. The From and Reply To addresses are all tesco.net, so if he sent from gmail did it pass through tesco.net which forwarded it to me?

It certainly didn't pass through tesco.net - the machines aren't there. Are you reading the raw headers in the source and seeing no suggestion whatsoever of gmail or google in any "Received: from..."?

Either that or he sent it from tesco.net by mistake, but that should have bounced back to him.

The tesco.net machines aren't there for him or his email client to reach for login. He wouldn't have been able to send it.

Bear in mind, too, that undeliverable emails aren't necessarily bounced back: they could just be silently dropped by the destination server so the absence of 'a bounce' isn't a reliable indicator of anything for diagnostic purposes..

Cheers!

[chas49]

He said he sent me a new email from his new gmail account. I've looked at the email headers closely and gmail isn't shown at all. The From and Reply To addresses are all tesco.net, so if he sent from gmail did it pass through tesco.net which forwarded it to me?

You can configure GMail to "Send mail as" another address... which is how I have mine set up

A message sent by me shows my own domain in the From: field, but my actual Gmail address in the "Return Path" field. I note you have examined the headers already, but this might be worth checking?

[wickham]

Are you reading the raw headers in the source and seeing no suggestion whatsoever of gmail or google in any "Received: from..."?

Received: from HE1EUR01HT035.eop-EUR01.prod.protection.outlook.com
(2603:10a6:7:53::37) by HE1P195MB0076.EURP195.PROD.OUTLOOK.COM with HTTPS via
HE1P189CA0024.EURP189.PROD.OUTLOOK.COM; Sat, 27 Oct 2018 16:52:46 +0000
Received: from HE1EUR01FT055.eop-EUR01.prod.protection.outlook.com
(10.152.0.58) by HE1EUR01HT035.eop-EUR01.prod.protection.outlook.com
(10.152.0.209) with Microsoft SMTP Server (version=TLS1_2,
ciper=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1294.14; Sat, 27 Oct
2018 16:52:45 +0000
Authentication-Results: spf=neutral (sender IP is 212.159.14.17)
smtp.mailfrom=tesco.net; hotmail.com; dkim=none (message not signed)
header.d=none;hotmail.com; dmarc=fail action=none header.from=tesco.net;
Received-SPF: Neutral (protection.outlook.com: 212.159.14.17 is neither
permitted nor denied by domain of tesco.net)
Received: from avasout02.plus.net (212.159.14.17) by
HE1EUR01FT055.mail.protection.outlook.com (10.152.1.28) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id
15.20.1294.14 via Frontend Transport; Sat, 27 Oct 2018 16:52:45 +0000
X-IncomingTopHeaderMarker: OriginalChecksum:BF68767EDA4BFFE7C985FCF0AB7F09A9906C00236952D977673C09346AD1F569;UpperCasedChecksum:E804DFFD2B10BF5D743ADF0CBEEBC11000757D184C359CD26D9160FB8DF13142;SizeAsReceived:1326;Count:13
Received: from [192.168.1.64] ([87.115.**.**])
by smtp with ESMTP
id GRpKgR2fcx6b6GRpLgp1yL; Sat, 27 Oct 2018 17:52:44 +0100
X-CM-Score: 0.00
X-CNFS-Analysis: v=2.3 cv=T4GiscCQ c=1 sm=1 tr=0
a=DRhj5CoDB4jTe/8V97hccg==:117 a=DRhj5CoDB4jTe/8V97hccg==:17
a=fmD_JHji_u0A:10 a=r77TgQKjGQsHNAKrUKIA:9 a=ltIjDeEzZGTC29SOHl8A:9
a=QEXdDO2ut3YA:10 a=uVhb0EPuAAAA:8 a=S6SzTbG0PKIWP7wydKYA:9
a=99Ha3Dcl1xmPSKWq:21 a=UiCQ7L4-1S4A:10 a=hTZeC7Yk6K0A:10 a=_W_S_7VecoQA:10
a=frz4AuCg-hUA:10 a=2eb-C5YfHNN9I4_Vz44A:9 a=opf97pOdm0Lx4tgk:18
a=KQqxNPgzF0kA:10 a=DIyJOsdSk80A:10 a=WZPYXuWY5o71WrsuGNMA:9
a=LGnI2sFVDBsGKyXD:18 a=RKaKAYOmPy0vm4y19U4M:22 a=4Qrs5Mp5_XtZQ5dpu0FD:22
a=HH7FIXwXL_sUf1zzYxQd:22
To: *** <***@hotmail.com>
From: *** <***@tesco.net>
Subject: Queries
Message-ID: <ae579c23-232e-48ff-bc3a-ed452c3fa5d1@tesco.net>
Date: Sat, 27 Oct 2018 17:52:41 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101
Thunderbird/60.2.1
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="------------E83571B154FDF4BB5CED7604"
Content-Language: en-GB
X-CMAE-Envelope: MS4wfPlvizQgQi7uYmzs4eIgjGRrnTWQ4zJadre/Dga3baD9SzvDsXOBq02k7Iqv8ufg50u6ECMZuW7pyEYqP81mtkVnxzUllPerEHor3MU1qz9BhcZuNOx+
+T+5H7f/MuzAvg96EEKgUDJUIYXqiVrBA2IjqISfbnQcSldtS+Y4XOKo
X-IncomingHeaderCount: 13
Return-Path: ***@tesco.net
X-MS-Exchange-Organization-ExpirationStartTime: 27 Oct 2018 16:52:45.2989
(UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 2:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id: 94d16cdf-bbba-4c01-88c8-08d63c2c9e62
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-Microsoft-Exchange-Diagnostics: 1;HE1EUR01FT055;1:UhruHN67zdaF1ibNfMnEm3qQZu4cUk60mmedEHxwIfpSC2Jwlvvu7RS81UluvdQnWTlRX9KrP5FDJDpTQdokeaq3FPpRenn62eCCbAqQrbxZO+jccyH8gx3nvOVdJyx6
X-Forefront-Antispam-Report: EFV:NLI;
X-MS-Exchange-Organization-AuthSource:
HE1EUR01FT055.eop-EUR01.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 94d16cdf-bbba-4c01-88c8-08d63c2c9e62
X-Microsoft-Antispam:
BCL:0;PCL:0;RULEID:(5000110)(711020)(4605076)(610169)(8291501071);SRVR:HE1EUR01HT035;
X-Microsoft-Exchange-Diagnostics:
1;HE1EUR01HT035;3:MQK1iFyI1Ybu6jjR1PeCwvn71G6Pls8vUukaETOIIKAVQOJGPTwVMcCaK0sZNQqatUQfFyCyAeXDLegJcKa+7YztECxaVngPPXEuCZOQuYeQ76E9uBaf/kpJuj+B3mcvDWcLcDtlcmscCIDacd2ZN5tdDgI3uQ5zkaD5fp4Eyzq0RKVPDXdMlNVNwUjWWsa4TfVVhRnOdE8coLAt9n5bUQizCzawExzQzIvVQujKZkylpVHClOr6f0KY9y/+kfrWq7rOlbm5ro2Byp12pbvT9kU47CAd9x53I+5EpVZ7N9AQA0sQp3zeQJd+WHS5huwBW1lmlxoOhnTea4kZ1qzToA==;25:qGU726FCb4d055rVfMx7XvjzuX5rAkD0AXqg+I0pgq85yqBVG3AxMxk8rIdYxJoMimPzs7Duv4ktgKHwk9BLWRUZS27uat3UJT2E0jrT9e2/0uDhI4AqLv6eQv8SWWJj4JvpFDhv4N+fuUQvtRi8AqsN4mCCueB5E0BZW+0BzsUyst7jPd4jlxiFyK2RY83iU05GnFPTWSvmcLG/ilRKqFHk4kafoGOT1Wj8UNaXV8rfFpigRPcK9XwnXtp1ncnp4FCR7gh52KbSqZP62I3NUHEiUZxDWf4+xx6OrDQh5iFx4ee+427Ct0R5PUU1P3rMtxRgZ193oGzUCXHOPVP0yA==;31:vLoksleIn3vZuPxnmjjYNUKuM3UCINmHA5gqkocu+6c0uZ6fVPQjlUD8XDMvdqCzSQI/09neuVDU1AC2HrjvFU0N+6pnE+L2BXAQytjH4iu6VVSiHbx/BCkxJ/m7SghqNhaBKZuwTh1KBKwCrd6AlGtpeKh6Lw//elLcfckhtZHAGZ30IWEo1BRX7ZzpU/FH5VMOfC9PWIQ3cPvjCIKkZ0ckya62T+YtpSsiD6qq54I=
X-MS-TrafficTypeDiagnostic: HE1EUR01HT035:
X-MS-Exchange-EOPDirect: true
X-Sender-IP: 212.159.14.17
X-SID-PRA: ***@TESCO.NET
X-SID-Result: NONE
X-MS-Exchange-Organization-PCL: 2
X-Exchange-Antispam-Report-Test: UriScan:(207280287050664);
X-Exchange-Antispam-Report-CFA-Test:
BCL:0;PCL:0;RULEID:(444111676)(52401380)(52601095)(52505095)(52406095)(52305095)(52205095)(88862240)(88860288)(102415395)(82015058);SRVR:HE1EUR01HT035;BCL:0;PCL:0;RULEID:;SRVR:HE1EUR01HT035;
X-Microsoft-Exchange-Diagnostics:
1;HE1EUR01HT035;4:4IrAX7/Ci6cgx5TapZrgnOFEBil80erKPRS+DLVpcGK1wqZjSKLJtKOiLEiplGfC5CsMX1CLsP28u2fEEIxPgAcnGF9nxiFgkX3l0zFtAEaAnIrIM1JA6XpVCRAHIMkkRwY+WAVKDJ5TNbBgeX90axEXFKcoZ3P2LPtfMfsXuABHLb9ZfDqZUlIDY3v7Mfjeny40pFc5EYHLeB3jo47rzpGKLlPKTAxh0bCIT4VaZktmlaAvLzc6gmvAAQCNpatNhq+ym4QbRcwB7gXCrX+cbFstc2ucKpLETNDbFykUWPF2HcTDI1oSvlmvWrSSLCya;6:+nbDbx3kJnxgshApJmP3CpnD/Hva9ZovfO8i2WqZ2/AeXKN/aNF9SIxcivYB/gOy8p51qEKqQjttuFKCzjV8VSit0KGV6OFXwJhRpZQEAehwpa9ioWNHYVN39VhaAbB/q7gaAUSa/NOqJMdNv01VFX7oAmHr/e0WNHFLCUjXTGzMZpEbQDSsPoju6fPK2FMWQMhKazBENeLSCT+wufvtexZph7wqZnEN+pHO3eT1BbgSLrwrYKeENaDmWmr0QxKQ4QWl1K1CEvXIimp7SuKCOsi6fzpV3/HaPdbrBDm9sR6oP5dI59i5poHcWWRyMSC4kDbN+xcSjZWhucOJLfraVEOlSbEQuv4wwZfr5De/fkqyIttTNNBE4rdwBzYR7fhVimxN3oo+wFmyAvy44oFFwv5F6sfOofZB5xsu9aS+UXwGqxYiIJQA8MD7FF24XyRdfllBOMVir1+8rnn6CHEg4w==
X-Microsoft-Exchange-Diagnostics:
1;HE1EUR01HT035;5:YlVoEkbsM5AzKlkYuSzJ2cC+Upgxk6YzKDGvXhwZwsogS7a+2DsrxeAenVL4JROmwjpQpsoHG9iVRylbNuGUMcDL0im4BSMHOhMpZkJKFw5AVbsGPJBqcGZGyklfjj53DMGhs+u1EEqfa/+378CAKH4iwyNsuiTZ6laXwqe+bv8=;7:LpWxMUWrs0mHNSPEC4wZ2RaM7C3mPkj2gxe93jStHUc5iATZdDy5QKbGkWTbAncCSvVFD6JeIszv0WCUPoOs8Nby7ujGhv6Lcom7+kIcdIRMlOAEayc8qO7icK6MchVn6lXWtpF/Q8Q0JxPkQD87gg==
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Oct 2018 16:52:45.1270
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 94d16cdf-bbba-4c01-88c8-08d63c2c9e62
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:
5dab7a8a-ebdc-4bd9-9cfd-67cde50b170b
X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1EUR01HT035
X-MS-Exchange-Transport-EndToEndLatency: 00:00:01.1378738
X-MS-Exchange-Processed-By-BccFoldering: 15.20.1273.007
X-Message-Info:
5vMbyqxGkddAj5YqYynYB0voClMuECwvywlzjPtHAZfWIxcC5YvjgwV5OnrHj5aaWX3qURU7iRvKdF8okjlT7jObnmPRPHnNf9BI/cONFrLQRdcj/Xbl15dOWCcaFcRmyNgi+VgxlMUTkTqHkZdSzFIRV7EoNTMVPqOy7EkRWPFcDoc4PpM5NoigMCoC8iSu0BmwHXae5ySoD0HtUI7K1Q==
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MTtHRD0yO1NDTD0z
X-Microsoft-Exchange-Diagnostics:
1;HE1P195MB0076;9:ykxFcRLCpSgwX9UbS/yHYDtpK2g640rMX0PT5YTv0xd3nJkZkEJXKNxaZeZrzuvIkoW4EeTZVLRDfqBi7ONtrI3I/4PMU3N0p4DXidY28vGp3APmdSVuLBb0lbzMXq5+gOzju8Q7DxRNG4gUW0DBM8EfUrmN2oSjDBBq7ilAfo8=
X-Microsoft-Antispam-Mailbox-Delivery:
abwl:0;wl:0;pcwl:0;kl:0;iwl:1;ijl:0;dwl:0;dkl:0;rwl:0;ucf:0;jmr:0;ex:0;psp:0;auth:0;dest:I;ENG:(5062000261)(5061607266)(5061608174)(4900095)(4920089)(6510075)(4950130)(590107)(4990090);
X-Microsoft-Antispam-Message-Info:
6faWdiVZAbhnNZb0qtOCo37d87bVwH5Qdg3StppkIgqsiKl7w6X5D9QjJdg7Co9gGt9vXooFTi7deVtP4VnMX7ErsIOyLENx9faJ8ryVpR/3MH/w68eKMUQY+CIAtLRZttH3ezKT7+FeQjrM2NVx47wja0gCbbuJrgLXvvPkJIQ2soy7H+1JY95wHk1Ast4SkygWVs4vaRGuCl46Xc9+39ZPakbEbX77mLjsR/v/TbShs/lUow99e6weWzldS9FSZgRt8mvWyt7c6az+GC0olkQYZD9569apbvBocmx820+qiLRBZenxuMiwgZubwjWGrYlDIYRLPneve8h4wsR7CbXkOfgvrFqjx+n0NwKc7J/mMW3ch7OwNB3jqeNDgZ45H//j8X8yxqGkjJ3Qjo5TKzA2U1lYBPr8dGYDUlMlrSK4UZyn/W4vRZZVxJ+PEVVVKfw+POEEB+zqbTp+GBVEtNQ67CFzmhVdD7qFh9zdCl5fCdwJNuFpd72xy3o8LvQySaJhqgjHRXijYJ0BABkeQgn3+RgfMgEzo+UxjcTdkEYg72pWA8rA5AMaLUQjeOPUHDowkHKnmfQSZCloGLpckEFN2vvWRHVff7X3omzPHfw9mmeBweDoC0Sq9lDiXLJlFAPHnxtwXEyuMwVq0MfFZUwYTpoOX1ZkNdWF+1SM6uw=
X-Microsoft-Exchange-Diagnostics:
1;HE1P195MB0076;27:puALeJIA8y8SLA8qHybZ3goptUvjwCRn/JhjHyclG8MTIY2+4LzSYDua5nxao72JrvLgqBV4Slm+DB4VxojPfsAsNCkvfvnWC7wLzaXuI1Ti8xfOk2uPEtcEvn6ccgVMnuqRdhT3IbSWA2frhh46yvK+LaWvm/EBKi6wEYLwztEUNteaF8qhzTbUM0PpiHzj5euHDzLs+E7zI5gCP8TyL/LT1GkI/xMSiszmnYU/m2h1yspMqY2ep51t0ZYcXt2y5nF/NeIQsGB6dGTOqIG8CYyAcCbt2HgPAA4xz+7Tij47AfMxDRrz+U+0hsfgseZ2DDsPwbsnjS4EqCQQGORCi6BSye4Fry0zmVZ3aDGE0rBGYkInmsEgJ6UAmZ1KtqDlCEmtj+aOCtVrDgAj8zpYeG14nAN9wZFNY8jUk7cUuQfHMRgX1cAputx+VbyJgd0P9dGG5QB2cTegMA5dePO6e5qQjnDLnmboZajnbYkucaEe3JQBViRkA1x5j5x7ff6CJOBPQlbl0I5istJnaspvzzylXkZnWFbogfWQXOCI+jGP4DHaf259S/TLkRxcJF+HUAwCkdfYY36+OekwENoaKYsmdxStE+z97If/Zc/ibj9X4+/0/SdU/CaQSH1AkKWYD9nD8o22ArLbp+4iKBOuqfEzKud/mS1DJUbgb42MhkQ=

Could my Outlook have substituted his old tesco.net address from my address book in the headers? Seems unlikely.

[Breelander]

Could my Outlook have substituted his old tesco.net address from my address book in the headers? Seems unlikely.

No. You read a raw header from the bottom up. Each step along the route adds one or more lines of text at the top, but will never modify a preceding line.

The header clearly states that on Sat 27th it was sent from [192.168.1.64] which is the IP address of the sender's local machine...

Received: from [192.168.1.64] ([87.115.**.**]) 
 by smtp with ESMTP 
 id GRpKgR2fcx6b6GRpLgp1yL; Sat, 27 Oct 2018 17:52:44 +0100
....
To: *** <***@hotmail.com>
From: *** <***@tesco.net>
Subject: Queries
Message-ID: <ae579c23-232e-48ff-bc3a-ed452c3fa5d1@tesco.net>
Date: Sat, 27 Oct 2018 17:52:41 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101
Thunderbird/60.2.1
MIME-Version: 1.0
Content-Type: multipart/alternative;
...
Return-Path: ***@tesco.net

It looks like it is configured at the sending end to insert the tesco.net address as the sender.

Note that later on (further up) the sender(s) are authenticated as both hotmail AND tesco.

Authentication-Results: spf=neutral (sender IP is 212.159.14.17)
smtp.mailfrom=tesco.net; hotmail.com; dkim=none (message not signed)

[Infrasonic]

Looks like Bree's suggestion has hit the nail on the head.
I had a similar issue when my sisters old ISP address ceased and she switched to Gmail.

As an A/B get the the original sender to actually log in to their new Gmail account via webmail (not Thunderbird) and send you a test email from there, I bet all the headers show Google/Gmail servers then.

They probably need to delete the Tesco email account entirely from the Thunderbird email client and set up the Gmail account as a new one using Gmail's SMTP details ideally (for clarity and continuity on things like SPF/DKIM/DMARC end to end authentication.)
If they really want to send or 'alias' (spoof) the Gmail account from the Hotmail (Outlook.com) SMTP servers, do the homework there and be aware of the downsides, namely the headers will give the game away anyway and there may be end to end authentication and/or spam filter trigger issues.

The last time I looked at Outlook.com 'aliasing' (for one of my domains) I had to go into my MS account online and do it from there, it's no longer an option from within the webmail settings itself (on the latest [beta] version of Outlook.com webmail anyway.) Probably an anti-spam spoofing measure as free webmail SMTP was being massively abused on that front previously by the plethora of 'anonymous' spam accounts.

I think that free Gmail itself doesn't allow SMTP 'aliasing' (spoofing) anymore (I still have it as a legacy function for existing domain accounts), but I think it's still allowed with the paid for G Suite options (in addition to their own domain service.) Not checked on that for a long time though,so it may have changed.