Alessandro Vesely writes:

> On Tue 19/Jun/2012 05:53:35 +0200 Gordon Messmer wrote:
> > On 06/14/2012 03:30 PM, Sam Varshavchik wrote:
> >> It should wind up in the Return-Path: header, if everything is set up
> >> properly.
>
> Actually, I searched for the from address.  It matches Return-Path
> except if resent via a mailing list.
>
> > Thanks, Sam.  You're right, but I'm still pretty sure there's at least
> > one log entry that Alessandro missed and searching the Mailbox and log
> > file for the message ID will be more reliable than using the time and
> > sender's address.
>
> I omitted what I considered irrelevant.  Otherwise I'd have put this:
>
> 874-north:savelog# zcat mail-20120612.log.gz |grep '00000000005DC03F.
> 000000004FD63F99.00003F1E'
> Jun 11 20:57:34 north courierfilter: zdkimfilter[16164]:id=00000000005DC03F.
> 000000004FD63F99.00003F1E: verifiez: spf=pass, dkim=pass (id=@ietf.org,  
> stat=0) rep=0
> Jun 11 20:57:34 north courierfilter: zdkimfilter[16164]:id=00000000005DC03F.
> 000000004FD63F99.00003F1E: responsz: 250 Ok.
> Jun 11 20:57:34 north courierd: newmsg,id=00000000005DC03F.
> 000000004FD63F99.00003F1E: dns; mail.ietf.org (mail.ietf.org [12.22.58.30])
> Jun 11 20:57:34 north courierd: started,id=00000000005DC03F.
> 000000004FD63F99.00003F1E,from=<asrg-
> bounces@irtf...>,module=local,host=0esely@tana...!!517!
> 517!/var/mail/tana.it/vesely!!,addr=<vesely@tana...>
> Jun 11 20:57:34 north courierlocal: id=00000000005DC03F.
> 000000004FD63F99.00003F1E,from=<asrg-bounces@irtf...>,addr=<vesely@tana.
> 0t>,size=5061,success: Message delivered.
> Jun 11 20:57:34 north courierd: completed,id=00000000005DC03F.
> 000000004FD63F99.00003F1E
>
> The message I received four minutes earlier was directed to that list
> and CC to me:
>
> 876-north:savelog# zcat mail-20120612.log.gz |grep '00000000005DC04B.
> 000000004FD63E9A.00003E33'
> Jun 11 20:53:18 north courierfilter: zdkimfilter[15934]:id=00000000005DC04B.
> 000000004FD63E9A.00003E33: verifyizg dkim_eoh: No signature (stat=2)
> Jun 11 20:53:18 north courierfilter: zdkimfilter[15934]:id=00000000005DC04B.
> 000000004FD63E9A.00003E33: verifiez: 1 auth method(s) written
> Jun 11 20:53:18 north courierfilter: zdkimfilter[15934]:id=00000000005DC04B.
> 000000004FD63E9A.00003E33: responsz: 250 Ok.
> Jun 11 20:53:18 north courierd: newmsg,id=00000000005DC04B.000000004FD63E9A.
> 00003E33: dns; fw9a.glodns.net (fw9a.glodns.net [196.220.48.59])
> Jun 11 20:53:18 north courierd: started,id=00000000005DC04B.000000004FD63E9A.
> 00003E33,from=<brendan@swif...>,module=local,h0st=vesely@tana...!!
> 517!517!/var/mail/tana.it/vesely!!,addr=<vesely@tana...>
> Jun 11 20:53:18 north courierlocal: id=00000000005DC04B.000000004FD63E9A.
> 00003E33,from=<brendan@swif...>,addr=<vesely@tana...>,size=49210success:  
> Message delivered.
> Jun 11 20:53:18 north courierd: completed,id=00000000005DC04B.
> 000000004FD63E9A.00003E33
>
> The former message, a copy of the lost one, is archived here:
> http://www.ietf.org/mail-archive/web/asrg/current/msg17083.html
> Curiously, the CC field doesn't show there, which can be explained in
> many ways, but I cannot think of one that justifies loosing the
> message.  I found nothing else in the mail.log, so I guess maildrop
> returned 0, or was not called.  The message was not "empty", as it
> contained at least the DKIM signature.  dmesg didn't have any log
> around that time.  I found no alert from the array driver.  Nothing.
>
> Should I enable maildrop's logging?

The first message does not look like a copy of the second one. It's size is  
much smaller. I would expect that a copy of a message sent through a mailing  
list would be larger than a CC from the sender, with the additional mailing  
list headers thrown in the mix.