If you've opened Support Cases of late, I recommend you check your Junk folder so you don't miss any email replies!
I've opened a Support Case to report this.
Here's an example header -- clearly it was not me who sent it!
Code: Select all
Return-Path: <mark.stone@missioncriticalemail.com>
Received: from securemail.missioncriticalemail.com (LHLO
securemail.missioncriticalemail.com) (10.8.53.113) by
mb31.missioncriticalemail.com with LMTP; Tue, 3 Mar 2026 14:13:05 +0000
(UTC)
Received: from localhost (localhost.localdomain [127.0.0.1])
by securemail.missioncriticalemail.com (Postfix) with ESMTP id 156C440116B7
for <mark.stone@missioncriticalemail.com>; Tue, 3 Mar 2026 14:13:05 +0000 (UTC)
X-Virus-Scanned: amavis at
X-Spam-Flag: YES
X-Spam-Score: 13.753
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.753 required=3.8 tests=[BAYES_00=-0.5,
DKIM_UNSIGNED=1.75, DMARC_FAIL_REJECT=9, SPF_FAIL=3.5, SPF_HELO_NONE=0.001,
TO_EQ_FM_DOM_SPF_FAIL=0.001, TO_EQ_FM_SPF_FAIL=0.001]
autolearn=no autolearn_force=no
Received: from securemail.missioncriticalemail.com ([127.0.0.1])
by localhost (securemail.missioncriticalemail.com [127.0.0.1]) (amavis, port 10024)
with ESMTP id hg35U9WDRfDE for <mark.stone@missioncriticalemail.com>;
Tue, 3 Mar 2026 14:13:04 +0000 (UTC)
Received: from mta03.zcom.email-ash1.synacor.com (mta03.zcom.email-ash1.synacor.com [129.80.213.239])
by securemail.missioncriticalemail.com (Postfix) with ESMTPS id CD4FD40116B0
for <mark.stone@missioncriticalemail.com>; Tue, 3 Mar 2026 14:13:04 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1])
by mta03.zcom.email-ash1.synacor.com (Postfix) with ESMTP id 6D18E1051609
for <mark.stone@missioncriticalemail.com>; Tue, 3 Mar 2026 09:13:04 -0500 (EST)
Received: from mta03.zcom.email-ash1.synacor.com ([127.0.0.1])
by localhost (mta03.zcom.email-ash1.sync.lan [127.0.0.1]) (amavis, port 10032)
with ESMTP id ap841KxQn3MK for <mark.stone@missioncriticalemail.com>;
Tue, 3 Mar 2026 09:13:04 -0500 (EST)
Received: from localhost (localhost [127.0.0.1])
by mta03.zcom.email-ash1.synacor.com (Postfix) with ESMTP id 2057B1051606
for <mark.stone@missioncriticalemail.com>; Tue, 3 Mar 2026 09:13:04 -0500 (EST)
X-Virus-Scanned: amavis at mta03.zcom.email-ash1.sync.lan
Received: from mta03.zcom.email-ash1.synacor.com ([127.0.0.1])
by localhost (mta03.zcom.email-ash1.sync.lan [127.0.0.1]) (amavis, port 10026)
with ESMTP id 2kxRacATSeYP for <mark.stone@missioncriticalemail.com>;
Tue, 3 Mar 2026 09:13:04 -0500 (EST)
Received: from smtp-0ca2721484c4efa27.core1.sfdc-lywfpd.mta.salesforce.com (smtp-0ca2721484c4efa27.core1.sfdc-lywfpd.mta.salesforce.com [44.238.67.234])
by mta03.zcom.email-ash1.synacor.com (Postfix) with ESMTPSA id DACE6104E010
for <mark.stone@missioncriticalemail.com>; Tue, 3 Mar 2026 09:13:03 -0500 (EST)
Received: from [127.0.0.1] ([127.0.0.1:52732] helo=eaas-22.eaas.emailinfra.svc.cluster.local)
by mx1.core1.sfdc-lywfpd.mta.salesforce.com (envelope-from <mark.stone@missioncriticalemail.com>)
(ecelerity 4.7.0.20111 r(msys-ecelerity:tags/4.7.0-ga^0)) with ESMTP
id 7B/E3-00689-E6CE6A96; Tue, 03 Mar 2026 14:13:02 +0000
Received: from 127.0.0.1 (localhost. [127.0.0.1]) by eaas-22 (EaaS) id
<W-pcK9YTS4yZn3an6AeWRg.ZIYHN94jdjCx0aiwdUHBFBU@sfdc.net> for
<"mark.stone@missioncriticalemail.com"
<mark.stone@missioncriticalemail.com>> Tue, 3 Mar 2026 14:13:02 GMT (GMT)
Date: Tue, 3 Mar 2026 14:13:02 +0000 (GMT)
From: Mark Stone <mark.stone@missioncriticalemail.com>
To: "mark.stone@missioncriticalemail.com" <mark.stone@missioncriticalemail.com>
Message-ID: <W-pcK9YTS4yZn3an6AeWRg.ZIYHN94jdjCx0aiwdUHBFBU@sfdc.net>
Subject: ** CAUTION! SUSPICIOUS EMAIL **Case 01957590: Mission Critical Email
(B) - False Confirmation of Uploaded Attachments When Opening a New Case
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
X-SFDC-LK: 00D300000000NRG
X-SFDC-User: 0058Z00000745b3
X-Sender: postmaster@salesforce.com
X-mail_abuse_inquiries: http://www.salesforce.com/company/abuse.jsp
X-SFDC-CORRELATION-ID: 00011bzx3r3dbk8i
X-SFDCOrgRelay: 00D300000000NRG
X-SFDC-Binding: 1WrIRBV94myi25uB
X-SFDC-App: coreapp
X-SFDC-EmailCategory: invocableActionEmail
X-SFDC-EntityId: 500PL00000g26UC
X-SFDC-Interface: internal
X-SFDC-Restrict: ^(.*)
X-SFDCRelayAddr: mail.zimbra.com
X-SFDCRelayPort: 587
X-SFDCTLS: 4
Mark
P.S. Also note that if you open a case and try to upload attachments at the same time, the attachment uploads will seemingly succeed, but then when you go back to look at the case after it's opened, there are no attachments. Seems you can only upload attachments after the case is opened and created by the system. The header above relates to the case I opened to address that issue FWIW.
