How do you change the From: field in an email's header using Outlook or Exchange online?

Question

I have been tasked with automating a process: getting GMS email alerts to automatically create tickets in ConnectWise, AND automatically assign the proper client.

In our environment we have a SonicWALL GMS that sends out email alerts. The GMS monitors 20 different SonicWALLS for 20 different clients.

The alerts are sent from [email protected]. The emails are sent to a distribution group [email protected]. In this distribution group is the member [email protected]. When an email is received by [email protected], a ticket is automatically created in our ticketing system. This mail flow is working properly, no problems there.

Here's the challenge: in order to get the ticketing system to automatically select the company field for the company, the FROM: field needs to be a company contact. For example: [email protected]

What I need is a rule that can change the from email address: [email protected] to a client contact email address [email protected], based on the SonicWALL serial number in the subject or body of the email. I don't need to redirect the email, I can get it TO the right place, I just need to change where the email is FROM, so the ticketing system assigns the correct client

I have researched this extensively. I've tried Outlook rules, but can't find one that will "send as" a different user. I have researched Exchange mail flow rules that adjust message header information, even opened a ticket with Office 365 support, and they hit a dead end as well. Does anyone have any insight on how to change the From: field in an email's header using Outlook or Exchange online?

*************EDIT*************** For clarity I have added a diagram that shows the flow and what needs to happen. The To: field does not need to change. The emails are being delivered to where they need to go. When they get to where they are going, the From: field needs to change.

Solution

This isn't something that is available in unmodified Exchange, much less Outlook. I have accomplished the exact same thing in two ways.

1) We use IronPort ESA filters/SMTP nodes to accept mail. You can write a rule at this level to do what you are asking before delivering to Exchange. The idea is simple enough and many mail filters will have similar capabilities. Have a mail content rule that triggers if the sender is 'GMS' and body contains serial number 'xyz' (lots of rules, one for each SN); the action is to modify the envelope-sender address to your desired address. Do be wary that you are talking about modifying to an address with a domain that is sounds like you don't control. Depending on where in the process your filter performs sender verification & anti-spoof/spam your alteration of the from address may cause failures to deliver. Just be mindful that there may be additional changes this requires.

2) I have written a custom SMTP Mail Transfer Agent in .Net, my code was to strip & re-route attachments (we didn't want large attachments living in our Exchange server, so the ESA would send emails over a certain size to my MTA that would move the attachments to a file server and insert links to the offloaded files into the message body). You can do the same thing, get a custom MTA that reads the body and changes the from address based upon some lookup information. "If SN matches devices.SN then set From as devices.ContactEmail" type process. You'll need someone to do the coding for you (assuming that isn't in your skillset, if it is, boom, you're all set). Then your MTA just hands the re-written output to the Exchange inbound connector.

No, you can't do this in native Exchange (and especially in Exchange Online, where changing FROM address to non-authoritative domains is a pretty frowned upon thing). But it can be done.

Comments

[thims]

Talking about Outlook rules... Do you need to automatically redirect incoming messages to another email address from client contact's email (that is an Exchange contact and you have the "Send As" permissons for it)?

[Ben Plont]

No, I don't need to redirect. I can get the email TO the right place, I just need to change where the email is FROM, so the ticketing system assigns the correct client.

[Raystafarian]

So it comes in to the distribution group directly from the program? And you need to, do what? Have it come into a different mailbox in the distribution group which then forwards it to the ticketing system, but changes its identity based on the program's email?

[Ben Plont]

The GMS (single point of SMTP) sends an alert in an email, always FROM [email protected]. It goes to the distribution group [email protected] and then to the ticketing system. By the time the email gets to the ticketing system, the From: address, [email protected] needs to be changed to one of about 30 different client contact addresses: [email protected], which is based on the serial number of the device contained in the body of the email. I do not need to alter the destination. I need to alter the sent from field of the header.

[Ruscal]

For clarity, I used the IIS6 SMTP agent to accept the emails and drop them as .msg files in the DROP folder; then my service (with a folder watcher) would pick those up for processing and send the processed email to Exchange. I didn't write a full MTA, but the same end result was achieved. And always be careful when re-writing the FROM address as you can easily trigger spam/spoof detection rules.

[Ben Plont]

Your first point is our back up plan. I'm also asking the ticketing system if they can scrape the return-path field. I can alter the return-path field in the header.

[Ruscal]

Depending on the number of clients you have to write rules for, if the mail already traverses some form of smart filter then #1-like is the way I'd go. It could just be a pain to keep up-to-date with individual rules. A custom transport rule in Exchange could do it as well, but you'd have to write that and extending the transport pipe is something I normally argue against

[Ben Plont]

Currently the client list is only about 20 in the GMS, so it's manageable.

[Ruscal]

Another (and wholly untested) thought. If you can alter the return field in GMS, you might be able to have a rule in your mail filter that IF From==GMS THEN Set From=Return-Path. That'd be one rule in the email filter and would be easily expandable/updatable using only GMS in the future...