sync: auto-sync from GURU-BEAST-ROG at 2026-07-22 16:36:05
Author: Mike Swanson Machine: GURU-BEAST-ROG Timestamp: 2026-07-22 16:36:05
This commit is contained in:
Winter Williams
committed by
ClaudeTools Bot
ClaudeTools Bot
parent
599159e0e4
commit
b071900ca8
@@ -0,0 +1,107 @@
|
|||||||
|
# 2026-07-22 — The Marc Group — jmungo@themarcgroup.com not receiving email (ticket #32581)
|
||||||
|
|
||||||
|
## User
|
||||||
|
- **Executed by:** ClaudeTools Discord Bot (GURU-BEAST-ROG)
|
||||||
|
- **Requested by:** Winter Williams (@winterguru, via Discord) - tech
|
||||||
|
- **Role:** automation (acting on the requester's behalf)
|
||||||
|
|
||||||
|
## Session Summary
|
||||||
|
|
||||||
|
Winter reported via Discord (#web-department) that jmungo@themarcgroup.com (Jerry Mungo, The
|
||||||
|
Marc Group — GPS client, Syncro cid 869073) was not receiving email. Work tracked under Syncro
|
||||||
|
ticket #32581 (internal id 114131164), assigned to Howard, subject "Remote -
|
||||||
|
jmungo@themarcgroup.com is not receiving email but is able to send email."
|
||||||
|
|
||||||
|
Server-side mail flow was verified first. MX for themarcgroup.com correctly points to M365
|
||||||
|
(`themarcgroup-com.mail.protection.outlook.com`); autodiscover CNAME correctly points to
|
||||||
|
`autodiscover.outlook.com`. An SMTP RCPT probe (no mail sent) run from the IX server (BEAST has
|
||||||
|
outbound port 25 blocked) showed the M365 edge returning `250 2.1.5 Recipient OK` for jmungo —
|
||||||
|
mail is being accepted into the tenant. The tenant also accepts a bogus address (DBEB off), so
|
||||||
|
the probe alone could not distinguish internal mailbox state.
|
||||||
|
|
||||||
|
A remediation-tool consent audit on the tenant (id `e2eb465e-17d4-4c39-b110-1d7ea1c919ad`)
|
||||||
|
came back RED for all ComputerGuru MSP apps — no app consent, and no M365 admin credentials
|
||||||
|
exist in the vault for this client, so no message trace / quarantine / rules inspection was
|
||||||
|
possible.
|
||||||
|
|
||||||
|
Winter then supplied the decisive context: Jerry's Mac had its OS reinstalled during service,
|
||||||
|
after which email would send but not receive. Combined with the clean server-side findings,
|
||||||
|
root cause is a Mac Mail client misconfiguration — the account was most likely re-added as
|
||||||
|
IMAP/POP (note `mail.themarcgroup.com` resolves to `98.174.235.218`, a legacy Cox-IP mail
|
||||||
|
host, NOT Microsoft) instead of Microsoft Exchange. New mail sits in the M365 mailbox the Mac
|
||||||
|
is not checking; sending works via the separately configured SMTP path.
|
||||||
|
|
||||||
|
Posted an internal/hidden note to ticket #32581 (comment id 424952614, attributed to Winter)
|
||||||
|
with the diagnosis and fix steps, and posted a bot alert to #bot-alerts.
|
||||||
|
|
||||||
|
## Key Decisions
|
||||||
|
|
||||||
|
- Probed SMTP from the IX server rather than BEAST — outbound 25 from BEAST times out
|
||||||
|
(ISP-blocked); IX is a mail-capable host with clean egress.
|
||||||
|
- Used paramiko with the vaulted root password for IX access — SSH key auth to IX works from
|
||||||
|
GURU-5070 but not from BEAST (publickey denied), and the bot is headless.
|
||||||
|
- Did NOT pursue tenant consent once the OS-reinstall context arrived — the server side was
|
||||||
|
proven clean, so tenant-side investigation became unnecessary for this issue.
|
||||||
|
- Note posted hidden/do_not_email at Winter's explicit direction (internal runbook for Howard).
|
||||||
|
|
||||||
|
## Problems Encountered
|
||||||
|
|
||||||
|
- Outbound port 25 blocked from BEAST — SMTP probe timed out; resolved by running the probe
|
||||||
|
from IX (172.16.3.10).
|
||||||
|
- SSH key auth root@172.16.3.10 fails from BEAST (works from GURU-5070 only); resolved via
|
||||||
|
vault password + paramiko (`look_for_keys=False, allow_agent=False`).
|
||||||
|
- MSP app consent audit RED on the Marc Group tenant — no programmatic M365 access. Left
|
||||||
|
unresolved (not needed for this fix); consent URLs were generated and are in the Discord
|
||||||
|
thread if the tenant is ever onboarded.
|
||||||
|
|
||||||
|
## Configuration Changes
|
||||||
|
|
||||||
|
- None to infrastructure. Created this session log file. No repo config changes.
|
||||||
|
|
||||||
|
## Credentials & Secrets
|
||||||
|
|
||||||
|
- Read: `infrastructure/ix-server` (root password, used for paramiko SSH — value in vault, not
|
||||||
|
reproduced here).
|
||||||
|
- Read: `msp-tools/syncro-winter` (per-user Syncro API key via syncro-env.sh; writes attributed
|
||||||
|
to Winter).
|
||||||
|
- No new credentials created or discovered.
|
||||||
|
- NOTE: no M365 admin credentials exist for The Marc Group; no MSP app consent on the tenant.
|
||||||
|
|
||||||
|
## Infrastructure & Servers
|
||||||
|
|
||||||
|
- The Marc Group M365 tenant ID: `e2eb465e-17d4-4c39-b110-1d7ea1c919ad`
|
||||||
|
- MX: `themarcgroup-com.mail.protection.outlook.com` (correct)
|
||||||
|
- autodiscover.themarcgroup.com → CNAME `autodiscover.outlook.com` (correct)
|
||||||
|
- `mail.themarcgroup.com` → `98.174.235.218` (legacy/Cox IP — NOT a valid incoming server for
|
||||||
|
this mailbox; suspected wrong incoming host in Mac Mail)
|
||||||
|
- SPF: `v=spf1 +a +mx +ip4:72.194.62.5 +ip4:162.248.93.233 +ip4:162.248.93.81
|
||||||
|
+ip4:184.187.220.69 +include:spf.protection.outlook.com -all`
|
||||||
|
- IX server: 172.16.3.10 (probe origin; website for themarcgroup.com hosted here, cPanel
|
||||||
|
account `themarcgroup`)
|
||||||
|
|
||||||
|
## Commands & Outputs
|
||||||
|
|
||||||
|
- `nslookup -type=mx themarcgroup.com 8.8.8.8` → MX pref 0 themarcgroup-com.mail.protection.outlook.com
|
||||||
|
- `consent-audit.sh themarcgroup.com` → GRADE RED (all apps not consented)
|
||||||
|
- SMTP probe from IX (python3 smtplib, EHLO/MAIL/RCPT/QUIT, no DATA):
|
||||||
|
`RCPT jmungo: (250, b'2.1.5 Recipient OK')`; bogus address also 250 (DBEB off)
|
||||||
|
- Syncro: `POST /tickets/114131164/comment` (hidden, do_not_email) → comment id 424952614
|
||||||
|
|
||||||
|
## Pending / Incomplete Tasks
|
||||||
|
|
||||||
|
- Hands-on fix on Jerry's Mac (Howard): verify inbox at outlook.office.com as
|
||||||
|
jmungo@themarcgroup.com, then delete the Mail.app account and re-add as Microsoft Exchange
|
||||||
|
(autodiscover will self-configure). Mailbox resyncs from server; nothing lost.
|
||||||
|
- Billing on #32581 once resolved (minutes + labor type via /syncro).
|
||||||
|
- Optional: onboard the Marc Group tenant to the ComputerGuru app suite (consent URLs in the
|
||||||
|
Discord thread / regenerable via consent-audit.sh) so future M365 issues are traceable.
|
||||||
|
|
||||||
|
## Reference Information
|
||||||
|
|
||||||
|
- Syncro ticket: https://computerguru.syncromsp.com/tickets/114131164 (#32581)
|
||||||
|
- Discord thread ID: 1529628697936658464 (#web-department)
|
||||||
|
- Bot alert message id: 1529632891171242004
|
||||||
|
- Wiki: `wiki/clients/marc-group.md`
|
||||||
|
- Consent URLs (investigator / exchange-op):
|
||||||
|
`https://login.microsoftonline.com/e2eb465e-17d4-4c39-b110-1d7ea1c919ad/adminconsent?client_id=bfbc12a4-f0dd-4e12-b06d-997e7271e10c`
|
||||||
|
`https://login.microsoftonline.com/e2eb465e-17d4-4c39-b110-1d7ea1c919ad/adminconsent?client_id=b43e7342-5b4b-492f-890f-bb5a4f7f40e9`
|
||||||
Reference in New Issue
Block a user