Or….you said you have Symantec doing spam filtering on your exchange server also? It could be generating these NDR’s. Is it set up to deliver an NDR if it classifies an email as spam? If so that is very very bad.
From: Kennedy, Jim [mailto:[email protected]] Sent: Wednesday, June 09, 2010 3:07 PM To: MS-Exchange Admin Issues Subject: RE: undeliverables "clogging" que's Yep, that is an outgoing NDR from your Exchange server. I stand by my initial guess if those messages are typical of what is filling your queue, outgoing non-deliverables generated by your exchange server. Your gateway tagged it as [Spam] then delivered it to your Exchange server. The exchange server can’t find the original recipient in your system so it generated the below outgoing NDR that is going to a bogus or non-functioning domain/email system. The from is blank because Exchange does not want to create an endless loop of undeliverables, it knows it has enough problems already. ☺ Turn up your gateway spam filtering so this doesn’t get to your exchange server or fix the recipient verification system on it. The latter would be better and if it doesn’t do that you should replace it. Also look at your gateway and find the original message with that subject, that will give you some clues. From: Jeff Brown [mailto:[email protected]] Sent: Wednesday, June 09, 2010 3:00 PM To: MS-Exchange Admin Issues Subject: Re: undeliverables "clogging" que's EXAMPLE #1 Identity: SOL-EXCH1\7101\13399 Subject: Undeliverable: [Spam] Make better food! Internet Message ID: <2f3623af-1a77-4f11-8232-907fba43ce07> From Address: <> Status: Ready Size (KB): 12 Message Source Name: DSN Source IP: 255.255.255.255 SCL: -1 Date Received: 6/9/2010 1:46:12 PM Expiration Time: 6/11/2010 1:46:12 PM Last Error: Queue ID: SOL-EXCH1\7101 Recipients: [email protected]<http://[email protected]> EXAMPLE #2 Identity: SOL-EXCH1\7101\13396 Subject: Undeliverable: [Spam] Automobile Insurance � Compare and Save Instantly. Internet Message ID: <a27817aa-817d-42a9-b5e0-a8bb9847ece1> From Address: <> Status: Ready Size (KB): 11 Message Source Name: DSN Source IP: 255.255.255.255 SCL: -1 Date Received: 6/9/2010 1:44:08 PM Expiration Time: 6/11/2010 1:44:08 PM Last Error: 421 4.4.2 Connection dropped Queue ID: SOL-EXCH1\7101 Recipients: [email protected]<mailto:[email protected]> NO From: address on any of the "undeliverables" that are now in the que. Recipient example 2 email domain not close to any accepted mail domain here. On Wed, Jun 9, 2010 at 1:50 PM, Jay Dale <[email protected]<mailto:[email protected]>> wrote: Last time I saw something like this, it was employees with Out Of Office messages sent out into the world rather than limiting them to internal recipients or Contacts. They got sent to spammers who then used them for NDR’s and spoofs. It might be a case where your network is secured but you just have to deal with the pains of the NDR’s until they eventually die down, which they will. Jay Dale I.T. Manager, 3GiG Mobile: 713.299.2541 Email: [email protected]<mailto:[email protected]> Confidentiality Notice: This e-mail, including any attached files, may contain confidential and/or privileged information for the sole use of the intended recipient. If you are not the intended recipient, you are hereby notified that any review, dissemination or copying of this e-mail and attachments, if any, or the information contained herein, is strictly prohibited. If you are not the intended recipient (or authorized to receive information for the intended recipient), please contact the sender by reply e-mail and delete all copies of this message. From: Jeff Brown [mailto:[email protected]<mailto:[email protected]>] Sent: Wednesday, June 09, 2010 12:18 PM To: MS-Exchange Admin Issues Subject: undeliverables "clogging" que's We are in the middle of a multi-domain migration from E2k3 servers to E2K7. We had an outside consultant come in and set this all up. We had some time constraints and unrelated hardware issues that have complicated this process at times, and things have not always gone smoothly(imagine that). Everything seems to be working fine except that we have had reports of "missing email" and looked to find a que with hundreds of undelivered messages on the E2K7 Hub/CAS server. 80% or so of those messages are identified as "undeliverable". When we manually delete the undeliverables the rest of the messages seem to go out just fine. I'll be happy to provide more details about our setup, but I'm thinking that may be something someone else has seen and may be able to point us in the right direction to get this resolved??? thanks for any help. Jeff
