Mail received but server sends back '5.4.7 Delivery expired' mesage


Hello!

I've "inherited" an Exchange 2013 server that for the last month, even tho it receives mail, it sends back to outside senders a message like this, after a few days:

Action: failed
Status: 5.0.0 (permanent failure)
Diagnostic-Code: smtp; 5.4.7 - Delivery expired (message too old) 'timeout' (delivery attempts: 0)



Some details I know about the setup:

-there's a Cisco Ironport email filter for outside mail - tech support on that said it's not at fault

-exchange server was upgraded from 2010 to 2013. The old server and connectors still appear in the settings.

-there might be an issue with the exchange server seeing the secondary domain controller as the primary but this is an old issue and might not be related

-get-messagetrackinglog mentions HAREDIRECTFAIL and SEND events for external received email (there's only one server so I don't know why Transport high availability is on)

-mxtoolbox.com doesn't report any problems with my email domain


I would love to know if you have any ideas as to why this is happening!
Thank you!

Hi,

Does it apply to all outbound mail? or a particular domain?

Check where the Send connector is pointing to? and enable logging on the send connector, this will give you some info what is the cause of the problem.

The send connector is set to route through a smart host - the Cisco email filter

Scoping is set to SMTP, FQDN is set to *

But outbound mail seems fine. And only imbound mail from outside the domain triggers the error reply, even tho it is delivered to the inboxes.

Should I look for something at the receive connector instead?

I should have mentioned that the The Exchg server also has ESET mail security installed which says "Licensed numebr of mailboxes exceeded" and sometimes the mail server protection seems to be disabled. I might try to disable it completely.

• Edited by Lucian LS 6 minutes ago

First of all, you need to identify which server generated the NDR. You should be able to find something like 'generating server' in the message that the sender received.

If it's generated by the sending server, then it's not Exchange server problem.

If it's generated by IronPort, then it may be because of IronPort or Exchange server. You can enable the protocol log on the receive connector for troubleshooting.

If it's generated by Exchange server (unlikely), it indicate something wrong with Exchange server.