Hello!

Our Exchange infrastructure description, briefly:

1. Using Exchange 2013 CU7

2. 2 x MBX+CAS servers (EX1, EX2)

3. 2 x Edge servers (mx1, mx2)

4. DAG, 4 DBs

5. Hybrid Configuration: 200 local users, 15 cloud users

Our case: sometimes our users receive NDR while sending messages to existing mailboxes:

"Remote Server returned '550 5.1.1 RESOLVER.ADR.RecipNotFound; not found'

For example, user sent 2 messages, first caused NDR, second was successfully delivered:

Get-MessageTrackingLog -Sender sender@domain.ru -Recipient recipient@domain.ru | fl EventId, Source, TimeStamp, EventData

EventId   : HAREDIRECT
Source    : SMTP
Timestamp : 15.04.2015 16:58:36
EventData : {[DeliveryPriority, Normal], [AccountForest, local.domain.ru]}

EventId   : RECEIVE
Source    : SMTP
Timestamp : 15.04.2015 16:58:36
EventData : {[FirstForestHop, EX1.local.domain.ru], [Oorg, domain.ru], [ProxiedClientIPAddress, 10.0.100.21], [Proxie
            dClientHostname, mx1.domain.ru], [ProxyHop1, EX1.local.domain.ru(192.168.0.11)], [DeliveryPriority, Normal]
            , [AccountForest, local.domain.ru]}

EventId   : AGENTINFO
Source    : AGENT
Timestamp : 15.04.2015 16:58:36
EventData : {[AMA, SUM|action=st|error=|atch=0], [DeliveryPriority, Normal], [AccountForest, local.domain.ru]}

EventId   : FAIL
Source    : ROUTING
Timestamp : 15.04.2015 16:58:36
EventData : {[DeliveryPriority, Normal], [Oorg, domain.ru], [AccountForest, local.domain.ru]}

EventId   : HAREDIRECT
Source    : SMTP
Timestamp : 15.04.2015 18:17:23
EventData : {[DeliveryPriority, Normal], [AccountForest, local.domain.ru]}

EventId   : RECEIVE
Source    : SMTP
Timestamp : 15.04.2015 18:17:23
EventData : {[FirstForestHop, EX2.local.domain.ru], [ProxiedClientIPAddress, 10.0.100.22], [ProxiedClientHostname,
            mx2.domain.ru], [ProxyHop1, EX2.local.domain.ru(192.168.0.12)], [DeliveryPriority, Normal], [AccountForest,
            local.domain.ru]}

EventId   : AGENTINFO
Source    : AGENT
Timestamp : 15.04.2015 18:17:23
EventData : {[AMA, SUM|v=0|action=|error=|atch=0], [AMA, EV|engine=M|v=0|sig=1.195.3371.0|name=|file=], [TRA, ETR|ruleI
            d=068e0c20-5de5-48e0-9b53-ea90e5deb5b9|st=12.12.2014 18:27:31|action=SetSCL|sev=1|mode=Enforce], [CompCost
             |AMA=0|ETR=0], [DeliveryPriority, Normal], [AccountForest, local.domain.ru]}

EventId   : SEND
Source    : SMTP
Timestamp : 15.04.2015 18:17:25
EventData : {[E2ELatency, 4.863], [Microsoft.Exchange.Transport.MailRecipient.RequiredTlsAuthLevel, Opportunistic], [
            DeliveryPriority, Normal], [AccountForest, local.domain.ru]}

EventId   : DELIVER
Source    : STOREDRIVER
Timestamp : 15.04.2015 18:17:25
EventData : {[MailboxDatabaseName, IT], [Mailboxes, c1357fa5-52f2-4d16-8c70-09c9f9c4ab0e], [ToEntity, Hosted], [E2ELate
            ncy, 4.863], [DeliveryPriority, Normal], [AccountForest, local.domain.ru]}

How can I investigate this issue? 

• Edited by Turboon 19 hours 38 minutes ago

Are you sure that all your domain controllers are replicating properly?  Perhaps your Exchange server is sometimes contacting one with inconsistent content.

Is this occurring with messages coming in from the Internet as opposed to from internally?  If so, perhaps the Edge subscription needs to be recr