Trying to track down cause of NDR on Exchange 2007
One user on Exchange 2007 gets NDR's, occasionally...seems to be when there's a 'Reply All' there is a failure to that address. User sees this (note that below address is missing ending ' > '):
Delivery has failed to these recipients or distribution lists:
John Glassman <John.Glassman@AmericanWell.com
The format of the recipient's e-mail address isn't valid. A valid address looks like this: username@contoso.com. Microsoft Exchange will not try to redeliver this message for you. Please check the e-mail address and try sending the message again, or provide
the following diagnostic text to your system administrator.
_____
Sent by Microsoft Exchange Server 2007
Diagnostic information for administrators:
Generating server: BOS-MAIL-01.contoso.com
John Glassman <John.Glassman@contoso.com
#550 5.1.3 STOREDRV.Submit; invalid recipient address #SMTP#
Original message headers:
Received: from BOS-MAIL-01.contoso.com ([x.x.x.120]) by bos-mail-01
([x.x.x.120]) with mapi; Tue, 4 May 2010 17:33:26 -0400
MIME-Version: 1.0
Content-Type: text/plain
Date: Tue, 4 May 2010 17:33:26 -0400
Message-ID: <CA9974D56BCABD44BD037E851C1C25610162C2C462@bos-mail-01>
Subject: RE: Image request
Excerpt from logs of the most recent message:
2010-05-04T21:33:26.859Z,,,,BOS-MAIL-01,Failure,,DSN,DSN,580955,<fbb85ae6-6192-4d11-b3f1-c987d77a9fd3>,John.Glassman@contoso.com,,4774,1,,,Undeliverable: RE: Image request,MicrosoftExchange329e71ec88ae4615bbc36ab6ce41109e@contoso.com,<>,
2010-05-04T21:33:26.871Z,x.x.x.120,BOS-MAIL-01.contoso.com,x.x.x.120,BOS-MAIL-01,,,STOREDRIVER,RECEIVE,580956,<CA9974D56BCABD44BD037E851C1C25610162C2C462@bos-mail-01>,JGoldman@external.com;Tom.Sawyer@contoso.com;DistroList@external.com,,17234,3,,,RE:
Image request,John.Glassman@contoso.com,John.Glassman@contoso.com,04I:
2010-05-04T21:33:26.937Z,,,,BOS-MAIL-01,ContentConversion,,ROUTING,TRANSFER,580957,<CA9974D56BCABD44BD037E851C1C25610162C2C462@bos-mail-01>,DistroList@external.com;JGoldman@external.com,,14548,2,,580956,RE: Image request,John.Glassman@contoso.com,John.Glassman@contoso.com,
2010-05-04T21:33:26.951Z,,BOS-MAIL-01,,bos-mail-01,,,STOREDRIVER,DELIVER,580955,<fbb85ae6-6192-4d11-b3f1-c987d77a9fd3>,John.Glassman@contoso.com,,4947,1,,,Undeliverable: RE: Image request,MicrosoftExchange329e71ec88ae4615bbc36ab6ce41109e@contoso.com,<>,
2010-05-04T21:33:27.016Z,,BOS-MAIL-01,,bos-mail-01,,,STOREDRIVER,DELIVER,580956,<CA9974D56BCABD44BD037E851C1C25610162C2C462@bos-mail-01>,Tom.Sawyer@contoso.com,,17360,1,,,RE: Image request,John.Glassman@contoso.com,John.Glassman@contoso.com,2010-05-04T21:33:26.830Z
2010-05-04T21:33:27.178Z,x.x.x.120,BOS-MAIL-01,x.x.x.220,bos-ex-01.contoso.com,08CC33F8B4130BFF,Intra-Organization SMTP Send Connector,SMTP,SEND,580957,<CA9974D56BCABD44BD037E851C1C25610162C2C462@bos-mail-01>,JGoldman@external.com;DistroList@external.com,250
2.1.5 JGoldman@external.com ;250 2.1.5 DistroList@external.com ,14548,2,,;,RE: Image request,John.Glassman@contoso.com,John.Glassman@contoso.com,2010-05-04T21:33:26.830Z
WYSIWYG...YMMV
May 5th, 2010 11:02pm
Could be a cached or incorrect entry in the senders contacts.
Free Windows Admin Tool Kit Click here and download it now
May 6th, 2010 3:28am
Thanks Andy, but this latest one is from the user in question doing a Reply All and getting a NDR for their own address...that's part of what makes this so puzzling.WYSIWYG...YMMV
May 6th, 2010 3:38am
When they choose Reply All, is their own email listed?
Also make sure the OAB has downloaded to the client if they are in cache mode.
Test with OWA as well and see if the problem persists.
Free Windows Admin Tool Kit Click here and download it now
May 6th, 2010 3:56am
Hi,
For this issue, please first improve the Diagnostic Logging to Expert based on the below command:
Get-EventLogLevel MSExchangeTransport | Set- EventLogLevel -Level Expert
After that, please reproduce this issue and check the Event Log. If no value information is showed, please continue to run Get-TransportAgent |fl command to check for transport agent.
Then post it here.
Thanks
Allen
May 7th, 2010 10:04am
I have not been able to revisit this, but have not seen any more NDR's either.
I'm thinking it was a corrupt/incorrect entry in someone's cache. The address was missing the trailing '>' in every NDR...
Nothing more to see here folks....move along.
WYSIWYG...YMMV
Free Windows Admin Tool Kit Click here and download it now
June 1st, 2010 10:28pm