exchange 2003 not delivering message with body containing word jack, why?
We have Exchange 2003 sp2 running on a Windows 2000 server machine as a front end gateway. GFI Mail Essentials and MailSecurity are also on this machine. I send a message from an outside account to an inside account that contains the word "test" in the body, and the message is delivered as expected. I change the word "test" to "jack" (just the single word will do, but could be any text that happens to have that word as well), and Exchange drops the message. Message tracking is turned on and shows as a final result "Advanced queue failed to deliver message". I've turned on engineering logging for SMTP, and I see the message come in via the event viewer. I also have debug logging set for GFI and in their ase trace I see NO reference to the same inbound message. That is why I have concluded that Exchange is dropping the message. There is NDR returned. It just falls into a black hole. Very disturbing. Any insight as to why this might be happening, or other types of diagnostics that might be turned on would be greatly appreciated.
October 26th, 2007 6:43pm

Have you configured IMF Intelligent Message Filter Check you SMTP virtual server settings and try to unselect the IMF filtering from your SMTP virutal server and try again If the result is the same then it should be the GFI that is blocking your message Deli
Free Windows Admin Tool Kit Click here and download it now
October 26th, 2007 9:58pm

Here I thought that IMF was turned on, but in fact it is not. Just sender and recipient filtering is turned on. As far as GFI goes, I have stated that the message doesn't even turn up in the GFI ASE trace log. Any other message that is received and rejected does show in this log. This is why I conclude Exchange is the culprit. That being said I will try enableing IMF to see if that has some effect.
October 26th, 2007 10:34pm

Ok, it is definitely NOT GFI. I turned it off and sent the message thru, as I expected - black hole. Also enabling IMF made no difference. So, there it is. I've got Exchange 2003 sp2 on a 2000 server with IMF DISABLED and the only reason it drops the message is because the word jack is in the body of the message. It is definitely Exchange doing it. Maybe one of the Microsoft Experts could weigh in on this issue?? That would be great.
Free Windows Admin Tool Kit Click here and download it now
October 26th, 2007 11:53pm

Maybe you have a transport sync registered that someone developed for testing You can check for events registered on the OnArrival event with the Smtpreg.vbs script. This script can be used to determine which SMTP event sinks are installed on the server.You can use the /enum flag with the Smtpreg.vbs script to enumerate the list of registered transport event sink bindings for that service. The syntax for this is as follows: cscript smtpreg.vbs /enum The Smtpreg.vbs script is distributed with the Platform SDK. http://support.microsoft.com/kb/258224 Deli
October 27th, 2007 3:03pm

I actually found the script you referenced at http://support.microsoft.com/kb/324021/en-us. I ran it and received the following information: Source {1B3C0666-E470-11D0-AA67-80C04FA345F6} { DisplayName = smtpsvc 1 OnArrival Sinks { Binding {5D631EE6-61BA-4F19-B7C3-4BAFB6A30876} { DisplayName = TRANSPORTSINK SinkClass = Msecsink.transport Status = Enabled SourceProperties { Rule = MAIL FROM=* Priority = 10 } SinkProperties { VirtualServerInstance = 1 } } Binding {7FD4C849-5506-46F2-B2F9-5DFBBAAFB22B} { DisplayName = Exchange Transport XEXCH50 Submission sink SinkClass = peexch50.submit Status = Enabled SourceProperties { priority = 100 } SinkProperties { } } Binding {92DE29D2-A8AA-4A82-B8AA-657CF32A67C8} { DisplayName = Exchange Transport AntiVirus API SinkClass = Exchange.TransportAVAPI Status = Enabled SourceProperties { priority = 28000 } SinkProperties { } } Binding {A7D837CC-6273-4DA0-8B83-AFFCC9942B2B} { DisplayName = inboundsink SinkClass = TransSinkIn.Sink Status = Enabled SourceProperties { Priority = 20 } SinkProperties { VirtualServerInstance = 1 } } } Not sure what is supposed to be here. I would appreciate an opinion, Thanks.
Free Windows Admin Tool Kit Click here and download it now
October 31st, 2007 6:09pm

Msecsink.transport = GFI TransSinkIn.Sink = GFI It seams that only GFI has registered Event Syncs My suggestion is to uninstall GFI completely as I still think this is GFI related Deli
October 31st, 2007 6:49pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics