Hi All,

Got a read odd one here that I just can't get my head around and hoping someone here can.

I have an email here which has originally been sent to 'Samantha' and 'AllStaff distribution group' - the email goes through fine and the DL includes some external contacts such as gmail/yahoo accounts, these also receive the email fine.

Someone (marked as user1 in the headers below) has hit reply to all, which has sent it back to Samantha and AllStaff DL - now the AllStaff DL has sent it to everyone in it which has included a yahoo account. This Yahoo account has rejected the message and sent an NDR back to the AllStaff group, which means everyone gets the NDR! This is what I need to figure out.

Can anyone understand or explain to me why this NDR has been sent to the AllStaff group and not the original sender?

My theories are is that it has something to do with the return-path and resent-from header fields, but I can't figure out why it's happening or where the actual fault/issue is.

The NDR is actually because of a SPF record issue which I can fix but for reasons I can't really go into prevents me from doing this for a while, but for other reasons I really need to understand why it's sending the NDR to allstaff!

Original headers of the NDR are below minus the body plus for security I've had to change a few things:

Internal exchange server name (MAIL-SERVER.DOMAIN.LOCAL)

Exchange external IP (1.1.1.1)

Exchange domain (exchangedomain.com)

Other companies domain (externaldomain.com)

The yahoo persons email address (user1@yahoo.com)

Smtproutes is our external mail filtering.

Other technical info - exchange 2013, cu1 - not sure what else you need. I can install SP1 but again I can't do that for a while.

Can anyone assist or explain why this is happening?

Cheers

Ian

----------------------------------------------

------ This is a copy of the message, including all the headers. ------

------ The body of the message is 9173 characters long; only the first

------ 8192 or so are included here.

Return-path: <AllStaff@exchangedomain.com>

Received: from [94.186.192.132] (helo=gmy2-mh803.smtproutes.com)

        by mail.externaldomain.com with esmtp (Exim 4.63)

        (envelope-from <AllStaff@exchangedomain.com>)

        id 1WwYUL-00014A-Nc; Mon, 16 Jun 2014 18:06:26 +0300

X-Katharion-ID: 1402933338.60197.gmy2-mh803 (unfiltered-unk)

Received: from mail.exchangedomain.com ([1.1.1.1]) by

  gmy2-mh803.smtproutes.com [(94.186.192.132)] with ESMTP via TCP

  (TLSv1/SSL_RSA_WITH_RC4_128_SHA); 16 Jun 2014 15:42:18 +0000

Resent-From: <AllStaff@exchangedomain.com>

Received: from MAIL-SERVER.DOMAIN.LOCAL (192.168.16.6) by MAIL-SERVER.DOMAIN.LOCAL

 (192.168.16.6) with Microsoft SMTP Server (TLS) id 15.0.620.29; Mon, 16 Jun

 2014 16:41:53 +0100

Received: from ams1-mh584.smtproutes.com (5.10.67.98) by MAIL-SERVER.DOMAIN.LOCAL

 (192.168.16.6) with Microsoft SMTP Server id 15.0.620.29 via Frontend  Transport; Mon, 16 Jun 2014 16:41:53 +0100

X-Katharion-ID: 1402933261.28796.ams1-mh584 (unfiltered-unk) (unfiltered-unk)

Received: from nm44.bullet.mail.ne1.yahoo.com ([98.138.120.51]) by

   ams1-mh584.smtproutes.com [(5.10.67.98)] with ESMTP via TCP

   (TLSv1/TLS_DHE_RSA_WITH_AES_256_CBC_SHA); 16 Jun 2014 15:41:01 +0000

Received: from [127.0.0.1] by nm44.bullet.mail.ne1.yahoo.com with NNFMP; 16  Jun 2014 15:41:00 -0000

Received: from [98.138.101.129] by nm44.bullet.mail.ne1.yahoo.com with NNFMP;

 16 Jun 2014 15:38:04 -0000

Received: from [98.138.87.4] by tm17.bullet.mail.ne1.yahoo.com with NNFMP; 16  Jun 2014 15:38:04 -0000

Received: from [127.0.0.1] by omp1004.mail.ne1.yahoo.com with NNFMP; 16 Jun

 2014 15:38:04 -0000

X-Yahoo-Newman-Property: ymail-4

X-Yahoo-Newman-Id: 72495.37688.bm@omp1004.mail.ne1.yahoo.com

Received: (qmail 39556 invoked by uid 60001); 16 Jun 2014 15:38:04 -0000

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1402933084; bh=seApv1nZpPFggpI4RjLhGufcfbLeGZvKjh9QCVUe7u0=; h=References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=2Yj/POrJQU5ObU3oizxhH0vuk+rWKrtfVm/5mR7UmnXa+zXLR/CHtg358uoZ+ju5KMH3vSOY0LHpS9wZ/vW+9iN6rZzL5yTCE0sAxTa51rKz1x9816sCnMZiCAQ8i9ezQUmf61DLiH7kHEq7jZXJLg5wgHCiEIfZJRDBR0H7N/A=

X-YMail-OSG: d1kF4qsVM1nYfUa0APPqu6qqPnBoXnzkc24HvquNDamMNLD

 dzgbsgolsY9r6rDFr463zIvNqc9l6p6YH4HV1vj90qxFl5MFE0Shdx6UU44b

 y8P48z6BVq_HbIxKsImca81Cco3zuQKPTBUXc8TWTpLoPMdn68rYrv4_anqT

 73qEGFveIt8djt9kisltcDSMv7d2yrFfG12O04IFLoQ0TS4Vk5ZJ.EgcWWhl

 Mh2SQN5cNJ2rFxRrd1diMxxfZ25ivzrGLlpuV9pJqVurXACaUz.7KiFXeFUX

 zKYqM_Lt7EmN2bH0EzXcvqu69GDJzRzXA4U8sofXb0ZBk.sicpVzCsgLqmFN

 2I.ZjpcH7D9NQm8_fQRmwQFdECEMjUZgVTBzpgTS_8RbA0v79q5ycN_2Cv75

 VOi0uH_HvRHBO2VNWcuIShzD7QJsXK_KFfugIihlhoEbf9PWzpLHgim.fJfs

 f8ir_jO0FH574QV5bXPNpi41cB5MnzxjK4IMuShdJkYCu4FznQhbuF_jMOZW

 8mRn.klx6aZ5_veAi_5jOSNjGPCwn0.ErWAj3TEbDwpCT9KVws9arLjaxA2Y

 BUvkZrn.Dw5043ji7piZkwBpM0QYw.ppB15Lc6EH64v9by_h4uxZD0Mm_.Fx

 J4Wwk9lgN1BNQe8eWfHGn1OwTAXQDuTzw4fVvj3eKmh5Og47bqOso9ghtaui

 dnd8.6_goDcuYkcHM6Du2oHvU9uyh8xJKMNuFzuibvViNH8REbV7HlsrWj6n

 txJPibx1sOKJX9YW4jgxpokvB66tsqHvYJxs1i9b4c_RwJwkdB.gLH7Ad3ZE

 LsWILdeTKUfxXHeEw1gbUTkWSw4KsL.O6BLTSCRNEVgkhFU5dC6l4RQ--

Received: from [41.191.231.206] by web120102.mail.ne1.yahoo.com via HTTP; Mon,

 16 Jun 2014 08:38:03 PDT

X-Rocket-MIMEInfo: 002.001,VGhpcyBpcyBncmVhdCBhcyBpdCBicmluZ3Mgb3V0IHRoZSB0aGVtZSBvZiB0b2RheWBzIGNlbGVicmF0aW9uIHdoaWNoIHdhcyBgYEEgY2hpbGQgZnJpZW5kbHkgcXVhbGl0eSBmcmVlIGFuZCBjb21wdWxzb3J5IGVkdWNhdGlvbiBmb3IgYWxsIGNoaWxkcmVuIGluIEFmcmljYScnLiBJbmZvcm1hdGlvbiBpcyBpbmRlZWQgcG93ZXIgYW5kIGV2ZXJ5b25lIG9mIHVzIGhhcyBhIHJvbGUgdG8gcGxheSB0byBoYXZlIGFsbCBjaGlsZHJlbiBlbmpveSBhbmQgYWNjZXNzIGVkdWNhdGlvbiBhdCBhbGwgbGV2ZWxzIG8BMAEBAQE-

X-Mailer: YahooMailWebService/0.8.190.668

References: <783482227b244985a3b12245ec49b22d@DBXPR07MB461.eurprd07.prod.outlook.com>

Message-ID: <1402933083.67256.YahooMailNeo@web120102.mail.ne1.yahoo.com>

Date: Mon, 16 Jun 2014 08:38:03 -0700

From: USER 1 <user1@yahoo.com>

Reply-To: USER 1 <user1@yahoo.com>

Subject: Re: SUBJECT LINE GOES HERE

To: Samantha <Samantha@exchangedomain.com>, AllStaff

        <AllStaff@exchangedomain.com>

In-Reply-To: <783482227b244985a3b12245ec49b22d@DBXPR07MB461.eurprd07.prod.outlook.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

        boundary="-1658718958-168695060-1402933083=:67256"

X-Auto-Response-Suppress: DR, OOF, AutoReply

When the AddressBookPolicyRoutingEnabled attribute is enabled by running Set-TransportConfig -AddressBookPolicyRoutingEnabled $True, I am having an issue with delivery failures for mailboxes that are hidden from the address book. I receive the following undeliverable message:

'532 5.3.2 STOREDRV.Deliver; Missing or bad StoreDriver MDB properties'

If I disable the AddressBookPolicyRoutingEnabled attribute by running Set-TransportConfig -AddressBookPolicyRoutingEnabled $False then emails are successfully delivered to the mailbox that is hidden from the address list.

I followed the installation instructions here: http://technet.microsoft.com/en-us/library/jj907308(v=exchg.150).aspx

Below is the status of the ABP Routing Agent on my Hub Transport/Mailbox server:

Enabled: True
Priority: 5
TransportAgentFactory: Microsoft.Exchange.Transport.Agent.AddressBookPolicyRoutingAgent.AddressBookPolicyRoutingAgentFactory
AssemblyPath: C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\agents\AddressBookPolicyRoutingAgent\Microsoft.Exchange.Transport.Agent.AddressBookPolicyRoutingAgent.dll
Identity: ABP Routing Agent
IsValid: True
ObjectState: New

Has anyone else run into this issue yet?

Hello,

I've completed the steps necessary to enable SMIME within Exchange 2013.  I've followed the steps listed here:  http://technet.microsoft.com/en-us/library/dn626158(v=exchg.150).aspx

Here is the output from get-smimeconfig in the Exchange Mgmt Shell.  When I go to outlook web access and compose an email, I have no option to sign or encrypt.  I've requested a user certificate and the cert template I have is set to publish certs to AD.  There's no good documentation on how to properly set this up other than the link above which is not very clear.

Hello,

I have Exchange 2013 Co-Exist with Exchange 2007. I'm planning to create a "Transport Rule" to give me NDR when "Blank Subject Line" is detected.

Hi,

We are using Exchange 2010 with sp3.i am facing issue in few days;

Delaying email to one external domain. After sitting in the queue over night they are sent successfully. Email to anyone else is sent right away. Any ideas on what is causing this?

Following is the message in Msg Queue viewer.

"451.4.4.0 Primary target Ip address responded with "421.4.4.2 Connection dropped due to SocketError "Attempted failover to alternate host, but taht did not succeed. Either there are no alternate hosts, or delivery failed to all alternate hosts".

Hello,

I am able to send emails to different domains like yahoo,hotmail,gmail, and others from my administrator account. But when I use a different account like pooriya, I I am able to send to all domains except gmail. Could you please assist me with this?

Pooriya Aghaalitari

Hi,

We have recently been letting out one of our office, which was having a AD domain(abc.com) with email domain(123.com) created with seprate name.One of teh mailbox server of that email domain(123.com) was hosted in one of our office in India. Now the requirement is to cut off all the dependancy from that domain(abc.com) and have separate exchage infra(123.com) in India. We have AD domain in India(123.com) and want to share to have teh same SMTP domain(123.com). For this we have created new Exchange 2013 server with CAS and MB roles(in 123.com). We need help how to configure mail flow for the users who will be on this new exchange. The MX record is hoseted in the office which is to shutdown, however we can host this till the time we completely migrate teh users in India. The user migration will be done by creating teh pst and deleting and recreating the users innew Exchange. Below are teh queries:

1. How will the external mail be recieved to teh new domain 123.com users

2. During teh migration how will teh users share mails between the two diffrent exchange server with same SMTP domain.(Ad domain is diffrent)

Appreciate your help in advance...

Manu

hi...

i have exch..2013 with server 2008 r2 i have icn send e mail enternal and external but i canot recive any e mail externalthe  nybody help me,but its stoped suddently before its working fine..tell me one by one for trouble shooting..

We are running Exchange 2010 SP3 RU4, we have a setup as follow:

1- Dynamic distribution groups based on the DB membership and filters out hidden accounts, these were created in PS and are not manageable or viewable (for the large part) in EMC or ADUC. These lists are used primarily for third party archiving manipulation and management.

2- Master Distribution for all Employees (Moderated), created by adding all the above DD lists as described in point #1.

When I open up any of the Dynamic Lists and run the filter button, I don't see any of the hidden accounts filtered out as designed, yet when an email is sent out the Master Distribution list, all the hidden members receive the email.

I believe that the reason (as read on other threads) is that the DDL were not expanded prior to sending since the master distribution list is moderated and hence Exchange doesn't allow for it to be expanded.

Is that the reason why? if not what is the reason for that behavior? How can I solve this issue?

I also attempted to create a transport rule to block/delete such messages after defining a custom attribute to hidden mailboxes but couldn't get the right conditions/predicates to get the desired results.

Any input would be greatly appreciated.

Ash

Hello,

Our Exchange Server version is Exchange 2013 sp1 and 500 users we have.

mail.que DB grows 14gb about two days. I checked everything but ı can not solve.

Pipeline tracing disabled

I stopped MS Exchange Transport Service remove mail.que db recreate but issue still continue

Please Help me,

Thanks.

Murat ER Microsoft Certified Systems Administrator

I have only one Exchange 2013 SP1 server and one 2012 R2 Domain controller.  The one Exchange server is a mailbox and database server.  I have no edge transport server.   We'll call my external domain mybusiness.com and the internal domain is mybusiness.net.   I have made several mailboxes by by asking Exchange to tie in to the existing domain accounts.  All addresses are mybusiness.com.  Outlook 2013 auto connects to the correct account and displays the correct email address. 

When I try to send an email locally from user1@mybusiness.com to user2@mybusiness.com, the message goes to the outbox and no error messages are shown.  I see the message in the mailbox database queue in a ready state.  There are so many different log files and information on the net that all my search find find out the problem have turned up with nothing.  The last error is blank.  Do I even need a send connector for internal email with only one server? 

When I receive a message from the internet, from say a gmail account, my firewall shows that it is accepted and gets sent tot the server.  For a while, those messages would also show up in the mailbox database queue in a ready state and would also not process.  Now they don't even do that.  

When I send an outgoing message to the internet, it also goes to sent items with no error message.  I cannot find mention of it anywhere in the queues, and yet I don't receive it on the external mail server.  The outgoing send connector is set for SMTP and * domains.  It should be identical to the default send connector.

I even tried mess with telnet which inconsistent results.  Sometimes the commands work, other times they tell me invalid domain name, command not found, bad address and then I'll put in the exact same command and it will work.  So for, I have not been able to complete the 5 commands to send the message without being kicked out for too many bad commands.

Here's the scenario:

2 Exchange 2013 Servers configured with combined CAS and Mailbox roles.

While simulating an outage on one server (ServerA) by restarting it, any inbound mail (e.g. from the Internet) sits in the "SMTP Delivery to Mailbox" queue in Retry on ServerB until the ServerA is back up.  I would expect the mail to be delivered successfully as the mailbox databases all mounted successfully on ServerB when ServerA went down. 

It's looks almost as if the "SMTP Delivery to Mailbox" queue has somehow cached the active mailbox information, i.e. "When I last checked the mailbox databases were active on ServerA, so I'll keep trying to deliver there".

Any thoughts on what is going on here?

Tony www.activedir.org Blog: www.open-a-socket.com

Hello all,

It looks like there is a flaw by design in Exchange 2013 recipient validation, which in turn causes backscatter issues. I failed to find a way around it, maybe someone could help.

The Design: 2 x Exchange 2013 CAS + MBX servers (hardware NLB & DAG)

Version: Exchange Server 2013 Cumulative Update 3 (CU3) (Version15.0 (Build 775.38)  )

The issue:

Recipient validation has a flaw, which is documented (probably that should make it a "feature", but it doesn't): 
In short - Recipient validation on Mailbox servers blocks message to all recipients, if at least one of them is non-existent.
http://social.technet.microsoft.com/Forums/office/en-US/12181f43-7173-44dd-998a-9307f92ffc5d/exchange-2013-casmbx-recipient-validation-rejects-entire-message-if-any-of-recipients-are-invalid

As there is no way to explain the logic of blocking e-mails to valid recipients if at least one of them is invalid to a customer, the Recipient validation on Mailbox servers becomes unusable and is disabled.

But if the recipient validation is disabled, the Exchange design without Edge servers or other perimeter SMTP servers that could block e-mails to non-existent recipients, becomes vulnerable to backscatter SPAM attacks, since Exchange will always send out NDR to the FROM address.

According to the answer in the thread mentioned above, other antispam features should prevent it, but as always with antispam - it's not even close to 100% effective, as recipient validation would be. The result - an entry in backscatterer.org.

Question: How to prevent backscatter in Exchange 2013 without Edge servers, and without loosing valid e-mails due to recipient validation bug ("feature")?

Thank You for Your help.
Sincerely,
Vince

Good Afternoon,

       I have a customer running Exchange 2010 SP3 RU5 on SBS 2011. When trying to send a message that has a 10+ MB attachment they receive a rejection message:

Hi all, I had a strange issue that came up after I reconfigured our receive connector in exch2013.

   I have Exch2013 with Cu5 and a 2010 sp3. In order to fight spam I needed to reconfigure a new connector that's a bit locked down compared to the default frontend that's open to all remote networks, so in the new connector under the scope settings I put our internal network ip and disabled the default frontend connector that was created during install. Since our exch2010 box is the main server that sends in and out, and has better antispam features, this is where all emails went through and got routed to the 2013 box.

  After restarting services, all was working including iphones and androids, except for Macs with outlook 2011, they were suddenly not able to connect to the exch2013 box after the changes. I looked at the transport logs but I couldn't see anything showing why these users were not connecting, event viewer as well. It did block a lot of spam from getting through, but I had to revert back to the default front end connector just to get the Mac outlook users working again, has anyone seen this before, or any other settings I might have missed. If anyone can get me some ideas or pointers, I'd greatly appreciate.

Thanks in advanced.

Carlo

Hi all,

just wondering if its possible to convert an existing receive Connector from FrontendTransport to Hubtransport?

thanks!

Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you. Thank you! Off2work

Dear All,

I have exchange server 2013 running with windows server 2012.

My email server have been send and receive email with internal and external as normal.

Today, i got the problem the email cannot send out to external and get the error below:

Please comment.

BR,

Khemarin

Khemarin333@hotmail.com

I'm getting hundreds of messages in the Queue where the From Address is < >. 

Do I just let these build up or is there a setting somewhere that would just drop the message if it has a blank sender?

Here is an example of one that I've received;

Identity: Pebbles\512\21474838371
Subject: Undeliverable: MUST READ: Vehicle's Below Kelly-Blue-Book*
Internet Message ID: <1ca164f3-6423-4aa3-9574-a5124e61d827@mydomain.com>
From Address: <>
Status: Ready
Size (KB): 10
Message Source Name: DSN
Source IP: 255.255.255.255
SCL: -1
Date Received: 5/27/2014 11:51:09 AM
Expiration Time: 5/29/2014 11:51:09 AM
Last Error: 400 4.4.7 Message delayed
Queue ID: Pebbles\512
Recipients:  Notification9334@carforcheap0821.us;2;2;[{LRT=};{LED=400 4.4.7 Message delayed};{FQDN=};{IP=}];0;CN=outbound,CN=Connections,CN=Exchange Routing Group (DWBGZMFD01QNBJR),CN=Routing Groups,CN=Exchange Administrative Group (FYDIBOHF23SPDLT)....

1 email server in domain; Exchange 2013 sp1/Win2012 Standard

PennyM