none
Missing Email - Only EventId:RECEIVE

    Question

  • I have a ndr@ distribution list which I can send to from external.

    However, when an NDR is received, it only shows as "RECEIVE" in the logs (no TRANSFER etc) and I'm unable to determine what happens to it after this.

    [PS] C:\Windows\system32>Get-MessageTrackingLog -MessageID "<0102015f299fc896-84908505-1dd0-4913-b217-3df4e5b96f1d-0000@eu-west-1.amazonses.com>" | fl 
    
    *PSComputerName          : mail.*REMOVED*
    RunspaceId              : 8ba0d009-a883-4227-8cc8-323f0770d1f2
    PSShowComputerName      : False
    Timestamp               : 17/10/2017 10:17:57
    ClientIp                : 10.0.0.12
    ClientHostname          : *REMOVED*
    ServerIp                : 10.0.0.12
    ServerHostname          : mail
    SourceContext           : 08D5153FD1E4FD79;2017-10-17T09:16:59.107Z;2
    ConnectorId             : MAIL\Default MAIL
    Source                  : SMTP
    EventId                 : RECEIVE
    InternalMessageId       : 127702262612054
    MessageId               : <0102015f299fc896-84908505-1dd0-4913-b217-3df4e5b96f1d-000000@eu-west-1.amazonses.com>
    Recipients              : {ndr@*REMOVED*}
    RecipientStatus         : {}
    TotalBytes              : 12208
    RecipientCount          : 1
    RelatedRecipientAddress :
    Reference               :
    MessageSubject          : Delivery Status Notification (Failure)
    Sender                  : MAILER-DAEMON@eu-west-1.amazonses.com
    ReturnPath              : <>
    Directionality          : Incoming
    TenantId                :
    OriginalClientIp        : 54.240.3.182
    MessageInfo             : 0cA:
    MessageLatency          :
    MessageLatencyType      : None
    EventData               : {[FirstForestHop, mail.*REMOVED*], [ProxiedClientIPAddress, 54.240.3.182],                          [ProxiedClientHostname, a3-182.smtp-out.eu-west-1.amazonses.com], [ProxyHop1,                          mail.*REMOVED*(10.0.0.12)], [DeliveryPriority, Normal], [OriginalFromAddress, <>],                          [ExternalOrgIdNotSetReason, ]}

    The AntiSpam log shows the message incoming with result "SCL, not available: content filtering was bypassed" (as expected).

    I assume the message is being dropped after being received, but I can't see where/why.

    Thanks.


    • Edited by tenfourzero Tuesday, October 17, 2017 10:39 AM
    Tuesday, October 17, 2017 10:39 AM

All replies

  • I have a ndr@ distribution list which I can send to from external.

    However, when an NDR is received, it only shows as "RECEIVE" in the logs (no TRANSFER etc) and I'm unable to determine what happens to it after this.

    [PS] C:\Windows\system32>Get-MessageTrackingLog -MessageID "<0102015f299fc896-84908505-1dd0-4913-b217-3df4e5b96f1d-0000@eu-west-1.amazonses.com>" | fl 
    
    *PSComputerName          : mail.*REMOVED*
    RunspaceId              : 8ba0d009-a883-4227-8cc8-323f0770d1f2
    PSShowComputerName      : False
    Timestamp               : 17/10/2017 10:17:57
    ClientIp                : 10.0.0.12
    ClientHostname          : *REMOVED*
    ServerIp                : 10.0.0.12
    ServerHostname          : mail
    SourceContext           : 08D5153FD1E4FD79;2017-10-17T09:16:59.107Z;2
    ConnectorId             : MAIL\Default MAIL
    Source                  : SMTP
    EventId                 : RECEIVE
    InternalMessageId       : 127702262612054
    MessageId               : <0102015f299fc896-84908505-1dd0-4913-b217-3df4e5b96f1d-000000@eu-west-1.amazonses.com>
    Recipients              : {ndr@*REMOVED*}
    RecipientStatus         : {}
    TotalBytes              : 12208
    RecipientCount          : 1
    RelatedRecipientAddress :
    Reference               :
    MessageSubject          : Delivery Status Notification (Failure)
    Sender                  : MAILER-DAEMON@eu-west-1.amazonses.com
    ReturnPath              : <>
    Directionality          : Incoming
    TenantId                :
    OriginalClientIp        : 54.240.3.182
    MessageInfo             : 0cA:
    MessageLatency          :
    MessageLatencyType      : None
    EventData               : {[FirstForestHop, mail.*REMOVED*], [ProxiedClientIPAddress, 54.240.3.182],                          [ProxiedClientHostname, a3-182.smtp-out.eu-west-1.amazonses.com], [ProxyHop1,                          mail.*REMOVED*(10.0.0.12)], [DeliveryPriority, Normal], [OriginalFromAddress, <>],                          [ExternalOrgIdNotSetReason, ]}

    The AntiSpam log shows the message incoming with result "SCL, not available: content filtering was bypassed" (as expected).

    I assume the message is being dropped after being received, but I can't see where/why.

    Thanks.


    Whats a "ndr@ distribution list"?

    Generally, DLs and NDRs don't play well together.

    • Proposed as answer by Egg Thursday, April 26, 2018 1:46 PM
    Tuesday, October 17, 2017 10:57 AM
  • Whats a "ndr@ distribution list"?
    A DL to catch ndr's with an ndr alias, so ndr@my-domain.com.

    It works when sending to an existing dist lists, despite matching configurations. I've decided to send to an existing dist list and redirect to the end users using MailFlow->Rules matching rulesets.

    Not ideal but it works, thanks for the prompt to look at the DL.

    Tuesday, October 17, 2017 11:46 AM
  • Hi,

    Thanks for contacting our forum.

    As you've mentioned above, in anti spam log the "SCL, not available", can you see the value of the SCL, could you please check if any more detailed messages of the log? Thanks.

    Given the message tracking log, it just means that the message has been received by the transport service.

    It's recommended to check the original message tracking log on all of your servers in the following path:

    C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking

    Hope it helps and thanks for your efforts.


    Regards,

    Jason Chao


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, October 18, 2017 9:49 AM
    Moderator
  • Hi,

    I am currently standing by for further update from you and would like to know how things are going. Please check if the reply helps you, if it helps please help to mark as answer.

    Thanks for your time.


    Regards,

    Jason Chao


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, November 1, 2017 9:31 AM
    Moderator
  • Generally, DLs and NDRs don't play well together.

    Just had the same issue again, this time found this article that Distribution Groups cannot receive NDRs:
    https://support.microsoft.com/en-us/help/817220/xadm-non-delivery-reports-to-a-distribution-list-or-to-a-public-folder

    Clearly this applies beyond Exchange 2010, despite the "applies to" notice.

    I've added the addresses as an SMTP email to the end-user instead, all working fine now.


    • Proposed as answer by Egg Thursday, April 26, 2018 1:47 PM
    Thursday, April 26, 2018 1:47 PM