locked
Mail not delivered - where is it Exchange? RRS feed

  • Question

  • Hi,

    So I came across this issue a while ago with a distribution list and created a thread then (https://social.technet.microsoft.com/Forums/exchange/en-US/6bb02215-84e4-4b21-8d44-dfc9de408745/mail-going-missing-to-distribution-list?forum=exchangesvradminlegacy&prof=required) which turned out to be that the distribution list was not Universal so all DC's could see it.

    Now the distribution group is Universal there is still mail going missing.  I have an example this morning and this is the Exchange log for the message id:

    SerializationData       : {0, 1, 0, 0...}
    PSComputerName          : mailserver.domain.local
    RunspaceId              : 82beeba6-f66c-4420-8def-b7fa7163ae51
    Timestamp               : 08/10/2015 09:13:37
    ClientIp                : fd56:3812:9157:7f22:d27d:1932:fb44:e822
    ClientHostname          : mail.domain.co.uk
    ServerIp                : fd56:3812:9157:7f22:8fb2:6743:c06b:5252
    ServerHostname          : MAILSERVER
    SourceContext           : 08D2BC7BE0489245;2015-10-08T08:13:37.150Z;0
    ConnectorId             : MAILSERVER\Default MAILSERVER
    Source                  : SMTP
    EventId                 : RECEIVE
    InternalMessageId       : 16322
    MessageId               : <58bcfc97-7593-4b29-b71a-6bdc47db28ab@sender.com>
    Recipients              : {support@domain.co.uk}
    RecipientStatus         : {}
    TotalBytes              : 1408169
    RecipientCount          : 1
    RelatedRecipientAddress : 
    Reference               : 
    MessageSubject          : Undeliverable: Invoice from MyCompany
    Sender                  : postmaster@sender.com
    ReturnPath              : <>
    MessageInfo             : 00A: NTS: 
    MessageLatency          : 
    MessageLatencyType      : None
    EventData               : {[FirstForestHop, MAILSERVER.domain.local]}

    SerializationData       : {0, 1, 0, 0...}
    PSComputerName          : mailserver.domain.local
    RunspaceId              : 82beeba6-f66c-4420-8def-b7fa7163ae51
    Timestamp               : 08/10/2015 09:13:37
    ClientIp                : 
    ClientHostname          : 
    ServerIp                : 
    ServerHostname          : MAILSERVER
    SourceContext           : 
    ConnectorId             : 
    Source                  : ROUTING
    EventId                 : RESOLVE
    InternalMessageId       : 16322
    MessageId               : <58bcfc97-7593-4b29-b71a-6bdc47db28ab@sender.com>
    Recipients              : {ITSupport@domain.co.uk}
    RecipientStatus         : {}
    TotalBytes              : 1408321
    RecipientCount          : 1
    RelatedRecipientAddress : support@domain.co.uk
    Reference               : 
    MessageSubject          : Undeliverable: Invoice from MyCompany
    Sender                  : postmaster@sender.com
    ReturnPath              : <>
    MessageInfo             : 
    MessageLatency          : 
    MessageLatencyType      : None
    EventData               : 

    No DNS issues and nothing in the Event Viewer.  What has Exchange done with this message?  Is it something to do with the message as it appears to be a non-delivery report from the sender domain.

    Thursday, October 8, 2015 9:23 AM

All replies

  • So someone from the exterior is trying to send a message to an internal distribution list?

    If so, is the list configured to allow messages from unauthenticated senders?


    Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you.

    Thursday, October 8, 2015 1:37 PM
  • Hi ,

    In addition to David suggestions .

    If the sender has received the NDR please share us the NDR , so that we can able to tell the exact cause for this issue .


    Thanks & Regards S.Nithyanandham

    Thursday, October 8, 2015 2:23 PM
  • Yes, unauthenticated senders are allowed on that distribution list.  I have received plenty of other emails (from external sources) to the same email address which is attached to the distribution list.
    Thursday, October 8, 2015 3:00 PM
  • No the NDR is coming from the external domain into my organisation and Exchange.  We've sent them a document but the address was probably wrong and it generated a NDR which is coming back to us to the distribution list.  It then gets lost in Exchange as per the tracking above.
    Thursday, October 8, 2015 3:01 PM
  • Hello Tippers,

    Does this issue occur randomly or it can be always reproduced?
    Could you let us know the NDR code and post the message track log about this issue for further research?


    Thanks,

    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com


    Simon Wu
    TechNet Community Support

    Friday, October 9, 2015 1:49 PM
    Moderator
  • Randomly I'd say but it's very hard to find out how many emails go missing!  I can see from our SMTP gateway software when mail comes in and that it is passed onto Exchange and I can see when it appears in my mailbox but not other users so I don't know how much gets lost in Exchange!

    I don't have the NDR as the message is lost in Exchange.

    The message track log is posted in the first post.  There are two steps, RECEIVE and RESOLVE and I guess it fails to RESOLVE but the event message gives no idea which DC it tried to use or what it did with the message.  Is there any other logging I am missing?

    Friday, October 9, 2015 1:58 PM
  • Hello,
     
    For this kind of issue, we can also enable the pipleline tracking log:

    https://technet.microsoft.com/en-us/library/bb125018(v=exchg.150).aspx?f=255&mspperror=-2147217396


    Thanks,


    Simon Wu
    TechNet Community Support

    Tuesday, October 13, 2015 8:25 AM
    Moderator