locked
From address showing <> in queue viewer RRS feed

  • Question

  • Can someone please shine some light on this and point me in the right direction to troubleshoot this issue?

    When I check the exchange queue viewer, there are numbers weird domains displayed looking like spam. Please see below as example

    From Address: <>
    Status: Ready
    Size (KB): 6
    Message Source Name: DSN
    Source IP: 255.255.255.255
    SCL: -1
    Date Received: 1/16/2011 10:32:48 AM
    Expiration Time: 1/18/2011 10:32:48 AM
    Last Error: 400 4.4.7 Message delayed
    Recipients:  kgee_qf@pro.onet.pl

    How can I prevent this and determine where these emails or orginating from as the source IP listed above isn't accurate.

    Tuesday, January 18, 2011 1:57 PM

Answers

  • Most likely those are NDRs for users who dont exist in your org.

    What do you use for anti-spam on the SMTP gateways? Does it support recipient filtering? If not, and you are not using Edge, then you can enable on the 2010 Hub Transports:

     

    http://technet.microsoft.com/en-us/library/bb201691.aspx

    Enable Anti-Spam Functionality on a Hub Transport Server
    Configure Recipient Filtering Properties
    • Proposed as answer by Allen Song Tuesday, January 25, 2011 7:01 AM
    • Marked as answer by Allen Song Monday, January 31, 2011 2:10 AM
    Tuesday, January 18, 2011 4:12 PM
  • Hi,

    This issue may occur if the spamer keeps sending to your domain with non-existed recipient with undeliverable sender.

    To fix out this issue, you have to enable Recipient Filter.

    Thanks

    Allen


    Allen Song
    • Marked as answer by Allen Song Monday, January 31, 2011 2:10 AM
    Tuesday, January 25, 2011 7:06 AM

All replies

  • As this is a broadcast name so i suggest you to ask a network admin to monitor the switch and review the ARP table to identify the source of the issue, it seems it's an internal source.
    Mohamed Fouad, Systems Administrator - Egypt Engineers - http://EgyEng.com - http://Facebook.com/EgyptEngineers - *Please remember to click “Mark as Answer” on the post that helps you. This can be beneficial to other community members reading the thread. **remember to "Vote as Helpful"; to let other members to know the important posts to be read in the thread.
    • Proposed as answer by Mohamed.Fouad Tuesday, January 18, 2011 4:04 PM
    Tuesday, January 18, 2011 2:20 PM
  • Thanks for your reply. It's much appreciated. I will have the network admin monitor the switch and i will report his findings.

    I was reallly hoping i could use exchange or some exchange tool to determine the exact source as i'm aware that it is internal

     

    • Proposed as answer by cteneyck Tuesday, May 14, 2013 8:09 PM
    Tuesday, January 18, 2011 3:43 PM
  • It's usually a spam at one of a user machine, it's better to have a good antivirus and antispam at all users machines, and to have a forefront for exchange installed at all roles.


    Mohamed Fouad, Systems Administrator - Egypt Engineers - http://EgyEng.com - http://Facebook.com/EgyptEngineers - *Please remember to click “Mark as Answer” on the post that helps you. This can be beneficial to other community members reading the thread. **remember to "Vote as Helpful"; to let other members to know the important posts to be read in the thread.
    • Proposed as answer by Mohamed.Fouad Tuesday, January 18, 2011 9:20 PM
    Tuesday, January 18, 2011 4:06 PM
  • Most likely those are NDRs for users who dont exist in your org.

    What do you use for anti-spam on the SMTP gateways? Does it support recipient filtering? If not, and you are not using Edge, then you can enable on the 2010 Hub Transports:

     

    http://technet.microsoft.com/en-us/library/bb201691.aspx

    Enable Anti-Spam Functionality on a Hub Transport Server
    Configure Recipient Filtering Properties
    • Proposed as answer by Allen Song Tuesday, January 25, 2011 7:01 AM
    • Marked as answer by Allen Song Monday, January 31, 2011 2:10 AM
    Tuesday, January 18, 2011 4:12 PM
  • Hi,

    This issue may occur if the spamer keeps sending to your domain with non-existed recipient with undeliverable sender.

    To fix out this issue, you have to enable Recipient Filter.

    Thanks

    Allen


    Allen Song
    • Marked as answer by Allen Song Monday, January 31, 2011 2:10 AM
    Tuesday, January 25, 2011 7:06 AM