Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 28042
  • Last Modified:

MSExchangeTransport errors 3030, 3018, 3015, & 3008 occur frequently in event viewer.

Hello everyone. I am sitting at a Small Business Server 2003 machine and I am getting a lot of MSExchangeTransport errors in the event viewer. The errors I get are 3030, 3018, 3015, and 3008. Examples of each error are below and they are generated every 10-15 seconds. It may be useful to know that we run NAV corporate 8.1 edition and it has detected viruses on some machines, but it has successfully quarantined and deleted all viruses. Same goes on the server. I have looked at similar posts on these errors on EE and have configured the Default SMTP Virtual Server to those specifications. Is there anything else I can look at or try.

--------------------------------------------------------------------------------------------------

Event ID 3030:

A non-delivery report with a status code of 5.1.8 was generated for recipient rfc822;g5207@aunet.net (Message-ID <SERVERtpfTYSl1q4gto0000066d@mydomain.org>).

Event ID 3015:

A non-delivery report with a status code of 5.3.0 was generated for recipient rfc822;k5859@aunet.net (Message-ID <SERVERPasSmz6UuEhjJ000005d9@mydomain.org>).
Causes: Exchange mistakenly attempted mail delivery to an incorrect MTA route.  

Event ID 3018:

A non-delivery report with a status code of 5.4.0 was generated for recipient rfc822;panny728@tpts9.seed.net.tw (Message-ID  <YFLDFGWPHNOZNSZWPY@chickmail.com>).  
Causes: This message indicates a DNS problem or an IP address configuration problem  
Solution: Check the DNS using nslookup or dnsq. Verify the IP address is in IPv4 literal format.

Event ID 3008:

A non-delivery report with a status code of 5.0.0 was generated for recipient rfc822;ericwumc@kimo.com (Message-ID  <7--3wht4-p$k1$nk$58q10--v@dwzau.ia>).  
Cause:  This indicates a permanent failure. Possible causes :  1)No route is defined for a given address space. For example, an SMTP connector is configured, but this recipient address does not match the address spaces for which it routes mail.  2)Domain Name Server (DNS) returned an authoritative host not found for the domain.  3)The routing group does not have a connector defined û mail from one server in the routing group has no way to get to another routing group.    
Solution: Verify that this error is not caused by a DNS lookup problem, and then check the address spaces configured on your STMP connectors. If you are delivering Internet mail through an SMTP connector,  consider adding an address space of type SMTP with value ô*ö (an asterisk) to one of the SMTP connectors to make routing possible. Verify all routing groups are connected to each other through a routing group connector or another connector.

--------------------------------------------------------------------------------------------------

Is it possible that this is the work of a spammer or something along that lines. Any help is greatly appreciated and I thank you ahead of time.
0
pikeboss79
Asked:
pikeboss79
1 Solution
 
SembeeCommented:
Those look like the results of bounced email messages with false header information - ie the email has been delievered to your email server for an invalid user, but the "from" line is also false meaning that Exchange cannot bounce it back. Eventually the email will fail and this error will be generated.

If you are using 2003, enable the option to filter out invalid users and you will not have this problem.

Simon.
0
 
pikeboss79Author Commented:
Where in exchange do I enable that option?
0
 
SembeeCommented:
I knew you would ask that question...

Two parts

1. Expand ESM, Message Delivery.
2. Right click on "Message Delivery" and choose Properties.
3. Click on the tab "Recipient Filtering".
4. Enable the option "Filter Recipients who are not in the directory."

You then need to enable the Recipient Filter on the SMTP Server.

1. Still in ESM, Expand Admin Groups, <your admin groups>, Server, <your server>, Protocols, SMTP.
2. Right click on SMTP Virtual Server and choose Properties.
3. Click on "Advanced" next to the IP address on the first tab.
4. With the IP address selected, choose "Edit".
5. Enable "Apply Recipient Filter".
6. Click Apply/OK until clear.

Simon.
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
pikeboss79Author Commented:
Thank you Sembee for your timely and informative response. Your recommendations fixed my problem. I did have to go into the Exchange Queues and delete a lot of trash messages that were pending. It turns out I did overlook a machine that had a virus on it a couple days back.

P.S. In my Exchange Queue list there are over 800 queues listed and all but a few are legit. Is there a way to remove the illegitimate queues from the list? I have deleted all messages from the bad queues and I have frozen them also.
0
 
pikeboss79Author Commented:
I mean all but a few of the 800 queues listed are illegitimate. OOPS

About 800 bad queues.
About 12 good queues.
0
 
SembeeCommented:
There is an article from Microsoft which tells you how to clean up after a spam attack. It mentions SBS but applies to regular Exchange as well. That should help you clean up.

http://support.microsoft.com/default.aspx?kbid=324958

Simon.
0
 
oldskool75Commented:
This Was a big help!  I used this issue to fix the same problem...  Thanks Simon and experts exchange!
0
 
SembeeCommented:
Since this question was closed I have written my own article based on that KB article but with more information and techniques. http://www.amset.info/exchange/spam-cleanup.asp

Simon.
Exchange MVP.
0
 
skibosupportCommented:
Worked perfectly for me on SBS2003. Thanks Sembee!
0
 
mkz371975Commented:
i have exchange 2003 with service pack 2 and i have problem with it wit event id 3030 + 3018 sam time andi check for virus and instasll gfi for spam
how i can solve the problem o
0

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now