Exchange Message Tracking with only the sent Domain available not whole address?

Posted on 2005-04-13
Last Modified: 2008-03-17
I am running Exchange 2003. I have used the message tracking center and it work great if you have the full address, from or to, that a message was sent to. I have been getting a few different messages in the Exchange Server 2003 Eventlog saying that messages to particular domain say: has failed but it keeps trying to send; many times. IT ONLY GIVES THE DOMAIN NOT THE FULL EMAIL ADDRESS :(

My question is, is this merely a persistent user or is the machine infected with spyware or some other program. I wanted to know who was sending the message to that domain.  I tried to do a search for all messages sent to: * but that does not work.

Anyone, know how I can go about tracking all messages sent to a particular domain without knowing the full recipient email address.

Thanks for you help.
Question by:bwalan
    LVL 104

    Accepted Solution

    Message tracking is good at what it is designed to do - track a particular message. It isn't too good at doing anything else.

    The more recent viruses have tended to have their own SMTP server built in and will try and send directly. The trojans that make up BOTNETS will send via the ISPs SMTP Server.

    Therefore I would say that this is a persistent user - especially if it is a single domain. What might be happening is that the message is not being sent, either because your server cannot resolve the address or it is being blocked.
    If you look in the queues you may see messages to this domain listed.

    Are you collecting copies of the NDRs? If not, you might want to. This will give you an idea of why the messages are failing.
    I wouldn't use your own mailbox for NDR messages - and as you can't use a public folder you will need to use another mailbox.
    Set the full email address ( or whatever) in
    ESM, Admin Groups, <your admin group>, Servers, <your server>, protocols, SMTP. Right click on Default SMTP VS and choose Properties. Click on the tab "Messages".

    Exchange MVP.

    Author Comment

    Thats great advice and I'll take it but is there a tool that I can purchase that will let me do wil card searches on all sent items such as:  * for senders and * for recipient.

    Maybe there is no such tool?

    LVL 104

    Expert Comment

    If you want stats out of Exchange then the best is Quest Message Stats. I have had a play with an evaluation version of a fairly high traffic Exchange server and it was fantastic. It uses Message Tracking data, so if you already have Message Tracking enabled then you have information it can use immediately.

    LVL 16

    Expert Comment

    Did you try putting just the domain name "" in the message tracker?
    Previous versions of exchange permit this.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Threat Intelligence Starter Resources

    Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

    Use email signature images to promote corporate certifications and industry awards.
    Use these top 10 tips to master the art of email signature design. Create an email signature design that will easily wow recipients, promote your brand and highlight your professionalism.
    To show how to generate a certificate request in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Servers >> Certificates…
    This video discusses moving either the default database or any database to a new volume.

    760 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    11 Experts available now in Live!

    Get 1:1 Help Now