3005 Event ID's (NDR's) in Application Log of Exchange 2003 Front End Servers

I am getting constant 3005 evet ID's in the application log of both of my Exchange 2003 Front End servers which handle delivery of inbound and outbound Internet email.    Below is a snapshot of what a particular event is saying:

Event Type:      Error
Event Source:      MSExchangeTransport
Event Category:      NDR
Event ID:      3005
Date:            8/23/2006
Time:            9:45:03 AM
User:            N/A
Computer:      ETNMEM2FE01
A non-delivery report with a status code of 4.4.6 was generated for recipient rfc822;adbuo@svm.com (Message-ID  <001001c6c6af$c79adf70$23a3067c@pleiadesserver>).  
Cause: The maximum hop count was exceeded for this message.  This non-delivery report can also be caused if a looping condition exists between sending and receiving servers that are not in the same Exchange organization. In this situation, the message bounces back and forth until the hop count is exceeded.  A configuration error in the e-mail system can also cause the message to bounce between two servers or to be forwarded between two recipients.      
Solution: The maximum hop count is a property set on each virtual server and you can manually override it.  The default maximum hop count is 15. Also, check for any situations that might cause loops between servers.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
0000: cd 02 04 c0               Í..À    

Annoying issue and makes the Application Log pretty useless because the Event ID's fill up the entire log.   Microsoft's website was of no help.    Anyone else had this same issue and might share what the solution was ?  

Thanks       TB186K
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.


The following link contains all the error codes including your also 4.4.6 , the resolution for each error code is also there
a tool named winroute is also explianed there so as to troubleshoot these kind of errors . It will help you ..


svmEMDSAuthor Commented:

I looked at the article but it didn't tell me anything I didn't already know.   Need something to point me in the right direction on what to check that could be causing the NDR's to loop.    Not sure what to check at this point.   We are on Exchange 2003 and I checked the hop count prior to me posting this question and it is set to 30 by default just as the KB 284204 reconfirmed.   I don't see how bumping up the hop count is going to clear up this particular issue.   The message will just take longer to bounce around.  I need to get to the root of why these NDR's are bouncing and get it to route correctly and reduce these events from constantly posting in the app event log on my Exchange Front Ends.

Those types of NDRs usually mean what they say - a loop condition or too many hops.
Most of the time this isn't a problem with you, but the remote site or your ISP. They could be rejecting the message in an odd way that is upsetting something.

The domain mentioned in that NDR is a client of mxlogic - who I believe are an outsourced email protection service.
They could be rejecting your message.

If you getting lots of these to different domains then it could be an issue closer to home. It might be as something as simple as your DNS isn't configured correctly, the messages are being rejected on that basis and your firewall is not accepting the traffic back.

Ensure Business Longevity with As-A-Service

Using the as-a-service approach for your business model allows you to grow your revenue stream with new practice areas, without forcing you to part ways with existing clients just because they don’t fit the mold of your new service offerings.

svmEMDSAuthor Commented:

You are correct about MXlogic we use them to filter all of our inbound Internet email.   These 3005 errors and NDR's are for emails being sent to  @svm.com which is one of the email domains our company owns (Servicemaster)  They are not occuring for the other domains that we own, just  @svm.com     We have a small number of users who still receive email to that domain.   I have that domain listed as an alias address on my mailbox for test purposes and I get any of the test emails I send to that alias.   The emails coming in that are generating the tons of 3005 event ID's in the app log are invalid and do not exist in our organization.  What I am trying to currently do is identify all of the users in our organization who own an  @svm.com  email address and then I can use that information to work with MXlogic  to filter out anything not destined for those valid internal addresses.    New users that we create do not get an  @svm.com alias address assigned to them.   So the number of users with an @svm.com address should be a small number.  

I am having problems identifying those users with an @svm.com address because its not the Primary SMTP address on those users mailboxes and when I run a query in ADUC or use the Find/Search function to scan the entire Directory it turns up nothing.   I actually have another question on this site addressing that issue specifically.  

If these emails are coming in to invalid users then I expect Exchange is kicking them back out on an NDR and MXLOGIC are not accepting them back, or they are going off on their own way.

You could annoy MXLOGIC by enabling recipient filtering on the SMTP virtual servers of the point of entry. That will stop the messages from being delivered because they don't match any user on your domain.


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
svmEMDSAuthor Commented:
We do not send any response back to MXlogic.   MXlogic feeds inbound internet email to two Front End Linux Redhat servers which then deliver to our Exchange 2003 Front Servers for delivery to our mail environment.   If say a bogus address comes in from the outside at    bogus@svm.com   It gets passed on from Mxlogic to our Linux servers and they forward it to Exchange, but the Linux Servers are not setup to return any response back to MXlogic.   Could be those emails are bouncing back and forth between those Linux Front Ends and the Exchange Front End servers;  not sure.   I have talked about this problem with MXlogic and they want us to turn on Explicit filtering on our MXlogic portal but we can't do that right now.

It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.