Solved

Receiving multiple copies of an email through exchange 2003 server

Posted on 2007-04-11
20
624 Views
Last Modified: 2008-01-09
I have windows 2000 server installed as domain controller and exchange 2003 server installed on windows 2000 server as member server. ISA 2000 server is installed as front end server. Exchange server is published through ISA server and all the traffic is going through ISA server. Now the problem is that we are receiving emails multiple times and from the last two days the number of repeated emails increased dramatically. Can anybody expalin if an email is received mutiple times, the problem will be at sender's email server or recipient email server. What i have to do to resolve this issue.
Microsoft outlook 2003 is installed at clients end and is configued as exchange server client.
0
Comment
Question by:upl
  • 7
  • 7
  • 3
  • +2
20 Comments
 
LVL 104

Expert Comment

by:Sembee
ID: 18888714
Is this happening for all email, or just email from outside?
If it happening from with external email only then you need to look at the message headers of the duplicated messages and see if they are 100% identical or not. That will give you an idea if the duplication is taking place before or after delivery.

For example the problem could be that the sending server doesn't know that the message has been received correctly, so sends it again.
Alternatively, the message could be received correctly but something happens in the next hop.

Simon.
0
 

Author Comment

by:upl
ID: 18888795
This is happening only with outside mails (not with all emails but with some emails).
Message headers of the duplicated emails are 100% identical.
0
 
LVL 104

Expert Comment

by:Sembee
ID: 18893445
What does message tracking show?
Does it show multiple messages arriving on the Exchange server?

Simon.
0
 
LVL 11

Expert Comment

by:djxtreme
ID: 18902728
Just a quick question.

Is the email a legitimate email. Ie is it correclt addressed?
If not, who is it addressed to? do you have a catchall facility on your POP3 / Exchange server?
And lastly, if you look into one of hte headers, even though they are duplicate, are they repeating theirselves?
(ie you get the same server sending it multiple times).

sounds like a message is stuck bouncing around. Pause your outgoing queues, and remove your smarthost in your local SMTP connector (not the one used for forwarding external mail, but the one used for forwarding mail from your domain to somewhere else if you dont have a user assigned to that address. When all queues are paused for about 10-15 minutes, you should see a decrease in these messages. Wait till they stop coming, clean out all queues (both through the UI and manually check in program files/exchsvr/mailroot/queues (i think thats the dir). when everythings clear, re-enable the queues and see what happens.

i had this recently with a message that was incorrectly addressed. we get our email from a pop3 box, and forward it onto exchange. because exchange was looking for the outside world, and that meant the catchall POP3 box, it just looped and looped, peaking at about 100-200 per minute. nasty stuff.

0
 

Author Comment

by:upl
ID: 18904501
yes email is legitimate.how we can check that they are repeating themselves because sending time and date of all repeated messages are same.
i checked in mailroot/queue folder, it is empty.
we didn't enable message tracking.
0
 
LVL 104

Expert Comment

by:Sembee
ID: 18906465
You need to enable message tracking, because that is one of the few ways to know where the duplication is taking place.
The send time and date being identical is not a sign that the message is identical. The send date and time is created when the message is sent - it isn't changed en-route. Therefore a message can bounce around inside an ISPs server (for example) for months and come out with the old information in it. That is why you have to look at the SMTP headers of the message to see where the duplication may have occurred.

Simon.
0
 
LVL 11

Expert Comment

by:djxtreme
ID: 18907698
pull one of the headers out (right click the message in outlook, properties) and post it here for us to see.

OT : What rank is Savant??
0
 
LVL 104

Expert Comment

by:Sembee
ID: 18908502
0
 

Author Comment

by:upl
ID: 18916205
Message Header of repeated email.

Microsoft Mail Internet Headers Version 2.0
Received: from smtp.dsl.net.pk ([203.82.48.4]) by mailing.uchpower.com with Microsoft SMTPSVC(5.0.2195.6713);
       Thu, 12 Apr 2007 05:16:40 +0500
Received: from colony ([202.125.134.218])
      by smtp.dsl.net.pk (8.13.8/8.13.8) with ESMTP id l3ABdXYn010522;
      Tue, 10 Apr 2007 16:42:00 +0500 (PKT)
Received: from upl ([192.168.13.74]) by colony with Microsoft SMTPSVC(5.0.2195.6713);
       Tue, 10 Apr 2007 16:34:37 +0500
X-MSReally-From: ikhalid@uchpower.com
Reply-To: <ikhalid@uchpower.com>
From: "Imran Khalid" <ikhalid@uchpower.com>
To: "Javed Abbasi" <javed@uchpower.com>
Cc: "'Hasan Shehryar Malik'" <shehryar@uchpower.com>
Subject: FW: Police Camp near UPS - Quetta Highway
Date: Tue, 10 Apr 2007 16:30:25 +0500
Organization: Uch Power Limited
MIME-Version: 1.0
Content-Type: multipart/mixed;
      boundary="----=_NextPart_000_0090_01C77B8D.8B2C7420"
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2900.3028
Thread-index: Acd7WeyxSCqF9Nt9TJC0maVeRSnuiAACUbyw
Message-ID: <COLONYbeUzmRf6Ci6nx0000001b@colony>
X-OriginalArrivalTime: 10 Apr 2007 11:34:37.0843 (UTC) FILETIME=[38836630:01C77B64]
X-Virus-Scanned: ClamAV 0.88.7/3058/Tue Apr 10 00:45:50 2007 on smtp.dsl.net.pk
X-Virus-Status: Clean
Return-Path: ikhalid@uchpower.com

------=_NextPart_000_0090_01C77B8D.8B2C7420
Content-Type: multipart/alternative;
      boundary="----=_NextPart_001_0091_01C77B8D.8B2C7420"

------=_NextPart_001_0091_01C77B8D.8B2C7420
Content-Type: text/plain;
      charset="us-ascii"
Content-Transfer-Encoding: 7bit

------=_NextPart_001_0091_01C77B8D.8B2C7420
Content-Type: text/html;
      charset="us-ascii"
Content-Transfer-Encoding: quoted-printable


------=_NextPart_001_0091_01C77B8D.8B2C7420--
------=_NextPart_000_0090_01C77B8D.8B2C7420
Content-Type: image/jpeg;
      name="DSC_6806.JPG"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
      filename="DSC_6806.JPG"


------=_NextPart_000_0090_01C77B8D.8B2C7420--


Microsoft Mail Internet Headers Version 2.0
Received: from smtp.dsl.net.pk ([203.82.48.4]) by mailing.uchpower.com with Microsoft SMTPSVC(5.0.2195.6713);
       Fri, 13 Apr 2007 00:01:15 +0500
Received: from colony ([202.125.134.218])
      by smtp.dsl.net.pk (8.13.8/8.13.8) with ESMTP id l3ABdXYn010522;
      Tue, 10 Apr 2007 16:42:00 +0500 (PKT)
Received: from upl ([192.168.13.74]) by colony with Microsoft SMTPSVC(5.0.2195.6713);
       Tue, 10 Apr 2007 16:34:37 +0500
X-MSReally-From: ikhalid@uchpower.com
Reply-To: <ikhalid@uchpower.com>
From: "Imran Khalid" <ikhalid@uchpower.com>
To: "Javed Abbasi" <javed@uchpower.com>
Cc: "'Hasan Shehryar Malik'" <shehryar@uchpower.com>
Subject: FW: Police Camp near UPS - Quetta Highway
Date: Tue, 10 Apr 2007 16:30:25 +0500
Organization: Uch Power Limited
MIME-Version: 1.0
Content-Type: multipart/mixed;
      boundary="----=_NextPart_000_0090_01C77B8D.8B2C7420"
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2900.3028
Thread-index: Acd7WeyxSCqF9Nt9TJC0maVeRSnuiAACUbyw
Message-ID: <COLONYbeUzmRf6Ci6nx0000001b@colony>
X-OriginalArrivalTime: 10 Apr 2007 11:34:37.0843 (UTC) FILETIME=[38836630:01C77B64]
X-Virus-Scanned: ClamAV 0.88.7/3058/Tue Apr 10 00:45:50 2007 on smtp.dsl.net.pk
X-Virus-Status: Clean
Return-Path: ikhalid@uchpower.com

------=_NextPart_000_0090_01C77B8D.8B2C7420
Content-Type: multipart/alternative;
      boundary="----=_NextPart_001_0091_01C77B8D.8B2C7420"

------=_NextPart_001_0091_01C77B8D.8B2C7420
Content-Type: text/plain;
      charset="us-ascii"
Content-Transfer-Encoding: 7bit

------=_NextPart_001_0091_01C77B8D.8B2C7420
Content-Type: text/html;
      charset="us-ascii"
Content-Transfer-Encoding: quoted-printable


------=_NextPart_001_0091_01C77B8D.8B2C7420--
------=_NextPart_000_0090_01C77B8D.8B2C7420
Content-Type: image/jpeg;
      name="DSC_6806.JPG"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
      filename="DSC_6806.JPG"


------=_NextPart_000_0090_01C77B8D.8B2C7420--

0
Do email signature updates give you a headache?

Do you feel like you are constantly making changes to email signatures? Are the images not formatting how you want them to? Want high-quality HTML signatures on all devices, including on mobiles and Macs? Then, let Exclaimer solve all your email signature problems today.

 
LVL 104

Expert Comment

by:Sembee
ID: 18916771
The duplication is happening on the last step.

The last lines are different.

Received: from smtp.dsl.net.pk ([203.82.48.4]) by mailing.uchpower.com with Microsoft SMTPSVC(5.0.2195.6713);
       Fri, 13 Apr 2007 00:01:15 +0500

Received: from smtp.dsl.net.pk ([203.82.48.4]) by mailing.uchpower.com with Microsoft SMTPSVC(5.0.2195.6713);
       Thu, 12 Apr 2007 05:16:40 +0500

The message is being resent by the ISPs server.
That is classic signs of interference on the receiving side. The sending server doesn't know that the email has been delivered correctly so resends the message.

Firewall, AV etc would be the first place to look.

Simon.
0
 

Author Comment

by:upl
ID: 18917097
What about this repeated email.

Microsoft Mail Internet Headers Version 2.0
Received: from smtp.dsl.net.pk ([203.82.48.4]) by mailing.uchpower.com with Microsoft SMTPSVC(5.0.2195.6713);
       Sun, 15 Apr 2007 14:28:32 +0500
Received: from mail95.messagelabs.com (mail95.messagelabs.com [216.82.241.67])
      by smtp.dsl.net.pk (8.13.8/8.13.8) with SMTP id l3F0TrSx017785
      for <ssaqib@uchpower.com>; Sun, 15 Apr 2007 05:30:01 +0500 (PKT)
X-VirusChecked: Checked
X-Env-Sender: yasir.irshad@pk.abnamro.com
X-Msg-Ref: server-11.tower-95.messagelabs.com!1176466283!45228284!1
X-StarScan-Version: 5.5.10.7.1; banners=-,-,-
X-Originating-IP: [203.127.138.92]
Received: (qmail 1798 invoked from network); 13 Apr 2007 12:11:24 -0000
Received: from mail03.ap.abnamro.com (HELO mail03.ap.abnamro.com) (203.127.138.92)
  by server-11.tower-95.messagelabs.com with SMTP; 13 Apr 2007 12:11:24 -0000
Received: from aaapr001.abnamro.com (aaapr001 [10.111.11.43])
      by mail03.ap.abnamro.com (8.13.8/8.13.8) with ESMTP id l3DCB7Tb007878
      for <ssaqib@uchpower.com>; Fri, 13 Apr 2007 20:11:07 +0800 (SGT)
X-Priority: 1 (High)
To: ssaqib@uchpower.com
Subject: Proposal for Uch II
MIME-Version: 1.0
Importance: High
X-Mailer: Lotus Notes Release 6.5.5 HF423 May 09, 2006
Message-ID: <OF64EB8EE7.AEEFB2D4-ON452572BC.0042A129-452572BC.0042D197@abnamro.com>
From: yasir.irshad@pk.abnamro.com
Date: Fri, 13 Apr 2007 17:11:20 +0500
Disposition-Notification-To: yasir.irshad@pk.abnamro.com
X-MIMETrack: Serialize by Router on AAAPR001/HUB/ABNAMRO/NL(Release 6.5.4FP1|June 19, 2005) at
 04/13/2007 08:13:27 PM
Content-Type: multipart/mixed; boundary="=_mixed 0042D18F452572BC_="
X-Virus-Scanned: ClamAV 0.88.7/3091/Sat Apr 14 21:53:57 2007 on smtp.dsl.net.pk
X-Virus-Status: Clean
Return-Path: yasir.irshad@pk.abnamro.com
X-OriginalArrivalTime: 15 Apr 2007 09:28:32.0758 (UTC) FILETIME=[6F6FC960:01C77F40]

--=_mixed 0042D18F452572BC_=
Content-Type: multipart/alternative; boundary="=_alternative 0042D191452572BC_="

--=_alternative 0042D191452572BC_=
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable

--=_alternative 0042D191452572BC_=
Content-Type: text/html; charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable


--=_alternative 0042D191452572BC_=--
--=_mixed 0042D18F452572BC_=
Content-Type: application/octet-stream; name="Uch II Power Project Letter of Interest and Credentials v4.doc"
Content-Disposition: attachment; filename="Uch II Power Project Letter of Interest and Credentials v4.doc"
Content-Transfer-Encoding: base64


--=_mixed 0042D18F452572BC_=--



Microsoft Mail Internet Headers Version 2.0
Received: from mail95.messagelabs.com ([216.82.241.67]) by mailing.uchpower.com with Microsoft SMTPSVC(5.0.2195.6713);
       Sun, 15 Apr 2007 01:36:00 +0500
X-VirusChecked: Checked
X-Env-Sender: yasir.irshad@pk.abnamro.com
X-Msg-Ref: server-11.tower-95.messagelabs.com!1176466283!45228284!1
X-StarScan-Version: 5.5.10.7.1; banners=-,-,-
X-Originating-IP: [203.127.138.92]
Received: (qmail 1798 invoked from network); 13 Apr 2007 12:11:24 -0000
Received: from mail03.ap.abnamro.com (HELO mail03.ap.abnamro.com) (203.127.138.92)
  by server-11.tower-95.messagelabs.com with SMTP; 13 Apr 2007 12:11:24 -0000
Received: from aaapr001.abnamro.com (aaapr001 [10.111.11.43])
      by mail03.ap.abnamro.com (8.13.8/8.13.8) with ESMTP id l3DCB7Tb007878
      for <ssaqib@uchpower.com>; Fri, 13 Apr 2007 20:11:07 +0800 (SGT)
X-Priority: 1 (High)
To: ssaqib@uchpower.com
Subject: Proposal for Uch II
MIME-Version: 1.0
Importance: High
X-Mailer: Lotus Notes Release 6.5.5 HF423 May 09, 2006
Message-ID: <OF64EB8EE7.AEEFB2D4-ON452572BC.0042A129-452572BC.0042D197@abnamro.com>
From: yasir.irshad@pk.abnamro.com
Date: Fri, 13 Apr 2007 17:11:20 +0500
Disposition-Notification-To: yasir.irshad@pk.abnamro.com
X-MIMETrack: Serialize by Router on AAAPR001/HUB/ABNAMRO/NL(Release 6.5.4FP1|June 19, 2005) at
 04/13/2007 08:13:27 PM
Content-Type: multipart/mixed; boundary="=_mixed 0042D18F452572BC_="
Return-Path: yasir.irshad@pk.abnamro.com
X-OriginalArrivalTime: 14 Apr 2007 20:36:03.0864 (UTC) FILETIME=[8557D180:01C77ED4]

--=_mixed 0042D18F452572BC_=
Content-Type: multipart/alternative; boundary="=_alternative 0042D191452572BC_="

--=_alternative 0042D191452572BC_=
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable

--=_alternative 0042D191452572BC_=
Content-Type: text/html; charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable


--=_alternative 0042D191452572BC_=--
--=_mixed 0042D18F452572BC_=
Content-Type: application/octet-stream; name="Uch II Power Project Letter of Interest and Credentials v4.doc"
Content-Disposition: attachment; filename="Uch II Power Project Letter of Interest and Credentials v4.doc"
Content-Transfer-Encoding: base64


--=_mixed 0042D18F452572BC_=--



Microsoft Mail Internet Headers Version 2.0
Received: from mail95.messagelabs.com ([216.82.241.67]) by mailing.uchpower.com with Microsoft SMTPSVC(5.0.2195.6713);
       Fri, 13 Apr 2007 19:07:40 +0500
X-VirusChecked: Checked
X-Env-Sender: yasir.irshad@pk.abnamro.com
X-Msg-Ref: server-11.tower-95.messagelabs.com!1176466283!45228284!1
X-StarScan-Version: 5.5.10.7.1; banners=-,-,-
X-Originating-IP: [203.127.138.92]
Received: (qmail 1798 invoked from network); 13 Apr 2007 12:11:24 -0000
Received: from mail03.ap.abnamro.com (HELO mail03.ap.abnamro.com) (203.127.138.92)
  by server-11.tower-95.messagelabs.com with SMTP; 13 Apr 2007 12:11:24 -0000
Received: from aaapr001.abnamro.com (aaapr001 [10.111.11.43])
      by mail03.ap.abnamro.com (8.13.8/8.13.8) with ESMTP id l3DCB7Tb007878
      for <ssaqib@uchpower.com>; Fri, 13 Apr 2007 20:11:07 +0800 (SGT)
X-Priority: 1 (High)
To: ssaqib@uchpower.com
Subject: Proposal for Uch II
MIME-Version: 1.0
Importance: High
X-Mailer: Lotus Notes Release 6.5.5 HF423 May 09, 2006
Message-ID: <OF64EB8EE7.AEEFB2D4-ON452572BC.0042A129-452572BC.0042D197@abnamro.com>
From: yasir.irshad@pk.abnamro.com
Date: Fri, 13 Apr 2007 17:11:20 +0500
Disposition-Notification-To: yasir.irshad@pk.abnamro.com
X-MIMETrack: Serialize by Router on AAAPR001/HUB/ABNAMRO/NL(Release 6.5.4FP1|June 19, 2005) at
 04/13/2007 08:13:27 PM
Content-Type: multipart/mixed; boundary="=_mixed 0042D18F452572BC_="
Return-Path: yasir.irshad@pk.abnamro.com
X-OriginalArrivalTime: 13 Apr 2007 14:07:51.0946 (UTC) FILETIME=[1FDD6EA0:01C77DD5]

--=_mixed 0042D18F452572BC_=
Content-Type: multipart/alternative; boundary="=_alternative 0042D191452572BC_="

--=_alternative 0042D191452572BC_=
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable

--=_alternative 0042D191452572BC_=
Content-Type: text/html; charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable


--=_alternative 0042D191452572BC_=--
--=_mixed 0042D18F452572BC_=
Content-Type: application/octet-stream; name="Uch II Power Project Letter of Interest and Credentials v4.doc"
Content-Disposition: attachment; filename="Uch II Power Project Letter of Interest and Credentials v4.doc"
Content-Transfer-Encoding: base64


--=_mixed 0042D18F452572BC_=--
0
 
LVL 104

Expert Comment

by:Sembee
ID: 18917217
That would tend to show the problem is with the transfer of the message to the last server in the chain.
The reason there are different servers listed in the message is because you have multiple MX records, one if which isn't responding

http://www.dnsreport.com/tools/dnsreport.ch?domain=uchpower.com

My suggestion to you at this time is to remove the MX records that point to your ISP, remove the non-responsive MX record as well, so that there is only one MX record listed.
That will then allow you to narrow down where the problem is.

The problem appears to be the last hop.

Simon.
0
 
LVL 11

Expert Comment

by:djxtreme
ID: 18921102
Quick few questions before you go changing MX records;

the IP's that your MX is pointing at, are they your exchange / ISA servers? or do you host the email elsewhere, and pull it down using a POP3 connector?

Its a bit late, and im a bit wired so Ill have to have a re-read of the headers int he morning after a coffee or two ;)

Reason I ask about the POP3, is simple. If you have a pop3 server, with a catchall account that exchange is polling, try creating a seperate account on the server. Send some email to it, see if you get any loops. If so, then you can rule out your Exchange server, and get onto your hosting company, allowing their boff's to take over.

If you dont get any loops, its a exchange problem. Is your exchange all service packed up? I seem to remember reading a KB article regarding a looping email issue within Exchange.

Have a read through these two aricles, and check out what the point out. Moving MX records is going to kill your email completley for a good 24hours + (given the time to move them back) if anything goes wrong with the pointers. These will step you through being able to track the messages through the queuing system, and see what route they are coming in and going out with.

http://support.microsoft.com/kb/924239/en-us
http://support.microsoft.com/kb/823489/en-us

Also, Sembee, congrats on the Savant rank. Hopefully one day I can get up there with you *laugh*. just gotta learn not to read my EE email at 11pm at night after a long day at work playing with exchange/server. who knew that a corrupt IIS could kill exchange2003 so badly lol.

one last note, as a disclaimer. as stated it is late, and my head refuses to make sense of the message headers posted, so my advise is generic advise to read through and try before playing with MX records. I certainly would, however, resolvet he dead MX record, as that may cause problems if the other 2 become unresponsive due to excessive timeouts, etc. The suggestions I make should mean no downtime on incoming email, with maybe a small downtime on outgoint (see previous post where I suggested stopping all outgoing email on your Exchange to see if the problem straightened out.)

Goodluck and i look forward to your post!
0
 

Author Comment

by:upl
ID: 19035812
We are planning to shift our MX records to our ISP, as in our current senario our MX records are hosted to one ISP and bandwidth from another ISP.
0
 
LVL 104

Expert Comment

by:Sembee
ID: 19036020
You don't need to have your MX records with your ISP. I actually discourage that. I don't like putting all of my services with one company because it limits your options in the event something goes wrong.

Simon.
0
 
LVL 2

Expert Comment

by:synergiq
ID: 19745025
We are having a similar problem, this is currently happening with SBS 2003 fully SP'd up. Looking around found this article on the Microsoft Knowledge Base : http://support.microsoft.com/kb/264249 Seems its a "feature" of the POP3 Connector?
0
 

Author Comment

by:upl
ID: 19751707
I had shifted my
0
 

Author Comment

by:upl
ID: 19751725
I shifted my MX records to my ISP and also removed the non-responsive MX record. Now it seems that the problem has been resolved.
0
 
LVL 1

Accepted Solution

by:
Computer101 earned 0 total points
ID: 20560474
PAQed with points refunded (500)

Computer101
EE Admin
0

Featured Post

Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Suggested Solutions

Resolve DNS query failed errors for Exchange
Local Continuous Replication is a cost effective and quick way of backing up Exchange server data. The following article describes the steps required to configure Local Continuous Replication. Also, the article tells you how to restore from a backup…
To show how to generate a certificate request in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Servers >> Certificates…
To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now