Link to home
Start Free TrialLog in
Avatar of upl
upl

asked on

Receiving multiple copies of an email through exchange 2003 server

I have windows 2000 server installed as domain controller and exchange 2003 server installed on windows 2000 server as member server. ISA 2000 server is installed as front end server. Exchange server is published through ISA server and all the traffic is going through ISA server. Now the problem is that we are receiving emails multiple times and from the last two days the number of repeated emails increased dramatically. Can anybody expalin if an email is received mutiple times, the problem will be at sender's email server or recipient email server. What i have to do to resolve this issue.
Microsoft outlook 2003 is installed at clients end and is configued as exchange server client.
Avatar of Sembee
Sembee
Flag of United Kingdom of Great Britain and Northern Ireland image

Is this happening for all email, or just email from outside?
If it happening from with external email only then you need to look at the message headers of the duplicated messages and see if they are 100% identical or not. That will give you an idea if the duplication is taking place before or after delivery.

For example the problem could be that the sending server doesn't know that the message has been received correctly, so sends it again.
Alternatively, the message could be received correctly but something happens in the next hop.

Simon.
Avatar of upl
upl

ASKER

This is happening only with outside mails (not with all emails but with some emails).
Message headers of the duplicated emails are 100% identical.
What does message tracking show?
Does it show multiple messages arriving on the Exchange server?

Simon.
Avatar of Stephen Croft
Just a quick question.

Is the email a legitimate email. Ie is it correclt addressed?
If not, who is it addressed to? do you have a catchall facility on your POP3 / Exchange server?
And lastly, if you look into one of hte headers, even though they are duplicate, are they repeating theirselves?
(ie you get the same server sending it multiple times).

sounds like a message is stuck bouncing around. Pause your outgoing queues, and remove your smarthost in your local SMTP connector (not the one used for forwarding external mail, but the one used for forwarding mail from your domain to somewhere else if you dont have a user assigned to that address. When all queues are paused for about 10-15 minutes, you should see a decrease in these messages. Wait till they stop coming, clean out all queues (both through the UI and manually check in program files/exchsvr/mailroot/queues (i think thats the dir). when everythings clear, re-enable the queues and see what happens.

i had this recently with a message that was incorrectly addressed. we get our email from a pop3 box, and forward it onto exchange. because exchange was looking for the outside world, and that meant the catchall POP3 box, it just looped and looped, peaking at about 100-200 per minute. nasty stuff.

Avatar of upl

ASKER

yes email is legitimate.how we can check that they are repeating themselves because sending time and date of all repeated messages are same.
i checked in mailroot/queue folder, it is empty.
we didn't enable message tracking.
You need to enable message tracking, because that is one of the few ways to know where the duplication is taking place.
The send time and date being identical is not a sign that the message is identical. The send date and time is created when the message is sent - it isn't changed en-route. Therefore a message can bounce around inside an ISPs server (for example) for months and come out with the old information in it. That is why you have to look at the SMTP headers of the message to see where the duplication may have occurred.

Simon.
pull one of the headers out (right click the message in outlook, properties) and post it here for us to see.

OT : What rank is Savant??
Avatar of upl

ASKER

Message Header of repeated email.

Microsoft Mail Internet Headers Version 2.0
Received: from smtp.dsl.net.pk ([203.82.48.4]) by mailing.uchpower.com with Microsoft SMTPSVC(5.0.2195.6713);
       Thu, 12 Apr 2007 05:16:40 +0500
Received: from colony ([202.125.134.218])
      by smtp.dsl.net.pk (8.13.8/8.13.8) with ESMTP id l3ABdXYn010522;
      Tue, 10 Apr 2007 16:42:00 +0500 (PKT)
Received: from upl ([192.168.13.74]) by colony with Microsoft SMTPSVC(5.0.2195.6713);
       Tue, 10 Apr 2007 16:34:37 +0500
X-MSReally-From: ikhalid@uchpower.com
Reply-To: <ikhalid@uchpower.com>
From: "Imran Khalid" <ikhalid@uchpower.com>
To: "Javed Abbasi" <javed@uchpower.com>
Cc: "'Hasan Shehryar Malik'" <shehryar@uchpower.com>
Subject: FW: Police Camp near UPS - Quetta Highway
Date: Tue, 10 Apr 2007 16:30:25 +0500
Organization: Uch Power Limited
MIME-Version: 1.0
Content-Type: multipart/mixed;
      boundary="----=_NextPart_000_0090_01C77B8D.8B2C7420"
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2900.3028
Thread-index: Acd7WeyxSCqF9Nt9TJC0maVeRSnuiAACUbyw
Message-ID: <COLONYbeUzmRf6Ci6nx0000001b@colony>
X-OriginalArrivalTime: 10 Apr 2007 11:34:37.0843 (UTC) FILETIME=[38836630:01C77B64]
X-Virus-Scanned: ClamAV 0.88.7/3058/Tue Apr 10 00:45:50 2007 on smtp.dsl.net.pk
X-Virus-Status: Clean
Return-Path: ikhalid@uchpower.com

------=_NextPart_000_0090_01C77B8D.8B2C7420
Content-Type: multipart/alternative;
      boundary="----=_NextPart_001_0091_01C77B8D.8B2C7420"

------=_NextPart_001_0091_01C77B8D.8B2C7420
Content-Type: text/plain;
      charset="us-ascii"
Content-Transfer-Encoding: 7bit

------=_NextPart_001_0091_01C77B8D.8B2C7420
Content-Type: text/html;
      charset="us-ascii"
Content-Transfer-Encoding: quoted-printable


------=_NextPart_001_0091_01C77B8D.8B2C7420--
------=_NextPart_000_0090_01C77B8D.8B2C7420
Content-Type: image/jpeg;
      name="DSC_6806.JPG"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
      filename="DSC_6806.JPG"


------=_NextPart_000_0090_01C77B8D.8B2C7420--


Microsoft Mail Internet Headers Version 2.0
Received: from smtp.dsl.net.pk ([203.82.48.4]) by mailing.uchpower.com with Microsoft SMTPSVC(5.0.2195.6713);
       Fri, 13 Apr 2007 00:01:15 +0500
Received: from colony ([202.125.134.218])
      by smtp.dsl.net.pk (8.13.8/8.13.8) with ESMTP id l3ABdXYn010522;
      Tue, 10 Apr 2007 16:42:00 +0500 (PKT)
Received: from upl ([192.168.13.74]) by colony with Microsoft SMTPSVC(5.0.2195.6713);
       Tue, 10 Apr 2007 16:34:37 +0500
X-MSReally-From: ikhalid@uchpower.com
Reply-To: <ikhalid@uchpower.com>
From: "Imran Khalid" <ikhalid@uchpower.com>
To: "Javed Abbasi" <javed@uchpower.com>
Cc: "'Hasan Shehryar Malik'" <shehryar@uchpower.com>
Subject: FW: Police Camp near UPS - Quetta Highway
Date: Tue, 10 Apr 2007 16:30:25 +0500
Organization: Uch Power Limited
MIME-Version: 1.0
Content-Type: multipart/mixed;
      boundary="----=_NextPart_000_0090_01C77B8D.8B2C7420"
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2900.3028
Thread-index: Acd7WeyxSCqF9Nt9TJC0maVeRSnuiAACUbyw
Message-ID: <COLONYbeUzmRf6Ci6nx0000001b@colony>
X-OriginalArrivalTime: 10 Apr 2007 11:34:37.0843 (UTC) FILETIME=[38836630:01C77B64]
X-Virus-Scanned: ClamAV 0.88.7/3058/Tue Apr 10 00:45:50 2007 on smtp.dsl.net.pk
X-Virus-Status: Clean
Return-Path: ikhalid@uchpower.com

------=_NextPart_000_0090_01C77B8D.8B2C7420
Content-Type: multipart/alternative;
      boundary="----=_NextPart_001_0091_01C77B8D.8B2C7420"

------=_NextPart_001_0091_01C77B8D.8B2C7420
Content-Type: text/plain;
      charset="us-ascii"
Content-Transfer-Encoding: 7bit

------=_NextPart_001_0091_01C77B8D.8B2C7420
Content-Type: text/html;
      charset="us-ascii"
Content-Transfer-Encoding: quoted-printable


------=_NextPart_001_0091_01C77B8D.8B2C7420--
------=_NextPart_000_0090_01C77B8D.8B2C7420
Content-Type: image/jpeg;
      name="DSC_6806.JPG"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
      filename="DSC_6806.JPG"


------=_NextPart_000_0090_01C77B8D.8B2C7420--

The duplication is happening on the last step.

The last lines are different.

Received: from smtp.dsl.net.pk ([203.82.48.4]) by mailing.uchpower.com with Microsoft SMTPSVC(5.0.2195.6713);
       Fri, 13 Apr 2007 00:01:15 +0500

Received: from smtp.dsl.net.pk ([203.82.48.4]) by mailing.uchpower.com with Microsoft SMTPSVC(5.0.2195.6713);
       Thu, 12 Apr 2007 05:16:40 +0500

The message is being resent by the ISPs server.
That is classic signs of interference on the receiving side. The sending server doesn't know that the email has been delivered correctly so resends the message.

Firewall, AV etc would be the first place to look.

Simon.
Avatar of upl

ASKER

What about this repeated email.

Microsoft Mail Internet Headers Version 2.0
Received: from smtp.dsl.net.pk ([203.82.48.4]) by mailing.uchpower.com with Microsoft SMTPSVC(5.0.2195.6713);
       Sun, 15 Apr 2007 14:28:32 +0500
Received: from mail95.messagelabs.com (mail95.messagelabs.com [216.82.241.67])
      by smtp.dsl.net.pk (8.13.8/8.13.8) with SMTP id l3F0TrSx017785
      for <ssaqib@uchpower.com>; Sun, 15 Apr 2007 05:30:01 +0500 (PKT)
X-VirusChecked: Checked
X-Env-Sender: yasir.irshad@pk.abnamro.com
X-Msg-Ref: server-11.tower-95.messagelabs.com!1176466283!45228284!1
X-StarScan-Version: 5.5.10.7.1; banners=-,-,-
X-Originating-IP: [203.127.138.92]
Received: (qmail 1798 invoked from network); 13 Apr 2007 12:11:24 -0000
Received: from mail03.ap.abnamro.com (HELO mail03.ap.abnamro.com) (203.127.138.92)
  by server-11.tower-95.messagelabs.com with SMTP; 13 Apr 2007 12:11:24 -0000
Received: from aaapr001.abnamro.com (aaapr001 [10.111.11.43])
      by mail03.ap.abnamro.com (8.13.8/8.13.8) with ESMTP id l3DCB7Tb007878
      for <ssaqib@uchpower.com>; Fri, 13 Apr 2007 20:11:07 +0800 (SGT)
X-Priority: 1 (High)
To: ssaqib@uchpower.com
Subject: Proposal for Uch II
MIME-Version: 1.0
Importance: High
X-Mailer: Lotus Notes Release 6.5.5 HF423 May 09, 2006
Message-ID: <OF64EB8EE7.AEEFB2D4-ON452572BC.0042A129-452572BC.0042D197@abnamro.com>
From: yasir.irshad@pk.abnamro.com
Date: Fri, 13 Apr 2007 17:11:20 +0500
Disposition-Notification-To: yasir.irshad@pk.abnamro.com
X-MIMETrack: Serialize by Router on AAAPR001/HUB/ABNAMRO/NL(Release 6.5.4FP1|June 19, 2005) at
 04/13/2007 08:13:27 PM
Content-Type: multipart/mixed; boundary="=_mixed 0042D18F452572BC_="
X-Virus-Scanned: ClamAV 0.88.7/3091/Sat Apr 14 21:53:57 2007 on smtp.dsl.net.pk
X-Virus-Status: Clean
Return-Path: yasir.irshad@pk.abnamro.com
X-OriginalArrivalTime: 15 Apr 2007 09:28:32.0758 (UTC) FILETIME=[6F6FC960:01C77F40]

--=_mixed 0042D18F452572BC_=
Content-Type: multipart/alternative; boundary="=_alternative 0042D191452572BC_="

--=_alternative 0042D191452572BC_=
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable

--=_alternative 0042D191452572BC_=
Content-Type: text/html; charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable


--=_alternative 0042D191452572BC_=--
--=_mixed 0042D18F452572BC_=
Content-Type: application/octet-stream; name="Uch II Power Project Letter of Interest and Credentials v4.doc"
Content-Disposition: attachment; filename="Uch II Power Project Letter of Interest and Credentials v4.doc"
Content-Transfer-Encoding: base64


--=_mixed 0042D18F452572BC_=--



Microsoft Mail Internet Headers Version 2.0
Received: from mail95.messagelabs.com ([216.82.241.67]) by mailing.uchpower.com with Microsoft SMTPSVC(5.0.2195.6713);
       Sun, 15 Apr 2007 01:36:00 +0500
X-VirusChecked: Checked
X-Env-Sender: yasir.irshad@pk.abnamro.com
X-Msg-Ref: server-11.tower-95.messagelabs.com!1176466283!45228284!1
X-StarScan-Version: 5.5.10.7.1; banners=-,-,-
X-Originating-IP: [203.127.138.92]
Received: (qmail 1798 invoked from network); 13 Apr 2007 12:11:24 -0000
Received: from mail03.ap.abnamro.com (HELO mail03.ap.abnamro.com) (203.127.138.92)
  by server-11.tower-95.messagelabs.com with SMTP; 13 Apr 2007 12:11:24 -0000
Received: from aaapr001.abnamro.com (aaapr001 [10.111.11.43])
      by mail03.ap.abnamro.com (8.13.8/8.13.8) with ESMTP id l3DCB7Tb007878
      for <ssaqib@uchpower.com>; Fri, 13 Apr 2007 20:11:07 +0800 (SGT)
X-Priority: 1 (High)
To: ssaqib@uchpower.com
Subject: Proposal for Uch II
MIME-Version: 1.0
Importance: High
X-Mailer: Lotus Notes Release 6.5.5 HF423 May 09, 2006
Message-ID: <OF64EB8EE7.AEEFB2D4-ON452572BC.0042A129-452572BC.0042D197@abnamro.com>
From: yasir.irshad@pk.abnamro.com
Date: Fri, 13 Apr 2007 17:11:20 +0500
Disposition-Notification-To: yasir.irshad@pk.abnamro.com
X-MIMETrack: Serialize by Router on AAAPR001/HUB/ABNAMRO/NL(Release 6.5.4FP1|June 19, 2005) at
 04/13/2007 08:13:27 PM
Content-Type: multipart/mixed; boundary="=_mixed 0042D18F452572BC_="
Return-Path: yasir.irshad@pk.abnamro.com
X-OriginalArrivalTime: 14 Apr 2007 20:36:03.0864 (UTC) FILETIME=[8557D180:01C77ED4]

--=_mixed 0042D18F452572BC_=
Content-Type: multipart/alternative; boundary="=_alternative 0042D191452572BC_="

--=_alternative 0042D191452572BC_=
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable

--=_alternative 0042D191452572BC_=
Content-Type: text/html; charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable


--=_alternative 0042D191452572BC_=--
--=_mixed 0042D18F452572BC_=
Content-Type: application/octet-stream; name="Uch II Power Project Letter of Interest and Credentials v4.doc"
Content-Disposition: attachment; filename="Uch II Power Project Letter of Interest and Credentials v4.doc"
Content-Transfer-Encoding: base64


--=_mixed 0042D18F452572BC_=--



Microsoft Mail Internet Headers Version 2.0
Received: from mail95.messagelabs.com ([216.82.241.67]) by mailing.uchpower.com with Microsoft SMTPSVC(5.0.2195.6713);
       Fri, 13 Apr 2007 19:07:40 +0500
X-VirusChecked: Checked
X-Env-Sender: yasir.irshad@pk.abnamro.com
X-Msg-Ref: server-11.tower-95.messagelabs.com!1176466283!45228284!1
X-StarScan-Version: 5.5.10.7.1; banners=-,-,-
X-Originating-IP: [203.127.138.92]
Received: (qmail 1798 invoked from network); 13 Apr 2007 12:11:24 -0000
Received: from mail03.ap.abnamro.com (HELO mail03.ap.abnamro.com) (203.127.138.92)
  by server-11.tower-95.messagelabs.com with SMTP; 13 Apr 2007 12:11:24 -0000
Received: from aaapr001.abnamro.com (aaapr001 [10.111.11.43])
      by mail03.ap.abnamro.com (8.13.8/8.13.8) with ESMTP id l3DCB7Tb007878
      for <ssaqib@uchpower.com>; Fri, 13 Apr 2007 20:11:07 +0800 (SGT)
X-Priority: 1 (High)
To: ssaqib@uchpower.com
Subject: Proposal for Uch II
MIME-Version: 1.0
Importance: High
X-Mailer: Lotus Notes Release 6.5.5 HF423 May 09, 2006
Message-ID: <OF64EB8EE7.AEEFB2D4-ON452572BC.0042A129-452572BC.0042D197@abnamro.com>
From: yasir.irshad@pk.abnamro.com
Date: Fri, 13 Apr 2007 17:11:20 +0500
Disposition-Notification-To: yasir.irshad@pk.abnamro.com
X-MIMETrack: Serialize by Router on AAAPR001/HUB/ABNAMRO/NL(Release 6.5.4FP1|June 19, 2005) at
 04/13/2007 08:13:27 PM
Content-Type: multipart/mixed; boundary="=_mixed 0042D18F452572BC_="
Return-Path: yasir.irshad@pk.abnamro.com
X-OriginalArrivalTime: 13 Apr 2007 14:07:51.0946 (UTC) FILETIME=[1FDD6EA0:01C77DD5]

--=_mixed 0042D18F452572BC_=
Content-Type: multipart/alternative; boundary="=_alternative 0042D191452572BC_="

--=_alternative 0042D191452572BC_=
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable

--=_alternative 0042D191452572BC_=
Content-Type: text/html; charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable


--=_alternative 0042D191452572BC_=--
--=_mixed 0042D18F452572BC_=
Content-Type: application/octet-stream; name="Uch II Power Project Letter of Interest and Credentials v4.doc"
Content-Disposition: attachment; filename="Uch II Power Project Letter of Interest and Credentials v4.doc"
Content-Transfer-Encoding: base64


--=_mixed 0042D18F452572BC_=--
That would tend to show the problem is with the transfer of the message to the last server in the chain.
The reason there are different servers listed in the message is because you have multiple MX records, one if which isn't responding

http://www.dnsreport.com/tools/dnsreport.ch?domain=uchpower.com

My suggestion to you at this time is to remove the MX records that point to your ISP, remove the non-responsive MX record as well, so that there is only one MX record listed.
That will then allow you to narrow down where the problem is.

The problem appears to be the last hop.

Simon.
Quick few questions before you go changing MX records;

the IP's that your MX is pointing at, are they your exchange / ISA servers? or do you host the email elsewhere, and pull it down using a POP3 connector?

Its a bit late, and im a bit wired so Ill have to have a re-read of the headers int he morning after a coffee or two ;)

Reason I ask about the POP3, is simple. If you have a pop3 server, with a catchall account that exchange is polling, try creating a seperate account on the server. Send some email to it, see if you get any loops. If so, then you can rule out your Exchange server, and get onto your hosting company, allowing their boff's to take over.

If you dont get any loops, its a exchange problem. Is your exchange all service packed up? I seem to remember reading a KB article regarding a looping email issue within Exchange.

Have a read through these two aricles, and check out what the point out. Moving MX records is going to kill your email completley for a good 24hours + (given the time to move them back) if anything goes wrong with the pointers. These will step you through being able to track the messages through the queuing system, and see what route they are coming in and going out with.

http://support.microsoft.com/kb/924239/en-us
http://support.microsoft.com/kb/823489/en-us

Also, Sembee, congrats on the Savant rank. Hopefully one day I can get up there with you *laugh*. just gotta learn not to read my EE email at 11pm at night after a long day at work playing with exchange/server. who knew that a corrupt IIS could kill exchange2003 so badly lol.

one last note, as a disclaimer. as stated it is late, and my head refuses to make sense of the message headers posted, so my advise is generic advise to read through and try before playing with MX records. I certainly would, however, resolvet he dead MX record, as that may cause problems if the other 2 become unresponsive due to excessive timeouts, etc. The suggestions I make should mean no downtime on incoming email, with maybe a small downtime on outgoint (see previous post where I suggested stopping all outgoing email on your Exchange to see if the problem straightened out.)

Goodluck and i look forward to your post!
Avatar of upl

ASKER

We are planning to shift our MX records to our ISP, as in our current senario our MX records are hosted to one ISP and bandwidth from another ISP.
You don't need to have your MX records with your ISP. I actually discourage that. I don't like putting all of my services with one company because it limits your options in the event something goes wrong.

Simon.
We are having a similar problem, this is currently happening with SBS 2003 fully SP'd up. Looking around found this article on the Microsoft Knowledge Base : http://support.microsoft.com/kb/264249 Seems its a "feature" of the POP3 Connector?
Avatar of upl

ASKER

I had shifted my
Avatar of upl

ASKER

I shifted my MX records to my ISP and also removed the non-responsive MX record. Now it seems that the problem has been resolved.
ASKER CERTIFIED SOLUTION
Avatar of Computer101
Computer101
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial