<div>
Microsoft's definition is:<br />
<br />
For example, you may receive a warning state notification message or a critical state notification message if an undeliverable e-mail message remains in the SMTP queue while all other e-mail is delivered successfully. In this scenario, you cannot determine whether the notification message that you receive indicates a problem with the SMTP queue that requires administrative action to address.<br />
<br />
It also say's it's a known issue with Exchange and recommend Rollups to Exch 2003 SP2.<br />
<br />
Can you confirm your service pack Level. Your Tag says SBS so has the SP1 been applied for SBS?<br />
<br />
If so I suggest installing SP2 for Exch 2003
</div>


<div>
Sp1 for SBS has been installed, as well as Sp2 for Exchange. I am current ony patches and service packs. This is a wierd problem, that started out of the blue. I've been trying to check the queues when I get the message but the thing that alarms me is the default value for warning about the queu growth is 10 minutes, so what happens if a message is undeliverable for 10 mins? I get emailed... So what alarms me is that I'm just now starting to get the alerts. I'm a bit confused as to why, and I don't fully understand the reason behind the alerts being there at all.
</div>


<div>
First thing to check will be DNS.<br />
<br />
Ensure there are NO DNS servers listed in the Default SMTP Virtual Server.<br />
<br />
Then ensure that the local DNS Servers are funcitoning correctly. You could try add an external DNS server to the Exchange NIC as a secondary to test. i.e. 194.145.241.6
</div>


<div>
We do not use a smart host, we use local DNS to send email. In any rate I verfied this to be sure. &nbsp;We do have forwarding on our DNS server, to our ISP DNS.<br />
<br />
I still don't understand the meaning and relation of smtp queu growth and the email messages being sent to me. What I mean is The default timeout for a message is Urgent - 2 days, Normal - 7 Days, and Non-urgent - 10 days. So why the heck would I want it to notify me every 10 minutes? Something doesn't seem right to me, could you explain this a bit?
</div>


<div>
I'm concerned about the growth limit, and what it says current growth. Currently it says 233, earlier today when I received the message it said 300 something, and yesterday it said the same. So even setting the value you suggest I'm likely to receive the message again regardless. Having said that I'm begining to feel there is something that changed or happened recently. I am the only person who manages the systems so it would be impossible it was something someone else did. The thing is however I haven't changed anything, or even applied any updates as of late.
</div>


<div>
How mnay items are in the Queues?<br />
<br />
Is you SMTP Connector set to send via DNS or via a Smart Host? I assume it will be DNS?<br />
As a quick DNS Test, go to the Properties of the SMTP Virtual Server &gt;&nbsp;Delivery and Click Advanced.<br />
<br />
Press configure on configure external DNS servers and add the following DNS servers.<br />
<br />
194.145.240.6<br />
194.145.241.6<br />
<br />
Try flush your queues, do the emails leave the server?<br />
<br />
If so, monitor the server for a while and see if you continue to get the warning emails.<br />
<br />
If you do, then it's something that needs further investigation such as your DNS Mail Server Config (Reverse DNS ETC).<br />
<br />
If you don't you will need to remove those DNS entries and diagnose the issue with your internal DNS servers.
</div>


<div>
How mnay items are in the Queues?<br />
When I get the email alert, I check the queues and it appears to be 1 item, but I'm not entirely sure the problem is acuratelly being reported upon. For instance I came in this morning and checked the queues but I know there is a message in the queue that has been there for around 24 hours now.<br />
<br />
First try 10 mins<br />
Second try 10 mins<br />
Third try 10 mins<br />
Sub tries 15 mins<br />
Delay notification &nbsp;12 hours<br />
Expiration 3 days<br />
<br />
So expanding on that you can see from the values about it is normal if a message is improperly addressed or something it could be there for up to three days. Now here is where I scratch my head, and it all doesn't make sense. The email notification I've been receiving has a value of 10 minutes, which is pretty low, and I'm confused as to why after so long am I know just seeing these.<br />
<br />
Is you SMTP Connector set to send via DNS or via a Smart Host? I assume it will be DNS?<br />
You are correct. I am unable to add those DNS servers to my Virtual SMTP server, because I do not know where they are, or who they belong to. If you feel it is really worth while, and that this may prove to be a DNS problem I would be willing to but we should talk about those DNS servers first. I hope you understand.<br />
<br />
Try flush your queues, do the emails leave the server?<br />
Yes<br />
<br />
If so, monitor the server for a while and see if you continue to get the warning emails.<br />
I've been monitoring the server, and I'm getting close to making an opinion. The emails that seem to be sitting in the queue are from postmaster@mydomain.com to user@somedomain.com. What I saw today was two messages that caused me to be alerted yesterday twice. Those two emails after sitting in the queue for the 10 minutes it takes to trigger the alert. Those were the emails I flushed today and they successfully left the queue. I just deleted them with NDR.<br />
<br />
The domains looked a little fishy, and I think that they didn't exist, or the users didn't exist. For example the one domain was @my-realbox.com and the other was @yahoo.com.jp. I'm sure you can see the assumption that I am coming to. They however sent a message through my spam firewall to my users, the system generated an NDR, and attempted to send it back to them. That means I have two problems, how do I track the message in the queue back to the original message sent that generated the response, and my original question of why is this the first time these alerts are happening?<br />

</div>


<div>
The emails that are looking fishy is probably NDR spam and there is very little you can do about stopping that, so it still leaves us with the same issue.<br />
<br />
Most problems with mail NOT leaving is usually DNS related.<br />
<br />
Those DNS servers mentioned are the Open Recursive DNS Servers of the HSP I work for. NS1.ANCARB.COM and NS2.ANCARB.COM. I know them to be fully functional/<br />
<br />
If you try them in your exchange config it should rule out DNS issues<br />
<br />
The other option is to configure a smart host so that your mail flows through a trusted source and that again rules out DNS issues in an Exchange Environment.<br />
<br />
-BBRazz
</div>


<div>
I did what you asked, and it did not resolve the issue. As I stated, every time I get these notifications I am checking the queue, and finding that they are going to non existant domains, or domains that do not have MX records setup for them. I am confirming this by checking the domain and it's public records at DNSSTUFF.com.<br />
<br />
So this leaves me one of two options which are increase the timeout, or make the messages expire faster. Alternatively I could just ignore the messages all together, but I'm not so sure that is the right decision either.
</div>


<div>
So, I figured out where they are coming from at least. I have a user which is simply configured as a contact within my organization because he technically resides at another. For the sake of this conversation we will call him bob@otherdomain.com and my domain will be referred to as mydomain.com. I tested the email forwarder this morning it works fine. So I looked at the queue this morning and found another NDR waiting to go to another domain which did not exist, and I receive the email that I posted about. I confirmed it was a bogus domain by querying the domain's public records at dnsstuff.com and failed to find any. In any rate I queried my spam filter and exchange message tracker, and found the following.<br />
<br />
User@fakedomain emailed bob@mydomain.com which was then forwarded to bob@otherdomain.com.<br />
<br />
Two issues here<br />
<br />
I have his spam filtering turned off, because the user requires that he check his email at his organization's spam filter. I'm not going to be able to turn this on, because it isn't my call to make. In any rate if the spam filtering was turned on, it would stop these messages. I wish I could turn it back on, and tone it down so to speak, but I can't.<br />
<br />
The NDR should have been sent by bob's actual server, but because I was forwarding the message, maybe my server is required to send the NDR? I can't figure out why my server is being stuck with the NDR.<br />
<br />
Any ideas?
</div>


<div>
If the forwarding was sucessful, the NDR shouldn't exist. In the SMTP logs does it show the email as being rejected by anotherdomain.com's mail server?<br />
<br />
-BBRazz<br />

</div>


<div>
x.x.x.x - spamfilter.domain.com [27/Jul/2008:23:22:46 -0500] &quot;EHLO -? spamfilter.domain.com SMTP&quot; 250 292<br />
x.x.x.x - spamfilter.domain.com [27/Jul/2008:23:22:46 -0500] &quot;MAIL -? FROM:&lt;yokoe@techtelnet.net<wbr />&gt; SMTP&quot; 250 45<br />
x.x.x.x - spamfilter.domain.com [27/Jul/2008:23:22:46 -0500] &quot;RCPT -? TO:&lt;bob@otherdomain.com&gt; SMTP&quot; 250 40<br />
x.x.x.x - spamfilter.domain.com [27/Jul/2008:23:22:46 -0500] &quot;DATA -? &lt;7870A455.D1F019EE@techtel<wbr />net.net&gt; SMTP&quot; 250 118<br />
x.x.x.x - spamfilter.domain.com [27/Jul/2008:23:22:46 -0500] &quot;QUIT -?spamfilter.domain.com SMTP&quot; 240 71<br />
x.x.x.x - OutboundConnectionResponse<wbr /> [27/Jul/2008:23:22:52 -0500] &quot;- -?220 otherdomain.com ESMTP SMTP&quot; 0 32<br />
x.x.x.x - OutboundConnectionCommand [27/Jul/2008:23:22:52 -0500] &quot;EHLO -?mailserver.domain.com SMTP&quot; 0 4<br />
x.x.x.x - OutboundConnectionResponse<wbr /> [27/Jul/2008:23:22:52 -0500] &quot;- -?250-mailserver.otherdoma<wbr />in.com Hello mailserver.mydomain.com [X.X.X.X], pleased to meet you SMTP&quot; 0 93<br />
x.x.x.x - OutboundConnectionCommand [27/Jul/2008:23:22:52 -0500] &quot;MAIL -?FROM:&lt;yokoe@techtelnet.n<wbr />et&gt; SIZE=8614 SMTP&quot; 0 4<br />
x.x.x.x - OutboundConnectionResponse<wbr /> [27/Jul/2008:23:22:52 -0500] &quot;- -?553 5.1.8 &lt;yokoe@techtelnet.net&gt;... Domain of sender address yokoe@techtelnet.net does not exist SMTP&quot; 0 96<br />
x.x.x.x - OutboundConnectionCommand [27/Jul/2008:23:22:52 -0500] &quot;QUIT - SMTP&quot; 0 4<br />
x.x.x.x - OutboundConnectionResponse<wbr /> [27/Jul/2008:23:22:52 -0500] &quot;- -?221 2.0.0 mailserver.otherdomain.com<wbr /> closing connection SMTP&quot; 0 51<br />
<br />
That's what my logs say. Which says that the end mail server refused the message, and stuck me with the bill. So hmmm. I'm guessing that is an exchange recipient filter that says if rDNS lookup fails, reject. Regardless, I would think that it would pickup the message and send the NDR itself, but that isn't happening.<br />

</div>


<div>
There are two things to check to try avoid this. Is this NDR Spam, are are you being a used as a relay?<br />
<br />
The article below is be the EE Expert Sembee and should help diagnose and clear or prevent it continuing.<br />
<br />
<a href="http://www.amset.info/exchange/spam-cleanup.asp" rel="ugc">http://www.amset.info/exchange/spam-cleanup.asp</a><br />
-BBRazz<br />

</div>


<div>
Is this NDR Spam, are you being a used as a relay?<br />
<br />
No, open relay is not allowed. To be sure I did the test, and it behaved as expected. I restrict relay per IP, and currently the other systems allowed to relay are blocked from access from the Internet. <br />
<br />
As stated before the messages are coming from a bogus domain, to a valid user on my network. The thing is however that user's email is not being filtered for spam, and is directly being forwarded to their actual mail server which is as another organization. That mail server will accept any mail that it receives for that user, from us, but the problem as I see it that mail server will reject email from bogus domains. That's when I get stuck with the NDR, and it sits in my queue, and it triggers the alert.<br />
<br />
You have been great, and I can't tell you enough how this has benefited me. I really learned a lot with your help regarding the alerting.<br />
<br />
At this point I feel my options are limited. It would be nice if I could set a conditional rule that said if user to user@domain.com (which is forwarded to the other organization) bounces back stating &quot;sender domain does not exist&quot; delete message w/o NDR. I'm pretty sure what I'm interested in is &quot;Sender ID Filtering&quot; but that is done at a global level. I have a need for that regardless, so I soon will be looking into that. For now, do you know if that is something that can be set through policy at a granular level?<br />
<br />
The only other option I can come up with is simply raising the alert level for the SMTP queues to ignore it. I'm not so sure that is a good idea, and I'm not so just ignoring the emails that come in from time to time is a bad idea either.<br />
<br />
Having said that my spam filter does a great job at filtering my spam, and bogus domains. However it does not quarantine everything that an rDNS cannot be found for. It also doesn't care if the server sending the message has an open relay, unless on my spam filter reputation list. So I've had to take certain measures to increase what is quarantined. I think it might be time to explore &quot;Sender ID Filtering&quot;.<br />

</div>


<div>
<div class="content wysiwyg-content">
I have a server that keeps sending me the below messages<br />
<br />
From: &lt;WMI@SERVER&gt;<br />
Sender: &lt;WMI@SERVER&gt;<br />
Subject: Warning on ZEUS<br />
<br />
Server has reported a Warning. &nbsp;Reported status is:<br />
Queues - Warning<br />
Drives - OK<br />
Services - OK<br />
Memory - Unknown<br />
CPU - Unknown<br />
<br />
There messages are being generated from Exchange System Manager and I'm concerned about somethings. First I am a bit green when it comes to backbone Exchange technology. The administration part is easy. So I'm unsure what smtp queues &nbsp;growth period really means. I tried to google it and I found <a href="http://support.microsoft.com/kb/889180" rel="ugc nofollow">http://support.microsoft.com/kb/889180</a>. That got me worried, but it didn't state what it ment. My conclusion of what it means is time a message sites in the queue? Assuming I'm right doesn't this conflict with Microsoft Exchange default settings?<br />
<br />
For example the defaults for message timeouts are listed below<br />
Urgent - 2 days<br />
Normal - 7 Days<br />
Non-urgent - 10 days<br />
<br />
I have to be wrong about what smtp queues growth means. Someone please clarify.
</div>
</div>


I have a server that keeps sending me the below messages

From: <WMI@SERVER>
Sender: <WMI@SERVER>
Subject: Warning on ZEUS

Server has reported a Warning.  Reported status is:
Queues - Warning
Drives - OK
Services - OK
Memory - Unknown
CPU - Unknown

There messages are being generated from Exchange System Manager and I'm concerned about somethings. First I am a bit green when it comes to backbone Exchange technology. The administration part is easy. So I'm unsure what smtp queues  growth period really means. I tried to google it and I found http://support.microsoft.com/kb/889180. That got me worried, but it didn't state what it ment. My conclusion of what it means is time a message sites in the queue? Assuming I'm right doesn't this conflict with Microsoft Exchange default settings?

For example the defaults for message timeouts are listed below
Urgent - 2 days
Normal - 7 Days
Non-urgent - 10 days

I have to be wrong about what smtp queues growth means. Someone please clarify.

What is smtp queues growth period

Exchange is the server side of a collaborative application product that is part of the Microsoft Server infrastructure. Exchange's major features include email, calendaring, contacts and tasks, support for mobile and web-based access to information, and support for data storage.

Exchange

Windows Server 2003 was based on Windows XP and was released in four editions: Web, Standard, Enterprise and Datacenter. It also had derivative versions for clusters, storage and Microsoft’s Small Business Server. Important upgrades included integrating Internet Information Services (IIS), improvements to Active Directory (AD) and Group Policy (GP), and the migration to Automated System Recovery (ASR).

Windows Server 2003

Small Business Server (SBS) is a line of server operating systems targeted at small businesses by bundling the operating system with a number of other Microsoft products that would normally need to be purchased or licensed separately. The most notable inclusions are Exchange, SQL Server, SharePoint and ISA/TMG (Microsoft's firewall and proxy server).