exchange not delivery all emails - MSExchangeTransport

Hi
I am having a problem where some of my accounts are not reciving email,
and some are reviving email very sporadically.
I am getting a lot of MSExchangeTransport errors in event viewer.
event id 3018, 7004.
I saw a previus artivle about filtering but this seems to be setup fine.
I was getting mail fine myself, but now my account is getting none(however i have differnt domain for my mail, i.e second domain added to reciepeint poilicies).
Thanks
Stephen


Would this b
cstephen100Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

greesh_hemCommented:
This is one of two things.

1. DNS problems.
2. Spam.

If the emails are not ones that you normally would expect to go through your server and you have significant amounts of messages in the queues then spam attack is the likely cause.

If your queues are clear or have very small numbers of messages then it could be DNS.
Verify that you have internal DNS servers listed in the DNS configuration on the Exchange server - they should be pointed at the domain controllers only.
You may then need to configure forwarders on your DNS Server configuration on the domain controllers to use your ISPs DNS servers.
0
cstephen100Author Commented:

Hi,
  I looked at the queues in esm,  and there is literrally 2699 entries in here, most of these are for domains ending in .tw,
i.e  1111.com.tw,  123.job.tw etc... (i have attached image to show you what i mean)
this to me doesnt look to good :-(.,
Is this a spam attack or related?
how do i go about stopping this?
hope you can help here..
thanks
Stephen

queses.JPG
0
MesthaCommented:
Your server is being abused.
You should not have those numbers of messages in there. You need to find out how and then close the hole.

Start with my spam cleanup article: http://www.amset.info/exchange/spam-cleanup.asp

Basically it is either an open relay, authenticated relay or NDR attack.

Simon.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

cstephen100Author Commented:

thanks for replies,
i followed guides above thanks,
however,
the smtp virtual connector is very slow starting, i mean esm is running but not responding for 4hrs approx, is this normal?
thanks
stephen
0
MesthaCommented:
If the server is being abused then that is not unusual.
ESM is notorious for struggling to show the true extent of the queues after the server has been abused.

Simon.
0
cstephen100Author Commented:
cheers,
what i meant to ask you, is should i let it start normally, or is there other way?
if i have to wait thats fine.
thanks
stephen
0
MesthaCommented:
You will need to wait, things will be very sluggish as the server is probably trying to process many 1000s of messages.

Hopefully you have blocked port 25 on your firewall so that new messages do not continue to come in.

Simon.
0
cstephen100Author Commented:
hi guys,
i went though steps on above links, and everything seems to be set so server is not relay server,
however,
my server still seems to be targetted by the spammers, also when a delete queues i have loads of empty queses as shown in picture.
  Maybe i should open seperate question for this?  but bascially is there more i have to do to stop server been used for spam,
Also the no external domains are reciving emails even though it looks like there sent?
thanks
stephen

0
cstephen100Author Commented:
i feel i should award points here and open new question for new issues?
0
MesthaCommented:
If the queues are empty, then that is fine. It takes Exchange a while to remove the empty queues from the list. What you need to watch for is messages in the queues.

Simon.
0
cstephen100Author Commented:
there seems to be messages going into the queses again :-(,
and external domains dont seem to be recieving mails, plus I checked www.dnsstuff.com and it told me my domain is blacklisted,
doesnt sound good,
thanks for help Simon
Im under a bit of pressure with it,
cheers again
Stephen
0
MesthaCommented:
Domains do not get blacklisted, hosts do.
You now have two quesitons running, which means there will be some duplication. As I wrote in the other question - you need to close port 25 to ensure that no new emails are coming in.

Simon.
0
cstephen100Author Commented:

Hi simon,
I woke this morning and was pleasently suprised to see that the queses had reduced,
and email seems to be working fine, i am being pestered a bit about missing mails from yesterday but ill get over that :-).
Thanks ever so much!
Stephen

P.s:  on a note, they need to get decent AV for sever and mail server, Is there any you would recommend? i noticed avast does 30 day trial.
thanks again
Stephen

0
MesthaCommented:
AV - you pays your money and takes your choice. I usually suggest either Forefront or GFI Mail Security. Both have multiple engines. You want something different to what is on your workstations.

The messages would go over time on their own, as they time out after 48 hours. However that wouldn't stop your server from being blacklisted.

Simon.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.