Exchange 2010 / Internal Users receiving Bounce Back Messages Due to Corrupt Message Content

I have just migrated to Exchange 2010 (last week) and now mail to internal users seem to be randomly getting bounce back messages because of Corrupt content. The Original Exchange 2003 Server is still up and the Exchange 2010 is set as a Hub transport server. There is no Antivirus on the box and no SMTP device sitting inbetween the 2 servers. If they immediately resend the message the email goes through. Below is an example:

Delivery has failed to these recipients or groups:

Jeff M****** (jmc****
The e-mail system had a problem processing this message. Exchange will not try to redeliver this message for you.

Jeff L****(jll***
The e-mail system had a problem processing this message. Exchange will not try to redeliver this message for you.

Paul S****** (p*****
The e-mail system had a problem processing this message. Exchange will not try to redeliver this message for you.

Andrew K****** (a*****
The e-mail system had a problem processing this message. Exchange will not try to redeliver this message for you.

Diagnostic information for administrators:

Generating server: NATMAIL2.nwat.local

#554 5.6.0 STOREDRV.Deliver; Corrupt message content ##

#554 5.6.0 STOREDRV.Deliver; Corrupt message content ##

#554 5.6.0 STOREDRV.Deliver; Corrupt message content ##

#554 5.6.0 STOREDRV.Deliver; Corrupt message content ##

Original message headers:

Received: from NATMAIL2.nwat.local ([fe80::49f4:8fd3:4ae5:db8d]) by
 NATMAIL2.nwat.local ([fe80::49f4:8fd3:4ae5:db8d%19]) with mapi; Tue, 5 Jan
 2010 08:49:09 -0800
Content-Type: application/ms-tnef; name="winmail.dat"
Content-Transfer-Encoding: binary
From: John S*******t <js*****>
To: Shane J******** <sJ*******>, Brian Tulloch <>,
      Andrew K******* <a*******>
CC: Jeff M***** <j********>, Jeff Leek <>, Paul Sobotta
Subject: FW: Proposal Support Information
Thread-Topic: Proposal Support Information
Thread-Index: AQHKjaTVV//kquxwFEa64gw6Sn+V9ZGHDQfwgAAlhNA=
Date: Tue, 5 Jan 2010 08:49:06 -0800
Message-ID: <72E07E4DFE82FB4685954276EC6882660238AE@NATMAIL2.nwat.local>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator: <72E07E4DFE82FB4685954276EC6882660238AE@NATMAIL2.nwat.local
Who is Participating?
Alan HardistyConnect With a Mentor Co-OwnerCommented:
That sounds like a corrupted .OST file to me.
You can probably eliminate the problem by deleting the .OST file locally on the PC (with outlook closed) and then open up Outlook, which will then re-create the .OST file and problem should be gone.
A little weird, but perfectly plausible.
Alan HardistyCo-OwnerCommented:
You have migrated from 2003 to 2010 and still have the 2003 box up and running.
Are you planning to lose the 2003 box or are you waiting to resolve this issue before pulling the plug?
Does your mail flow in via the 2003 server and then get pushed to the 2010 box or does it arrive directly to the 2010 box?
You mention that there is no AV installed anywhere?  Nothing on your firewall?  No Forefront installed?
Can you please post the output you see in the Exchange Management Shell when you issue:
supportnatAuthor Commented:
Yes the 2003 Box is still up and running - I am just waiting to remove it from the environment - frankly letting the dust settle before pulling the plug. All users and the public folders have been moved off the server.

It is arriving directly to the new 2010 box.

I have kaspersky running on the machines - and then all external mail flows through a barracuda spam and virus filter - neither the mail client or Forefront is installed on the server yet.

This is what returns from that command:

Identity                                                   Enabled                                 Priority
Transport Rule Agent                                True                                       1
Text Messaging Routing Agent                  True                                       2
Text Messaging Delivery Agent                 True                                       3
CodeTwoExchangeRules                           True                                      4

I did have 2 transport rules enabled for some exclaimer text and Email signatures but have since removed the rules and added CodeTwo for that service. The problem was happening before the addition of the Disclaimers in either form.


Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Alan HardistyCo-OwnerCommented:
Okay - the Barracuda bit is the part that I think may be the area to focus on.  I have a 2003 to 2010 migrated server and have no such problems (I have other problems, but not messed up messages!) and I would suspect that the Barracuda may be interfering with the messages as Exchange is pretty robust at handling the mail and will not screw it up, that is usually the job of anti-virus software!
Can you bypass the Barracuda for testing purposes and see if you can reproduce the problem?
Is the Barracuda up-to-date in terms of Firmware?
supportnatAuthor Commented:
No the Barracuda is not in the equation at all - the problems are only happening on messages internal to internal users - the barracuda only scans incoming messages from the outside.

Barracuda is completely up to date though.
Alan HardistyCo-OwnerCommented:
Ah - sorry - forgot that part about it only being internal mail!
Does this affect all users or just a select few internal recipients?
You say it is random - can you reproduce the problem at will or is it truly random?
supportnatAuthor Commented:
I have not found a way to reproduce the error with any consistency - If the user resends a fresh message to the same user with the attachment the mail will go through - And it fails with different attachment types - Power Point Visio etc.
Alan HardistyCo-OwnerCommented:
Thanks - does it only happen with attachments?
Can you uninstall Kaspersky from two users and get them to send mail to each other with / without attachments and see if you can reproduce the error.
Disabling Kaspersky won't be sufficient I am afraid.
supportnatAuthor Commented:
Yep have already tried sending from machines minues Kaspersky with no luck - also if it was Kaspersky it should be consistent with the type of attachment.

Yes the problem happens with either attachments OR insertions into the mail - one failed this morning with and excel sheet copied and pasted into the mail.
Alan HardistyCo-OwnerCommented:
Okay - similar to my issue - can you please create two brand new user account with mailboxes and then test sending and receiving between these two new accounts.
My migration has left me without POP3 for migrated accounts, yet if I create a brand new account it works just fine!
Couple of quick questions:
  1. What version of Office are your users running?
  2. Is office patched fully?
  3. Are the workstations up-to-date with Windows Updates / Service Packs?
supportnatAuthor Commented:
1) Office 2007
2) Yes - SP 2 - 98 percent of all clients are up to date according to WSUS (Just checking it)
3) All XP stations are SP 3 and the Windows 7 machines are up to date.

I am almost positive it is how the exchange server is handling the mail - if it was something client based it would be happening with more than just internal users.
Alan HardistyCo-OwnerCommented:
Whilst you are testing the two new accounts!  Can you please also try the same with existing accounts using OWA only.
Just trying to see if there is something common going on :-)
supportnatAuthor Commented:
Okay I am not sure what caused the issue but I have found a way that seems to fix the problem.

1) First try and remove Cache mode from the outlook clients - close outlook, restart it - activate cahce mode AGAIN shut down and restart this fixes the issue sometimes.

2) Sometimes this does work so it requires you delete the entire mail profile and then recreate it - problem solved no more bounce backs.

At this point I am guessing something went goofy with the cache on some machines and needed a fresh start. Minor Headache but it would be nice if MS would document this and let people know what is causing this issue...
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.